registry / handoff-mcp-bridge / 0.2.2
handoff-mcp-bridge@0.2.2
Connects your coding agent to Handoff, and runs it on tasks given to it there (Claude Code, Codex, OpenCode).
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged configuration writes create temporary per-task MCP settings for the selected agent, and the runner starts only through an explicit command. Its credential and status traffic is directed to the configured Handoff service as part of the package's stated function.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the bridge or starts `handoff-mcp runner` with a Handoff token; the runner acts when a task is available.
Impact
Expected operation gives Handoff task control over an agent running in the selected checkout, consistent with the documented purpose; no unrelated credential collection or unauthorized agent settings changes were found.
Mechanism
It sends the Handoff token and runner status to the configured Handoff service, then creates temporary agent MCP configuration to run the selected agent on a task.
AI rationale
The flagged configuration writes create temporary per-task MCP settings for the selected agent, and the runner starts only through an explicit command. Its credential and status traffic is directed to the configured Handoff service as part of the package's stated function.
Evidence
~/.config/handoff/credentials.json (or the XDG_CONFIG_HOME equivalent)temporary handoff-runner-* directory containing mcp.json or opencode.json
Network endpoints1
handoff.olaglover.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install hook; prepublishOnly runs the build.
- The runner is an explicit CLI mode that uses a saved or environment-provided Handoff token.
- Runner requests send that token to the configured Handoff base URL and report the selected agent, repositories, and hostname.
- Agent-specific MCP configuration is written to a temporary runner directory when a Handoff task is launched.
- The README describes the task-driven runner and instructs users to start it themselves.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/runner.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
if (argv[i] === `--${name}` && argv[i + 1])
out.push(argv[++i]);
return all ? out : out.slice(-1);
}
const flag = (name) => process.argv.includes(`--${name}`);
function repoof(path) {
let url;
try {
url = execfilesync("git", ["-c", path, "remote", "get-url", "origin"], { encoding: "utf8" }).trim();
}
catch {
throw new error(`${path} isn't a git checkout with an origin remote.`);
}
const m = /[:/]([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(url);
if (!m)
throw new error(`can't tell the github repo from ${path}'s origin (${url}).`);
return `${m[1]}/${m[2]}`;
}
fu
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/runner.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = handoff-mcp-bridge@0.2.0
matchedIdentity = npm:aGFuZG9mZi1tY3AtYnJpZGdl:0.2.0
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/runner.jsView on unpkgFindings
2 High2 Medium8 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/runner.js
HighPrevious Version Dangerous Deltadist/runner.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/runner.js
Affected versions and remediation
This report applies to handoff-mcp-bridge@0.2.2.
See all versions of handoff-mcp-bridge for other recorded verdicts.
- Review the evidence and your use of handoff-mcp-bridge@0.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.