Enterprise SaaS / Security
RAG agents across tenant boundaries
One retrieval agent answers questions over many customers’ documents, calling search and fetch tools against shared indexes.
Real example — shipping today
source →Anthropic · Model Context Protocol (MCP)
Retrieval agents increasingly reach data through MCP tool servers over shared indexes — the exact surface where a mislabeled document or crafted query can cross a tenant boundary.
The danger without a gate
The classic multi-tenant RAG failure: a crafted query or a mislabeled document lets the agent surface another tenant’s data, and the breach stays invisible until a customer sees their information in someone else’s answer.
How MCPIP handles it, step by step
Read it top to bottom. Each step shows the real command and exactly what MCPIP returns — the same allow / step-up / denied envelope every time.
The agent searches its own tenant
The retrieval target resolves through a tenant-scoped opaque alias inside its own compartment. It authorizes, seals the record, and returns documents.
$ mcpip --json authorize skill_docs_search --arg query='refund policy'{
"decision": "allow",
"status": "executed",
"transaction_ref": "txn_2d77c9",
"executed_target_class": "rest",
"worm_sequence": 48218,
"correlation_id": "6b0c9f2a"
}attackThe attack: a crafted query reaches for tenant B
Another tenant’s corpus simply has no name inside this compartment. The reference resolves to nothing, so it fails closed — and a deny is opaque, so the agent can’t probe why.
$ mcpip --json authorize skill_docs_search_tenant_b --arg query='payroll'{
"error": "denied",
"correlation_id": "9a4410ce"
}The result
One agent serving many tenants with zero cross-tenant bleed — and proof of every document it touched.
The same flow, at a glance
Every command above runs against a local sandbox in one line.
run it yourself — curl … | bash && mcpip up →