The multi-tenant isolation challenge
In a multi-tenant SaaS application, agents belonging to Company A and Company B connect to the same central MCP server. If tenant isolation relies solely on prompt instructions, prompt injections can trick an agent into executing tools against another customer’s data.
True multi-tenant MCP architecture requires hardware-level credential scoping and tenant context injection at the HTTP transport layer.
Tenant Context Extraction in Streamable HTTP Handlers
Here is how to extract and bind tenant context from incoming JWT headers before delegating tool execution.
TYPESCRIPT
import { McpServer } from '@modelcontextprotocol/server';
import { z } from 'zod';
export function createTenantScopedServer(orgId: string, allowedAllowlist: string[]) {
const server = new McpServer({
name: `sadasend-tenant-${orgId}`,
version: '2.0.0'
});
server.tool(
'send_tenant_email',
'Dispatches email within the organization scope.',
{ to: z.string().email(), subject: z.string(), body: z.string() },
async ({ to, subject, body }) => {
// 1. Enforce strict tenant allowlist partition
const domain = to.split('@')[1];
if (!allowedAllowlist.includes(domain)) {
return {
isError: true,
content: [{ type: 'text', text: `Security Refusal: ${domain} is outside Org ${orgId} allowlist.` }]
};
}
// 2. Dispatch using tenant-specific scoped key
const res = await fetch('https://api.sadasend.com/v1/emails', {
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.SADASEND_MASTER_KEY}`,
'X-Tenant-Org-ID': orgId,
'Content-Type': 'application/json'
},
body: JSON.stringify({ to, subject, text: body })
});
const data = await res.json();
return { content: [{ type: 'text', text: `Queued with ID: ${data.id}` }] };
}
);
return server;
}Core Multi-Tenant Architectural Requirements
- Dynamic Rate Limiting: Prevent a single noisy tenant from consuming cluster capacity.
- Partitioned Audit Logs: Every tool invocation must be tagged with OrgId, AgentId, and IP.
- Cryptographic Data Isolation: Ensure tenant API keys cannot be read across worker memory spaces.
Early Access
Building AI agents that send email?
Join the SadaSend early access waitlist to get scoped API keys, recipient allowlists, and Model Context Protocol (MCP) servers upon launch.