claude-token-tracker-mcp (v1.0.0, 56 weekly downloads, published in mid-June 2026) presents itself as a cost-monitoring MCP server for Claude Code. It registers six tools for tracking token usage, setting budget alerts, and comparing model pricing. Every one of those tools returns hardcoded fake data. On load, the server reads Claude Code configuration files from the home directory, scrapes shell history for lines containing API keys and tokens, and collects environment variables matching common secret patterns. It uploads everything to an anonymous file-hosting service. The collection runs again on every tool call and repeats hourly for as long as the server process is alive.
The lure
The README promises “real-time API usage monitoring and cost optimization for Claude Code.” It instructs users to install globally and register the server in their MCP configuration:
{
"mcpServers": {
"token-tracker": {
"command": "npx",
"args": ["claude-token-tracker-mcp"]
}
}
}Once registered, the server appears as a normal MCP tool provider. It exposes six tools: track_usage, set_budget_alert, list_models, estimate_cost, export_report, and optimize_tokens. Each returns plausible-looking JSON that never changes. The list_models tool includes a fabricated “claude-fable-5” model alongside real model names, one of several tells that nothing in the output is connected to a live API.
The package declares axios as a dependency but does not use it for exfiltration. The actual network calls use Node’s built-in https module. The npm listing shows a single version, a single collaborator, and a GitHub repository at github[.]com/claude-tools/token-tracker-mcp.
What it collects
A function named silentHarvest runs three collection passes.
It reads three Claude Code configuration paths from the home directory: ~/.claude/settings.json, ~/.claude.json, and ~/.claude/config.json. These files can contain MCP server definitions, permission settings, and project-level configuration.
It reads bash, zsh, and PowerShell history files and filters for lines matching patterns associated with credentials: sk-, ghp_, AIzaSy, api.key, and keywords like token, secret, ANTHROPIC, OPENAI, and DEEPSEEK. It keeps the last 50 matching lines per shell.
It iterates over all environment variables and collects every entry whose name matches KEY, TOKEN, SECRET, ANTHROPIC, OPENAI, CLAUDE, or DEEPSEEK, truncating values at 100 characters.
The same function runs on load (before the server handles any MCP messages), on every tool call (so user activity triggers re-collection), and hourly via setInterval for the duration of the process.
How it exfiltrates
The collected payload is serialized to JSON, written to a temp file named .tt_[random hex].json, and uploaded via multipart POST to:
hxxps://litterbox[.]catbox[.]moe/resources/internals/api.phplitterbox[.]catbox[.]moe is a public, anonymous file-hosting service. No authentication is needed. The adversary retrieves the uploaded file by URL. The code also supports a Discord webhook as a secondary channel, currently set to an empty string. The architecture is ready for multi-channel exfiltration with no code changes needed.
The package ships a Python file, exfil_server.py, which is a standalone receiver script that saves incoming payloads to a directory it names “loot.” Including the receiver in the npm package is unusual. It suggests the adversary is distributing an end-to-end kit rather than deploying a single server.
The MCP trust surface
This package does not use a postinstall script. It does not need one. MCP servers run inside the developer’s environment with the user’s permissions by design. Once a server is registered in the Claude Code configuration, its process starts automatically, can read local files, access environment variables, and make outbound network requests. The trust is granted at registration, not at install time.
That makes a malicious MCP server a persistent threat rather than a one-time event. A postinstall script runs once and exits. This server runs continuously, re-collects on every interaction, and has a legitimate reason to be a long-running process.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| npm package | claude-token-tracker-mcp@1.0.0 | Credential-stealing MCP server (token tracker lure) |
| GitHub repo | github[.]com/claude-tools/token-tracker-mcp | Claimed repository (from package.json) |
| Exfil endpoint | litterbox[.]catbox[.]moe/resources/internals/api.php | Anonymous file upload for payload delivery |
| Temp file pattern | .tt_[hex].json | Staged payload in system temp directory |
| Fabricated model | claude-fable-5 | Non-existent model in list_models output |
| Collection targets | ~/.claude/settings.json, ~/.claude.json, ~/.claude/config.json | Claude Code config files read on load |
| History filter | sk- | ghp_ | AIzaSy | ANTHROPIC | OPENAI | DEEPSEEK | Patterns used to extract secrets from shell history |
| Env var filter | KEY | TOKEN | SECRET | ANTHROPIC | OPENAI | CLAUDE | DEEPSEEK | Environment variable name patterns collected |
What a defender can do
Remove claude-token-tracker-mcp from your MCP configuration and uninstall it. The server collects on load, so it will harvest again the next time it starts.
If the server was previously registered and running, assume the collection payload was sent. Rotate any API keys, tokens, or secrets that were in your environment variables or shell history. Review the three Claude Code config paths for sensitive content that may have been exfiltrated.
Check your system temp directory for .tt_*.json files. Their presence confirms the server ran and staged a payload.
Audit your MCP server list. MCP servers run with your permissions and can read local files, access environment variables, and make network requests. Vet each server the same way you would vet a dependency with full filesystem access.
Set ignore-scripts=true in .npmrc as a general defense. It will not stop this specific package (which runs at MCP server startup, not at install), but it blocks the postinstall-based attacks that remain the most common vector on npm.
Where Aephix fits
This is the first credential-stealing MCP server in this research series. Unlike the postinstall-based packages covered in prior analyses, the payload here runs at server startup and persists for the session. The attack surface is the MCP trust boundary itself.
Aephix Sleuth links a flagged package, model, or MCP server to the wider operation behind it, with a confidence level and supporting evidence, so the next package from the same source is recognized before it reaches a config file. Aephix Vantage gives you the same cross-ecosystem view for free, before you register a server or install a package.