registry / handoff-mcp-bridge / 0.4.0
handoff-mcp-bridge@0.4.0
Connects your coding agent to Handoff, and runs it on tasks given to it there (Claude Code, Codex, OpenCode).
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged service installation occurs through the explicit setup command, and the bridge sends its Handoff token to the configured Handoff server for its intended function. The inspected files show no unrelated credential collection, concealed behavior, or review manipulation.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the bridge or explicitly runs its setup command.
Impact
The runner can start a coding agent on tasks assigned through the user's Handoff account and selected repositories.
Mechanism
The bridge authenticates to the configured Handoff server. Setup saves the Handoff token and installs a runner service after its setup flow.
AI rationale
The flagged service installation occurs through the explicit setup command, and the bridge sends its Handoff token to the configured Handoff server for its intended function. The inspected files show no unrelated credential collection, concealed behavior, or review manipulation.
Evidence
~/.config/handoff/credentials.json~/.config/handoff/runner.json~/.handoff/runner~/Library/LaunchAgents/com.handoff.runner.plist~/.config/systemd/user/handoff-runner.service
Network endpoints2
handoff.olaglover.comUser-configured HANDOFF_URL
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes itself as a bridge that runs coding agents on tasks sent through Handoff.
- The CLI only loads setup.js when the user runs the setup command.
- The bridge sends its Handoff token to the configured Handoff server's /mcp endpoint.
- Setup obtains a token through browser sign-in and saves it in the Handoff config directory with mode 0600.
- Setup installs the background service as part of its displayed setup flow.
Evidence against
- The service and repo configuration changes are part of the package's stated setup purpose.
- The inspected code does not show automatic collection or forwarding of unrelated credentials.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/service.jsView file
2Trigger-reachable persistence chain: manifest.bin -> dist/index.js -> dist/commands.js -> dist/service.js
L2: // when you log in, restarts if it stops, and needs no terminal. Windows isn't supported yet.
L3: import { execFileSync } from "node:child_process";
L4: import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
...
L10: export const currentPlatform = () => (platform() === "darwin" ? "mac" : platform() === "linux" ? "linux" : "other");
L11: export const plistPath = () => join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
L12: export const unitPath = () => join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "systemd", "user", "handoff-runner.service");
L13: const xml = (s) => s.replace(/&/g, "&").replace(/</g, "<").replace(/>/
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/service.jsView on unpkg · L22// when you log in, restarts if it stops, and needs no terminal. Windows isn't supported yet.
L3: import { execFileSync } from "node:child_process";
L4: import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
...
L10: export const currentPlatform = () => (platform() === "darwin" ? "mac" : platform() === "linux" ? "linux" : "other");
L11: export const plistPath = () => join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
L12: export const unitPath = () => join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "systemd", "user", "handoff-runner.service");
L13: const xml = (s) => s.replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">");
...
L76: catch (e) {
L77: return { ok: false, out: String(e.stderr ?? e.message).trim() };
L78
Findings
3 High4 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/runner.js
HighTrigger Reachable Persistencedist/service.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/service.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to handoff-mcp-bridge@0.4.0.
See all versions of handoff-mcp-bridge for other recorded verdicts.
- Review the evidence and your use of handoff-mcp-bridge@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.