Topic starter
23/06/2026 7:25 pm
TL;DR: A malicious npm package can rewrite local Claude Code MCP routing, capture OAuth bearer tokens, and replay them against SaaS services, according to PermitIO's analysis of the Mitiga-reported chain. The incident shows that valid scopes and clean SaaS logs are not enough when runtime tool-call authorization is missing.
Editorial analysis by NHI Mgmt Group, based on content published by PermitIO: “Claude Code MCP Token Theft Shows Why OAuth Tokens Need Runtime Tool-Call Authorization”.
Key questions
Q: What breaks when local MCP routing can be rewritten by code running on a developer workstation?
A: The trust assumption that a valid token is reaching the intended service breaks first.
Q: Why do valid OAuth tokens still create risk for AI coding agents and MCP tools?
A: Because a token proves capability was granted, not that each call is safe now.
Q: What are the signs that runtime authorisation is missing from an agent tool chain?
A: Common signs include tool calls that succeed solely because a token exists, approval checks that happen only once at setup, and logs that record actions but not the policy decision behind them.
Practitioner guidance
- Audit MCP routing integrity Monitor ~/.claude.json and related MCP server files for endpoint, host, and protocol drift, and tie any change back to the process that made it.
- Control install-time execution paths Restrict or review package lifecycle scripts such as preinstall and postinstall, especially on developer workstations that can reach production tools.
- Enforce runtime policy at tool execution Place a policy decision point in front of agent tool calls so allowlists, denies, and approval gates evaluate each request in context.
Bottom line: The article shows that MCP token theft is really a routing and authorisation problem, because a valid token can still be delivered through a compromised local path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:24 am
Runtime authorisation, not token possession, is now the control that matters for agent tool use. The article shows that a bearer token can be technically valid while the request path has already been compromised. That means the decisive governance question is no longer only who holds the secret, but whether the call itself is still permitted under current policy. Practitioners should treat the tool-call boundary as an authorisation surface in its own right.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams respond when an AI coding agent's local configuration is compromised?
A: Contain the workstation first, verify MCP routing and related config integrity, then revoke and re-issue credentials after the path is restored. If rotation happens before the routing layer is cleaned up, the attacker can simply capture the replacement token as well. The response order matters because the path is the compromise point.
👉 Read our full editorial: Claude Code MCP token theft shows why runtime auth matters