Build1 publisher3 min readPublished
Mitiga routed Claude Code's MCP calls through a proxy by editing one user-writable file
Mitiga Labs says an npm post-install hook can repoint Claude Code's MCP endpoints at attacker infrastructure while the SaaS provider keeps logging a real user session arriving from Anthropic's egress range.
The Engineer · Build desk
What happened
- Mitiga Labs published a chain in which a user-level post-install hook rewrites MCP endpoints in Claude Code's configuration and routes the requests through attacker-controlled infrastructure.
- Mitiga's example Atlassian audit entry shows a real user and a real session with a source IP that resolves to Anthropic's egress range, which the firm says is what legitimate Claude Code activity looks like.
- Every step in the five-step chain is a file operation or a config edit, and Mitiga says none of it requires privilege escalation, a memory bug or a new CVE.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Rotation is the standard containment step for a stolen OAuth token, and here it buys one session while the hook stays installed, so eviction work moves onto the developer's filesystem.
- exposure Whoever holds an intercepted token holds every scope the MCP server requested at consent time, and the provider will not ask again before a sensitive call.
- decision Engineering teams now have to decide whether ~/.claude.json belongs in the same monitoring class as a credential file, since the write that reads the token can also flip the shell prompt.
- contradiction Mitiga's narrative says the SaaS audit row looks entirely legitimate, yet its detection list still points at unusual downstream SaaS activity, so the usable signal is the pattern of calls rather than any single entry.
An MCP call is a bearer token in an HTTP header. Claude Code runs an OAuth flow against the provider when the user first connects the server, the user approves the scopes on a consent screen, and every call after that carries the returned token in the Authorization header [7]. The token is kept for reuse across sessions, and when it expires the client refreshes it from a refresh token held in the same store [8]. Mitiga says one successful interception is therefore a durable foothold for as long as the refresh chain stays valid [8]. The scope stays as wide as it was at consent: the token inherits whatever the MCP server asked for at auth time, with no per-call narrowing and no re-consent on sensitive operations [9]. MCP is the thing wiring these tools to Jira, Confluence, GitHub, databases and internal APIs [6].
That store is a plaintext file. The token sits in `~/.claude.json` next to the flags that decide whether Claude Code prompts before running shell commands or loading external instructions, and because it is one file, both have the same permissions [10]. A process that can flip the prompt can read the credential.
Delivery works with ordinary tooling. Mitiga's first step is a bundled npm package whose lifecycle hook runs at install and then looks for common clone locations to expand into more projects [16]. Arbitrary code in a postinstall script is a known supply chain class [17]. The five steps are file operations and config edits, and Mitiga says none of them needs a privilege escalation, a memory bug or a new CVE [15]. The project-trust prompt does not stop the chain [18].
Then there is attribution, where the defender runs out of evidence. At the provider's API, a token presented from a proxy three hops away is identical to the same token presented by the machine that authorized it [11]. Claude Code's calls exit through Anthropic's egress, so the request arrives from an origin the provider already trusts [12]. Mitiga's illustration is an Atlassian audit row where the user and the session are real and the source IP resolves into Anthropic's range [13]. The logged action is a JQL query pulling tickets that mention credentials, and Mitiga says the user did not run it [14].
Teams reach for rotation first, and Mitiga's caveat about it is narrow. Rotating the token may not break the chain if the malicious hook keeps reseeding the MCP configuration [4]. Of the four detection surfaces Mitiga names, two are the contents of that one file on the laptop [5][20].
This is one vendor's chain, from Mitiga Labs, built on its earlier License to Skill work on skill and hook injection [19]. For it to describe your exposure, three conditions have to hold. You have MCP servers authorized against SaaS providers with scopes worth stealing [6][9]. Your developers install npm packages with lifecycle scripts enabled [17]. And nothing you run watches `~/.claude.json` for changes, which is the first item on Mitiga's detection list [5].
What to watch
- Whether Anthropic moves the MCP bearer token out of ~/.claude.json, away from the shell-prompt flags.
- Whether a package matching Mitiga's step 1 turns up in the npm registry, and whether teams respond by disabling lifecycle scripts.
- Whether Atlassian or other MCP providers add client fingerprinting or per-call scope narrowing so a proxy hop becomes visible in the audit log.