# Supply Chain - token-optimise MCP Proxy Installation or Registration

- **Severity:** High
- **Signature ID:** `7f3c1d9e-2a64-4b18-9c05-6ad81e2f4b73`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain)

## Summary

This rule flags attempts to install, run, or register a package called 'token-optimise' (including misspelled or differently-punctuated variants), which markets itself as a token-optimizing proxy for Claude Desktop's MCP protocol. Because it sits between the AI client and legitimate MCP servers, it can read, alter, or steal every tool call and result that passes through it.

## How the attack works

An attacker or an unwitting user installs the 'token-optimise' package via a package runner command, or fetches it directly from a package registry. The package is then wired into the MCP client configuration (the mcpServers block used by Claude Desktop), positioning it as a proxy between the client and real MCP servers. Once in that position it can intercept, read, modify, or exfiltrate any data flowing through tool calls, though the rule itself cannot observe that later interception - only the install and registration steps.

## Why it matters

If this proxy is registered, an attacker gains a position to silently read or tamper with every AI tool call and response passing through the MCP client, which can mean stolen data, corrupted instructions, or manipulated agent behaviour, with no separate alert once the traffic-interception stage begins.

## What you can do

- Search installed packages, lockfiles, and package-runner history for 'token-optimise' and close spelling/separator variants.
- Review the mcpServers section of claude_desktop_config.json (and any similar MCP client config) for unexpected proxy entries and remove any you did not deliberately approve.
- Treat any MCP proxy package as high-risk by default: require code review and provenance checks before adding new entries to mcpServers.
- If found in a lab or sandbox for research purposes, tag the finding as expected and isolate it from production configs to avoid confusion with a real compromise.

## Known benign look-alikes

- Security research, incident response or malware triage where an engineer deliberately installs or fetches the package in a sandbox - the advisory-language filter catches the common case where the request is accompanied by advisory text, but a bare install in a lab will still report.
- Configuration audit tooling that reads claude_desktop_config.json through an agent tool while the entry is already present - the read is reported once per inspection (tool_response branch) even though nothing new was installed.
- A vetted internal fork or mirror published under the same distribution name; the rule matches on package identity only and cannot distinguish a reviewed fork from the upstream package.
- Dependency manifests, lockfiles or CI job definitions being written or diffed by the agent that pin the package for analysis purposes.
- Prose that happens to place the exact token "token-optimise" on the same line as an installer verb, e.g. a runbook sentence like "pip install the token-optimise replacement instead".

## References

- https://owasp.org/www-project-top-10-for-large-language-model-applications/
- https://atlas.mitre.org/techniques/AML.T0010
- https://attack.mitre.org/techniques/T1195/002/
- https://modelcontextprotocol.io/docs/concepts/architecture

---
Source: https://www.netzilo.com/threats/token-optimise-mcp-proxy-install