registry / handoff-mcp-bridge / 0.4.1
handoff-mcp-bridge@0.4.1
Connects your coding agent to Handoff, and runs it on tasks given to it there (Claude Code, Codex, OpenCode).
AI Security Review
scanned 9h ago · by lpm-firewall-aiThe manifest has no install-time hook beyond a prepublish build. The reviewed network, credential, repository configuration, and persistence behavior belongs to the user-invoked setup and runner flow and targets the configured Handoff service.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the CLI; setup and service installation require invoking the setup command.
Impact
The runner can start a configured coding agent on tasks received through Handoff. The reviewed source does not show unrelated credential collection, project-data exfiltration, or hidden persistence.
Mechanism
The bridge sends its Handoff token to the configured Handoff server. Setup performs OAuth sign-in, saves user-selected repository configuration, and installs a runner service.
AI rationale
The manifest has no install-time hook beyond a prepublish build. The reviewed network, credential, repository configuration, and persistence behavior belongs to the user-invoked setup and runner flow and targets the configured Handoff service.
Evidence
~/.config/handoff/credentials.json~/.config/handoff/runner.json~/Library/LaunchAgents/com.handoff.runner.plist~/.config/systemd/user/handoff-runner.service
Network endpoints1
handoff.olaglover.com (default; configurable via HANDOFF_URL or setup URL)
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepublishOnly, which runs the TypeScript build; there is no install hook.
- The CLI imports and runs setup only when the user invokes the setup command.
- Setup uses browser sign-in with PKCE and a loopback redirect to the configured Handoff server.
- Setup lets the user choose repositories before saving runner configuration and installing a background service.
- The runner sends its bearer token to the configured Handoff server for runner API requests.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/service.jsView file
2Trigger-reachable persistence chain: manifest.bin -> dist/index.js -> dist/commands.js -> dist/service.js
L2: // when you log in, restarts if it stops, and needs no terminal. Windows isn't supported yet.
L3: import { execFileSync } from "node:child_process";
L4: import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
...
L10: export const currentPlatform = () => (platform() === "darwin" ? "mac" : platform() === "linux" ? "linux" : "other");
L11: export const plistPath = () => join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
L12: export const unitPath = () => join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "systemd", "user", "handoff-runner.service");
L13: const xml = (s) => s.replace(/&/g, "&").replace(/</g, "<").replace(/>/
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/service.jsView on unpkg · L22// when you log in, restarts if it stops, and needs no terminal. Windows isn't supported yet.
L3: import { execFileSync } from "node:child_process";
L4: import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
...
L10: export const currentPlatform = () => (platform() === "darwin" ? "mac" : platform() === "linux" ? "linux" : "other");
L11: export const plistPath = () => join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
L12: export const unitPath = () => join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "systemd", "user", "handoff-runner.service");
L13: const xml = (s) => s.replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">");
...
L76: catch (e) {
L77: return { ok: false, out: String(e.stderr ?? e.message).trim() };
L78
Findings
4 High4 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/setup.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/runner.js
HighTrigger Reachable Persistencedist/service.js
HighPrevious Version Dangerous Deltadist/runner.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/service.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to handoff-mcp-bridge@0.4.1.
See all versions of handoff-mcp-bridge for other recorded verdicts.
- Review the evidence and your use of handoff-mcp-bridge@0.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.