# handover.tools [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/gammaland/handover  
**GitHub Stars:** 0  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/handover-tools

## Description
Hand work between AI agents across devices and vendors: one-shot links or an E2EE channel.

## Tools
Capabilities this server exposes over MCP:

- **handoff_put** — Store a piece of context and get back a short code. The person gives the link handover.tools/<code> to an agent on another device and it can fetch the content — no copy-paste of long text. The code is 8 letters, easy to type on a phone. NOT ENCRYPTED: the server can read what you store, so never put credentials, tokens, or private data in it. Content becomes unreadable after the TTL expires, and by default it can only be fetched once. The response also returns a revoke_key — keep it for the rest of this session so you can destroy the content immediately with handoff_revoke if the person changes their mind. Writes are limited to a small number per day; reads are not.
- **handoff_get** — Fetch content stored by handoff_put using its 8-character code. The code is case-insensitive and hyphens are ignored, so 'kvmtrhxp' and 'KVMT-RHXP' are the same; the person may give it as a link like handover.tools/kvmtrhxp, and passing that is fine too. Return the content to the person verbatim and complete: it can be fetched only once. If the code is unknown, already fetched, or expired, content is null with a reason — these cases are deliberately indistinguishable.
- **handoff_revoke** — Destroy content stored by handoff_put right now, before its TTL runs out and whether or not it has been fetched. Requires the revoke_key returned by handoff_put — the person fetching with the short code cannot revoke, only the writer can. Use this the moment someone says they sent the wrong thing, or changed their mind. Revoking an already gone item is not an error: the outcome is reported as 'already_gone'.
- **channel_open** — Start pairing two agents on different machines for a multi-round exchange (e.g. one explores, the other studies and asks follow-up questions). Use the local client at https://handover.tools/client/channel.py — do not call this by hand. The client generates a secret password locally, and this call returns only a 3-character nameplate; the person gives nameplate + password (8 letters) to the other machine. The server never sees the password, so it cannot impersonate either side (SPAKE2). The person stays in the loop: send only after they approve, fetch only when they ask. Counts as one write against the daily write quota.
- **channel_join** — Second half of pairing, run by the local client at https://handover.tools/client/channel.py. Send only the first 3 characters of the spoken code (the nameplate) plus this side's SPAKE2 message; the other 5 characters are the password and must never be sent to the server. The nameplate is consumed on success. Returns this side's key and the peer's SPAKE2 message. Unknown, used, or expired nameplates are deliberately indistinguishable.
- **channel_send** — Relay one ciphertext to the other side of a paired channel. The ciphertext must come from the local client at https://handover.tools/client/channel.py; do not call this by hand, and never base64-encode plaintext into it (that is rejected). Only send after the person has seen and approved the draft — the server cannot enforce this, the calling agent must. Returns the message's sequence number and how far the peer has read.
- **channel_fetch** — Use the local client at https://handover.tools/client/channel.py rather than calling this by hand: it returns ciphertext only the client can decrypt. Returns the peer's messages this side has not fetched yet, and marks them read so the peer can see they arrived. Call only when the person asks. peek=true reads without marking; after=N re-reads from sequence N (recovery). Side A also receives the peer's SPAKE2 message here to finish pairing. Large backlogs are paged: more=true means fetch again.
- **channel_close** — Either side can close. Deletes the channel, both keys, and every stored message immediately. The other side's next fetch reports not_found_or_closed.

## Claude Desktop Quick Installation
No confirmed install details yet, so no config is published. Follow the setup steps in the repository above.

## Documentation

## What handover.tools MCP server does

The handover.tools MCP server transfers work between agents operating on different devices or from different vendors. It supports two distinct workflows: temporary one-shot handoffs and longer-lived paired channels.

A one-shot handoff stores text and returns an eight-letter code. The recipient can provide that code, or a `handover.tools/<code>` link, to retrieve the content. Content is normally readable once and is removed after retrieval or when its time-to-live expires. The writer can also revoke it immediately with the returned `revoke_key`.

One-shot content is not encrypted. The service can read it, so credentials, tokens, and private information should not be placed in a handoff.

## How it works

The hosted MCP endpoint is available at `https://handover.tools/mcp`. The server exposes separate tools for storing, getting, and revoking one-shot content, along with tools for opening, joining, sending through, fetching from, and closing channels.

Channels are intended for several rounds between two agents. The local `client/channel.py` script creates the pairing password and performs the cryptographic operations. Only a three-character nameplate is sent as the channel lookup value; the remaining password material stays off the server. SPAKE2 establishes the shared secret, and the server relays ciphertext rather than plaintext. Either side can close the channel, which deletes the channel keys and stored messages.

People remain in the loop for channel operations: the agent should send only after approval and fetch only when requested. Channel messages can be fetched normally, peeked without marking them read, or re-read from a sequence number for recovery. Large backlogs may require additional fetches.

## Setup and configuration

The hosted service requires no account and no installation for one-shot use. An agent needs MCP access to use the endpoint, while a recipient can also open the handoff link through a web-capable agent or browser workflow.

Channel use requires downloading the local client from `https://handover.tools/client/channel.py` and running it with Python through `uv run`. The repository states that the client hash is published through `/api/discover`, allowing a downloaded client to be checked against the published version.

The service applies per-caller and global limits. Writes are limited to 10 per caller per day, total calls to 200 per caller per day, and one-shot reads do not count against the write limit. Channel opening counts as a write.

## Tools and capabilities

- `handoff_put`: stores text and returns an eight-letter code plus a revocation key.
- `handoff_get`: retrieves content by code or link; codes ignore case and hyphens.
- `handoff_revoke`: deletes a handoff before expiry or retrieval.
- `channel_open` and `channel_join`: pair two local clients using a nameplate and SPAKE2 messages.
- `channel_send` and `channel_fetch`: relay and retrieve encrypted channel messages.
- `channel_close`: removes a channel, its keys, and its messages.

## Limitations and notes

The handover.tools MCP server is not a secret store in one-shot mode. Unknown, expired, already-read, and already-used codes are intentionally reported without distinguishing which condition occurred. A recipient cannot revoke a one-shot item; only the writer holding the revocation key can do so.

Channel tools that depend on cryptographic processing should be run through the local client rather than called manually. The service does not enforce human approval before sending or fetching, so the calling agent must follow that interaction rule. One-shot items expire after a default TTL, with a maximum lifetime of 24 hours; channels remain available until either side closes them.

_Full upstream README: https://allmcps.com/mcp/handover-tools/readme_