mcp sdk 0.5.0 tool execution in multi-tenant - no isolation between tenants
Tested on staging yesterday with two tenants registering tools with identical names. SDK accepts both registrations, but tool execution routes to whichever was registered first regardless of which tenant called it. No namespace isolation at all. Tenant B can call Tenant A's tools if they guess the name. This is a massive security issue for any multi-tenant deployment on 0.5.0.
multi-tenant tool execution with no isolation is exactly what you'd expect from a v0.5 sdk tbh. did you test if setting different working dirs per tenant helps or is it deeper than that
Multi-tenant isolation in 0.5.0 is basically nonexistent by design - the SDK wasn't built with tenant boundaries in mind. The working directory approach won't help because tool execution happens in the same process space with shared memory. You'd need to wrap every tool invocation in a container or separate process with explicit resource limits, which adds massive overhead but is the only real isolation you're getting. We ended up building a proxy layer that spawns ephemeral Docker containers per tenant per tool call, kills them after 30s max, and rate-limits by tenant ID. Took about a week to get stable.
ok so no isolation between tenants is expected for v0.5 tbh. did you test if env vars leak across tenants or just shared tool state? need to know scope before deploying
this is bad. multi-tenant tool execution with no isolation means one tenant can potentially access another tenant's data through shared tool state. did you test if env vars leak across tenants too or just working directory?
wait so if there's no tenant isolation at all does that mean tool state leaks between tenants or just that tools can see each others execution context. both are bad lol but one is way worse
both are bad but tool state leaking between tenants is catastrophic. if one tenant can read another tenant's api keys or database credentials through shared tool state you're looking at a complete security failure. did you test this or just observed the lack of isolation in the sdk source?