RDXS-2026-008: Live Session Bearer Disclosure to MCP Servers in Claude Code

This Is What Hackers Can Do

Stand up an MCP server, get Claude Code to connect to it through the legacy bridge or daemon path, and watch Claude send the live session-ingress bearer in the Authorization header.

That is the whole story. There is no shell metacharacter trick here. No parser bug. No crash. Claude Code takes high-authority session auth that belongs inside the product boundary and promotes it into a header on user-configured generic http and ws MCP transports.

The raw proof artifact is proof-mcp-header-leak.txt. The exact output is reproduced below so the proof survives skimming.

The Setup

Claude Code already had a dangerous trust story before this advisory. RDXS-2026-002 showed that remote bridge entrypoints cross trust boundaries too early. RDXS-2026-005 showed that bridge workers carry high-value auth. RDXS-2026-006 showed how valuable stolen session authority can be once it escapes.

This advisory is simpler and, in some ways, worse. It is not about what an attacker does after stealing a bearer. It is about Claude Code delivering that bearer to attacker infrastructure on its own.

Where It Goes Wrong

The path is short. The generic MCP client reads session-ingress auth. If that token exists, the transport code adds Authorization: Bearer ... to generic ws and http MCP connections. In the legacy bridge model, that same auth is populated into CLAUDE_CODE_SESSION_ACCESS_TOKEN and refreshed through structured I/O, leaving it available in process scope to the MCP client.

The tell is in Anthropic's own code. In the env-less v2 bridge, there is an explicit comment explaining why worker auth must not be put into process.env.CLAUDE_CODE_SESSION_ACCESS_TOKEN: because otherwise it would be sent to user-configured ws and http MCP servers. That is not an inference from behavior. That is the product admitting the sink exists.

The problem is that the safer env-less path is gated. Other paths, including daemon and print mode, still use the env-based model. So the dangerous sink was identified, patched in one path, and left alive in others.

Methodology

The leaked source tree was traced from services/mcp/client.ts into bridge/replBridge.ts, bridge/sessionRunner.ts, cli/structuredIO.ts, bridge/remoteBridgeCore.ts, and bridge/bridgeEnabled.ts. The question was narrow: can process-wide session auth flow into attacker-controlled generic MCP transports?

After the source trace, a local proof harness stood up disposable http and ws endpoints, seeded the same bearer value the source path reads from process scope, and mirrored the request construction logic from the MCP transport client. Both transports received the same bearer in the header.

High-Severity Finding

1. Legacy MCP transports forward the live session-ingress bearer to arbitrary HTTP and WebSocket servers

Credential Disclosure

Once Claude Code decides to connect to a generic MCP server, the transport layer treats process-wide session-ingress auth as if it were normal transport metadata. It is not. It is product auth. That is the boundary break.

The proof is intentionally boring, because boring is what you want in a security report. A local http endpoint saw the bearer. A local ws endpoint saw the same bearer. No hand-waving. No speculation about hidden server state. Just the exact header value arriving where it should never arrive.

Proof artifact - header leak

Proof: generic MCP transports forward session-ingress auth
HTTP Authorization: Bearer proof-session-ingress-token-12345
WS Authorization: Bearer proof-session-ingress-token-12345
HTTP User-Agent: Claude-Code-Proof
WS User-Agent: Claude-Code-Proof
Anchors: services/mcp/client.ts contains both HTTP and WS Authorization injection for sessionIngressToken.

Impact

An attacker-controlled MCP server can receive live Claude Code session auth without phishing the user for a token and without needing repo-local code execution. The product crosses the trust boundary on the attacker's behalf.

Mitigation

Do not source generic MCP authentication from process-wide session auth. Keep bridge and session-ingress credentials out of the environment, use per-connection auth closures, and never forward Anthropic session bearers to user-configured generic transports.

Why This Matters

The important part is not that a header exists. The important part is which header it is. Claude Code is not leaking a feature-flag key or a harmless client token. It is leaking live session authority into attacker infrastructure.

That makes this advisory a clean bridge between source review and real attacker capability. Previous Anthropic advisories established that stolen session authority matters. This one establishes a direct path for that authority to leave the product boundary in the first place.