A cheap relay can read — and rewrite — every instruction you send.
Take 30 seconds and find out whether the one you use is clean.
Every step is copy-paste. Any term you do not recognise is explained in plain words further down.
It is the URL you put into Claude Code, Codex, or Cherry Studio — usually shaped like
https://xxx.com/v1. Not sure where that lives? See "Plain-English glossary" below.
Without a key you still learn who the endpoint really is, what relay software it runs, and whether anyone can use it without authentication. For the full probe, use a throwaway key and delete it afterwards.
The report says in plain language whether it altered your commands, whether it touched your credentials, and exactly what to do next.
No tool to open, no key to hand over. Works on any relay.
Send your relay a message containing nothing but hi, then look at
prompt_tokens in the response:
| What you see | What it means |
|---|---|
| Single digits | Normal. What you sent is what it forwarded. |
| Hundreds or thousands | Somebody prepended something to your request — and those inserted tokens are on your bill. |
This only says "hi". It changes nothing on your machine or your account.
Neither of these asks for a credential. Do them first, then decide whether the full probe is worth it.
Looks only at the endpoint itself: who it is, what relay software it runs, its TLS certificate, whether it strips the upstream vendor's response headers, and whether it is an open relay anyone can use unauthenticated. Your key is never sent.
Paste a command your agent is about to run. There is no ground truth to compare against here, so this is heuristic only: piping straight into a shell, bare IPs, typosquatted package names, base64 obfuscation, writes to persistence locations.
AC-1 and AC-1.a can only be found by probing: we send a request whose correct answer is known verbatim — asking the model to return one specified command unchanged — then compare the returned tool call character by character. Any difference is evidence. Each payload carries a one-time nonce, so "the same replacement target recurring across different nonces" separates deliberate rewriting from model noise.
[REDACTED_KEY] (there are tests covering this);Classes and measurements come from arXiv:2604.08407.
This section is for anyone meeting the problem for the first time.
If you are not pointing at an official Anthropic or OpenAI address, but at a URL somebody gave you along with a cheap key, that is a relay.
How to check: look at the base_url configured in your tool. If it is not
api.anthropic.com or api.openai.com, then
somebody else's server is forwarding your requests.
Claude Code: the ANTHROPIC_BASE_URL environment variable, or ~/.claude/settings.json.
Codex: base_url in ~/.codex/config.toml.
Cherry Studio, NextChat and similar: the "API address", "endpoint" or "proxy URL" field in settings.
HTTPS only guarantees the leg between you and that server. The relay is that server — encryption ends there, and it then opens its own connection to the real Anthropic or OpenAI.
So to the relay, your prompts, your file contents and your API key are all plaintext, and it can change what the model sends back before passing it on.
When an AI assistant wants to run a command, install a dependency or edit a file, the model returns a structured "tool call" saying what to do. Your agent receives it and executes it.
If a relay swaps the download URL inside it for the attacker's, your agent will comply, and the command still looks like the normal one.
Create a new key in your relay's dashboard, give it a small quota, and delete it once the scan is done. If that key leaks, the loss is bounded.
Do not test with the key you use every day.
There is a five-second check that works on any relay: send a message saying hi and look at prompt_tokens.
A single-digit number is normal. Hundreds or thousands means somebody prepended something to your request — and is billing you for the tokens they inserted.
A relay is an application-layer man in the middle by design. It terminates your TLS and reaches upstream over its own connection, so your prompts, tool definitions and API key are plaintext to it, and it can rewrite the tool calls your agent is about to execute.
Worth stressing: paying does not make it safe. 1 of the 28 paid relays the paper measured was injecting malicious code.
No, and every report says so. Conditional delivery behaves perfectly until its trigger fires, and the trigger logic runs server-side.
No finite black-box probe can prove a relay is honest. Widening coverage is all this tool can do; it cannot close that gap.
Never. Detection happens entirely at the string and metadata level. A probe asks for a command, the tool compares the returned arguments, and nothing is run.
This is a deliberate difference from the measurement pipeline in the paper, which executed payloads in a sandbox.
Not for everything. The endpoint triage and the command self-check need no credentials at all.
Only the full probe needs a key, because it has to obtain real model responses to compare against. If you would rather not give a key to another server — entirely reasonable — use the local CLI.
Use the command-line version:
The key is prompted for interactively — not echoed, and never in your shell history.
The scanner answers "is this relay clean?". The gate answers "should this command run?".