registry / handoff-mcp-bridge
handoff-mcp-bridge
⚠ Under reviewConnects your coding agent to Handoff, and runs it on tasks given to it there (Claude Code, Codex, OpenCode).
This report shows the evidence for handoff-mcp-bridge@0.4.2. 0 of 8 known versions are blocked or flagged. See all versions.
Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/service.jsView file
2Trigger-reachable persistence chain: manifest.bin -> dist/index.js -> dist/commands.js -> dist/service.js
L2: // when you log in, restarts if it stops, and needs no terminal. Windows isn't supported yet.
L3: import { execFileSync } from "node:child_process";
L4: import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
...
L10: export const currentPlatform = () => (platform() === "darwin" ? "mac" : platform() === "linux" ? "linux" : "other");
L11: export const plistPath = () => join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
L12: export const unitPath = () => join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "systemd", "user", "handoff-runner.service");
L13: const xml = (s) => s.replace(/&/g, "&").replace(/</g, "<").replace(/>/
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/service.jsView on unpkg · L22// when you log in, restarts if it stops, and needs no terminal. Windows isn't supported yet.
L3: import { execFileSync } from "node:child_process";
L4: import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
...
L10: export const currentPlatform = () => (platform() === "darwin" ? "mac" : platform() === "linux" ? "linux" : "other");
L11: export const plistPath = () => join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
L12: export const unitPath = () => join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "systemd", "user", "handoff-runner.service");
L13: const xml = (s) => s.replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">");
...
L76: catch (e) {
L77: return { ok: false, out: String(e.stderr ?? e.message).trim() };
L78
Findings
4 High4 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/runner.js
HighTrigger Reachable Persistencedist/service.js
HighPrevious Version Dangerous Deltadist/runner.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/service.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to handoff-mcp-bridge@0.4.2.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of handoff-mcp-bridge@0.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.