{"slug": "a-happy-path-mcp-demo-proves-almost-nothing-about-tenant-isolation", "title": "A happy-path MCP demo proves almost nothing about tenant isolation", "summary": "A developer built an open-source preflight scanner for Model Context Protocol (MCP) servers that checks tool metadata and behavior for tenant-isolation and scope risks before deployment. The scanner runs four static rules (MCP-001 through MCP-004) covering unsafe command declarations, excessive filesystem or network scope, secret-like values in metadata, and untrusted input reaching sensitive operations, plus behavioral checks against a local fixture server, producing Markdown and JSON reports with pass, fail, blocked, or incomplete statuses. The developer frames it as a bounded first pass that narrows the surface for human security review rather than a penetration test or certification.", "body_md": "Most MCP demos look the same. A tool is registered. A client calls it. The tool returns the expected data. Everyone nods.\n\nThat demo tells you the tool can work. It tells you nothing about what happens when the tool is given the wrong tenant ID, or when it declares scope it should not have, or when it is about to reach users who did not write it.\n\nI built a preflight scanner for exactly that gap. This post is about what a bounded preflight can actually check, and what it honestly cannot.\n\nAn MCP tool is a capability. Some capabilities are safe to hand out freely. Others are not.\n\nCommon risky declarations:\n\n`filesystem:*` or `network:*` scope when it only needs to read one directory.\nThese are not exotic. They show up in real MCP servers being shipped right now.\n\nThe scanner I built runs two kinds of checks: static and behavioral.\n\nStatic rules look at the tool metadata: name, description, declared scopes, and any command patterns. Four rules cover the common cases:\n\n`MCP-001`: unsafe command declaration. Anything that runs a shell or takes a free-form command string.`MCP-002`: excessive filesystem or network scope. Anything that declares `network:egress` when the tool clearly does not need it.`MCP-003`: secret-like value in tool metadata. Anything that looks like an API key, token, or password embedded in a description or default config.`MCP-004`: untrusted input reaching a sensitive operation. Anything where user input flows into a command, a file path, or a URL without an obvious boundary.\nBehavioral checks actually call a local fixture server and observe what happens:\n\nEach check produces a pass, fail, blocked, or incomplete status. Nothing is reported as a pass if it was not actually run.\n\nOne run produces both a Markdown report and a JSON report. Each finding has:\n\nThe point is that a finding becomes an engineering task, not a vague warning.\n\nIt is not a penetration test. It is not a certification. It is not a scan of a real customer environment. It does not replace a real security review.\n\nIt is a bounded, repeatable first pass. It catches the obvious things before they ship, and it does so without pretending to be more than it is.\n\nA preflight can tell you that a tool declares too much scope. It cannot tell you that the scope is intentional and appropriate for the business. That is a decision for the team.\n\nA preflight can tell you that a write tool ran without an approval. It cannot tell you whether the approval was correctly granted in a real workflow. That is a process question.\n\nThe scanner is a filter. It narrows the surface for the human review that still has to happen.\n\nThe code is at [github.com/glatinone/mcp-security-preflight](https://github.com/glatinone/mcp-security-preflight). If your team is about to expose MCP tools to users or internal agents and wants a bounded first pass, I take short sprints on exactly this. [kielltampubolon.id](https://www.kielltampubolon.id/)", "url": "https://wpnews.pro/news/a-happy-path-mcp-demo-proves-almost-nothing-about-tenant-isolation", "canonical_source": "https://dev.to/kielltampubolon/a-happy-path-mcp-demo-proves-almost-nothing-about-tenant-isolation-17p", "published_at": "2026-09-11 04:20:33+00:00", "updated_at": "2026-09-11 04:55:38.359831+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools", "ai-infrastructure"], "entities": ["Model Context Protocol", "MCP", "github.com/glatinone/mcp-security-preflight", "kielltampubolon.id"], "alternates": {"html": "https://wpnews.pro/news/a-happy-path-mcp-demo-proves-almost-nothing-about-tenant-isolation", "markdown": "https://wpnews.pro/news/a-happy-path-mcp-demo-proves-almost-nothing-about-tenant-isolation.md", "text": "https://wpnews.pro/news/a-happy-path-mcp-demo-proves-almost-nothing-about-tenant-isolation.txt", "jsonld": "https://wpnews.pro/news/a-happy-path-mcp-demo-proves-almost-nothing-about-tenant-isolation.jsonld"}}