TenantGuard

What is TenantGuard and why does it exist

TenantGuard is a command-line policy-as-code scanner, written in Go and built on OPA/Rego, that audits a self-hosted multi-tenant AI-agent platform's configuration for tenant-isolation defects: the class of bug where one tenant's agent, sandbox, cron job, or credential can reach or affect another tenant.

TenantGuard exists because a real, confirmed multi-tenant AI-agent platform (goclaw) has had multiple open, unresolved issues in exactly this category, including a sandbox mount not scoped per tenant, a cross-agent authorization gap, an exec tool that leaks secrets through an indirect path, an approval bypass keyed on a filename instead of a real path scope, and an SSRF validation mismatch on saved tool URLs and LLM provider connections. No existing general-purpose IaC scanner (Checkov, Conftest, PolicyGuard) or AI-agent security scanner (AgentShield) checks for this specific failure category: cross-tenant isolation in a self-hosted, multi-agent deployment. TenantGuard fills that gap with 16 fail-closed rules, each traceable to a real, cited issue.

TenantGuard is not a generic Terraform/Kubernetes scanner and does not replace Checkov or Conftest for general cloud-infrastructure misconfiguration. It is scoped specifically to the tenant-isolation surface of self-hosted multi-tenant agent deployments.

How is TenantGuard different from a generic IaC scanner like Checkov or Conftest?Checkov and Conftest scan general infrastructure-as-code (Terraform, Kubernetes, CloudFormation, and similar) for broad categories of misconfiguration. Neither ships a rule pack for multi-tenant AI-agent deployments. TenantGuard's 16 rules are purpose-built for that one surface: sandbox mounts, cron/agent bindings, MCP tool registrations, LLM provider connections, exec approvals, and channel/session identity, each derived from a real, cited defect.

Does TenantGuard replace OPA or Conftest?No. TenantGuard's rules are written in Rego and TenantGuard bundles its own evaluation path; it is a purpose-built policy pack and CLI, not a general-purpose Rego test harness. If you need to test arbitrary structured config against arbitrary Rego policies, Conftest is the right general tool. TenantGuard is the right tool specifically for tenant-isolation checks on a multi-agent deployment.

What does the HIPAA citation on each finding mean?Every finding is annotated with a related HIPAA Security Rule citation (e.g. Sec164.312(a)(1) Access Control) to help map a technical finding to a compliance control a reviewer may already track. These citations are markedprovisional: they indicate a plausible mapping between the technical control and the cited HIPAA section, not a legal or audited compliance determination. Treat them as a starting point for your own compliance review, not a substitute for one.

Does a PASS on TA02 (SSRF) mean the MCP tool URL is actually safe from DNS rebinding?Not fully. TA02 uses real CIDR containment against a literal or DNS-resolved IP, not string matching, but a PASS trusts the deployment's ownpins_resolved_ip/validates_privatedeclaration. TenantGuard cannot independently verify that the real validator pins the resolved IP for the actual connection, so a DNS-rebinding/TOCTOU risk persists if that declaration is inaccurate. This limitation is documented directly in the TA02 rule.

Can I scan a real deployment instead of the bundled demo?Yes:tenantguard scan --target <path-to-deployment-config-dir>.--demoexists so you can see the tool run with zero setup before pointing it at a real config.

Does TenantGuard produce output a CI pipeline or GitHub code scanning can consume?Yes.--format sarif --sarif-out <file>produces a schema-valid SARIF 2.1.0 document with real result locations and messages. The bundled GitHub Action (action/action.yml) runs a scan and uploads the SARIF report viagithub/codeql-action/upload-sarifin one step.

Why does TenantGuard have both--format sarifand--format json? Isn't SARIF already structured output?Yes, SARIF is a real, standard, machine-parseable format, and it is the right choice for CI/code-scanning integration.--format jsonexists for a different consumer: a script or agent that wants to parserule_id/status/file/linedirectly, without walking SARIF's tool/run/rule/taxonomy object model first. It also reports every PASS alongside every FAIL, which SARIF deliberately does not (SARIF results represent problems found, not a full checklist), so a caller can answer "what did you check" and not just "what did you flag" from one document. Note:--format jsonis onmain, not yet in the version the npm/pip packages install today, see the note under](#install)CLI Reference.

Is there an npm package?Yes,npm install -g tenantguard-cliis live and is the recommended install path (renamed from the old plaintenantguard, which is deprecated). It depends on a matching platform binary package as an npmoptionalDependency; all six platform packages are live (macOS x64/arm64, Linux x64/arm64, Windows x64/arm64). SeeInstallabove.

Is there a PyPI package?Yes,tenantguard-cliis live on PyPI (source underpython/, built and tested in CI). Versions up to and including 0.1.2 had a first-run bug that is fixed in 0.1.3 (seeInstallabove);pip install tenantguard-clinow works out of the box.

Can an AI agent run TenantGuard directly, without a human typing CLI commands?Yes, viatenantguard mcp, which starts an MCP server on stdio exposing the scan engine as ascantool. SeeMCP server (agent-native usage)above for the exact client config and tool arguments, and for the note on which install path has this today.

Can I use TenantGuard in a commercial or closed-source product?Yes. TenantGuard is licensed under the Apache License 2.0, which permits commercial use, modification, private use, and redistribution, including inside a proprietary or SaaS product, subject to the license's standard notice and attribution terms (retaining the copyright notice and a copy of the license, and marking any modified files). It comes with no warranty, as stated in the license. SeeLICENSEfor the full, authoritative terms.

Contributions are welcome. SeeCONTRIBUTING.mdfor how to add a new rule; every rule needs both a vulnerable and a clean fixture before it ships.

Build and deploy full-stack Next.js apps with 98 tools for React, AWS, and MongoDB