TenantGuard

TenantGuard is a purpose-built CLI and MCP server for securing multi-tenant AI-agent deployments. While broad governance tools and general IaC scanners miss agent-specific isolation defects, TenantGuard goes deep. Using 16 fail-closed OPA/Rego rules mapped to real-world vulnerabilities, it instantly catches unscoped sandbox mounts, cross-tenant cron bindings, SSRF tool URLs, and exec credential leaks. It outputs in SARIF, JSON, and MCP and is licensed with Apache-2.0.