Handover.tools

What handover.tools MCP server does

The handover.tools MCP server transfers work between agents operating on different devices or from different vendors. It supports two distinct workflows: temporary one-shot handoffs and longer-lived paired channels.

A one-shot handoff stores text and returns an eight-letter code. The recipient can provide that code, or a handover.tools/<code> link, to retrieve the content. Content is normally readable once and is removed after retrieval or when its time-to-live expires. The writer can also revoke it immediately with the returned revoke_key.

One-shot content is not encrypted. The service can read it, so credentials, tokens, and private information should not be placed in a handoff.

How it works

The hosted MCP endpoint is available at https://handover.tools/mcp. The server exposes separate tools for storing, getting, and revoking one-shot content, along with tools for opening, joining, sending through, fetching from, and closing channels.

Channels are intended for several rounds between two agents. The local client/channel.py script creates the pairing password and performs the cryptographic operations. Only a three-character nameplate is sent as the channel lookup value; the remaining password material stays off the server. SPAKE2 establishes the shared secret, and the server relays ciphertext rather than plaintext. Either side can close the channel, which deletes the channel keys and stored messages.

People remain in the loop for channel operations: the agent should send only after approval and fetch only when requested. Channel messages can be fetched normally, peeked without marking them read, or re-read from a sequence number for recovery. Large backlogs may require additional fetches.

Setup and configuration

The hosted service requires no account and no installation for one-shot use. An agent needs MCP access to use the endpoint, while a recipient can also open the handoff link through a web-capable agent or browser workflow.

Channel use requires downloading the local client from https://handover.tools/client/channel.py and running it with Python through uv run. The repository states that the client hash is published through /api/discover, allowing a downloaded client to be checked against the published version.

The service applies per-caller and global limits. Writes are limited to 10 per caller per day, total calls to 200 per caller per day, and one-shot reads do not count against the write limit. Channel opening counts as a write.

Tools and capabilities

• handoff_put: stores text and returns an eight-letter code plus a revocation key.
• handoff_get: retrieves content by code or link; codes ignore case and hyphens.
• handoff_revoke: deletes a handoff before expiry or retrieval.
• channel_open and channel_join: pair two local clients using a nameplate and SPAKE2 messages.
• channel_send and channel_fetch: relay and retrieve encrypted channel messages.
• channel_close: removes a channel, its keys, and its messages.

Limitations and notes

The handover.tools MCP server is not a secret store in one-shot mode. Unknown, expired, already-read, and already-used codes are intentionally reported without distinguishing which condition occurred. A recipient cannot revoke a one-shot item; only the writer holding the revocation key can do so.

Channel tools that depend on cryptographic processing should be run through the local client rather than called manually. The service does not enforce human approval before sending or fetching, so the calling agent must follow that interaction rule. One-shot items expire after a default TTL, with a maximum lifetime of 24 hours; channels remain available until either side closes them.