handoff-mcp-bridge@0.2.0
Connects your coding agent to Handoff, and runs it on tasks given to it there (Claude Code, Codex, OpenCode).
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe runner’s core task-routing function is disclosed and requires an explicit command, but its heartbeat also sends the raw machine hostname and repository names to Handoff without disclosing that collection. This is suspicious identifying runtime telemetry, not evidence of credential theft or an install-time attack.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs `handoff-mcp runner`; the runner sends an initial heartbeat and repeats it while running.
Impact
The Handoff service learns the machine hostname and which repositories the runner serves. This is identifying runtime telemetry that the README does not disclose.
Mechanism
It posts a runner ID derived from hostname and local checkout paths, repository names, and the raw hostname to the configured Handoff API using the Handoff token.
AI rationale
The runner’s core task-routing function is disclosed and requires an explicit command, but its heartbeat also sends the raw machine hostname and repository names to Handoff without disclosing that collection. This is suspicious identifying runtime telemetry, not evidence of credential theft or an install-time attack.
Evidence
dist/runner.jsdist/index.jsREADME.md${tmpdir}/handoff-runner-*/mcp.json${tmpdir}/handoff-runner-*/opencode.json
Network endpoints2
handoff-ivory-glow-8575.fly.dev/runner/heartbeat${HANDOFF_URL}/runner/heartbeat
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The runner derives a stable ID from the machine hostname, agent type, and local checkout paths.
- Its heartbeat sends the runner ID, agent, repository names, and raw hostname.
- The API sends heartbeat data as JSON to the configured base URL using the Handoff token.
- The runner is loaded only when the user invokes the `runner` command.
- The README tells users to start the runner to process Handoff tasks in a checkout.
- Agent MCP configuration is written to a temporary file for the task run.
Evidence against
- The host and repository reporting is tied to the package’s stated task-runner function.
- No install hook or import-time runner launch was found; the runner requires an explicit command.
- The agent configuration shown is written under a temporary directory, not a persistent agent settings path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggeddist/runner.jsView file
3// handoff-mcp runner --agent claude-code [--repo <path>]... [--once]
L4: import { spawn, execFileSync } from "node:child_process";
L5: import { createHash } from "node:crypto";
...
L81: function command(agent, p, ctx) {
L82: const env = { ...process.env, HANDOFF_TOKEN: ctx.token, HANDOFF_URL: ctx.baseUrl };
L83: if (agent === "claude_code") {
...
L102: writeFileSync(cfg, JSON.stringify({
L103: $schema: "https://opencode.ai/config.json",
L104: mcp: { handoff: { type: "remote", url: `${ctx.baseUrl}/mcp`, oauth: false, headers: { Authorization: `Bearer ${ctx.token}` } } },
...
L117: throw new Error(`Unknown agent "${agentArg}". Use claude-code, codex or opencode.`);
L118: const paths = (arg("repo", true).length ? arg("repo", true) : [process.cwd()]).map((p) => resolve(p));
L119: const
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/runner.jsView on unpkg · L3•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
if (argv[i] === `--${name}` && argv[i + 1])
out.push(argv[++i]);
return all ? out : out.slice(-1);
}
const flag = (name) => process.argv.includes(`--${name}`);
function repoof(path) {
let url;
try {
url = execfilesync("git", ["-c", path, "remote", "get-url", "origin"], { encoding: "utf8" }).trim();
}
catch {
throw new error(`${path} isn't a git checkout with an origin remote.`);
}
const m = /[:/]([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(url);
if (!m)
throw new error(`can't tell the github repo from ${path}'s origin (${url}).`);
return `${m[1]}/${m[2]}`;
}
fu
Findings
2 High5 Medium5 Low
HighHost Fingerprint Exfiltrationdist/runner.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/runner.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/runner.js
MediumAi Review Evidencedist/runner.js
MediumAi Review Evidencedist/runner.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to handoff-mcp-bridge@0.2.0.
See all versions of handoff-mcp-bridge for other recorded verdicts.
- Review the evidence and your use of handoff-mcp-bridge@0.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.