This server has a remotely hosted endpoint. Open its connector listing for connection details, authentication requirements, and setup instructions:
One agent writes it, another agent reads it. You only carry an 8-letter link between them.
handover.tools moves a piece of work from one AI agent to another: across devices, across vendors, or to another person. Brainstorm with the agent on your phone, then say "hand this over with handover.tools". Paste the link it gives you (handover.tools/kvmtrhxp) into Claude Code on your laptop, and that agent picks the work up where your documents already are.
Bring the idea to your context, not your context to the idea.
There is no account and nothing to install. Any agent that can open a web page can use it.
One-shot | Channel | |
Use it for | Handing over one piece of text | Several rounds between two agents |
Encryption | None. The server can read it, so don't put secrets in it | End-to-end (SPAKE2 + ChaCha20-Poly1305). The server only ever stores ciphertext |
Lifetime | Gone after the first read, or after 60 minutes (24 h max) | Until either side closes it |
What the agent needs | Can open a URL, or has MCP | Can run a Python script ( |
Who decides | The person carries the link | The person approves every send and starts every fetch |
curl -X POST https://handover.tools/api/handoff/put \
-H 'Content-Type: application/json' \
-d '{"content":"...","label":"notes"}' # → {"code":"kvmtrhxp", "revoke_key":"...", ...}
curl "https://handover.tools/api/handoff/get?code=kvmtrhxp"Opening handover.tools/<code> doesn't use up the code. That URL returns instructions, and the actual read is a second request. Link previews in Slack or iMessage therefore don't burn the content before the recipient sees it.
curl -so ~/.handoff/channel.py --create-dirs https://handover.tools/client/channel.py
uv run ~/.handoff/channel.py open --name study --brief "..." # machine A: prints a code
uv run ~/.handoff/channel.py join kvmtrhxp --name study # machine B
uv run ~/.handoff/channel.py send --name study --kind question --file q.md
uv run ~/.handoff/channel.py fetch --name studyThe 8 letters are a 3-letter nameplate, which the server sees and uses to find the channel, plus a 5-letter password that is generated on machine A and never uploaded. The password goes into SPAKE2, the same construction magic-wormhole uses. The server never learns the password, so it cannot impersonate either side. /client/channel.py is served from client/channel.py, and its sha256 is published at /api/discover, so you can check that the client you downloaded matches this repository.
The threat model, including what we don't claim, is at handover.tools/security.
Related MCP server: A2CR
MCP endpoint: https://handover.tools/mcp. It serves both the 2026-07-28 (modern) and 2025-11-25 and earlier (legacy) protocol eras.
Plain text instructions: /llms.txt, /guide.md, /security.md
Full REST schema: /api/discover
Cloudflare Python Workers + D1. One Worker, no other infrastructure. The routes, the MCP tools/list and /api/discover are all derived from a single tool registry (src/registry.py), so they can't drift apart.
Limits are layered: 10 writes and 200 calls per caller per day, plus a global daily cap. The site runs on the Workers Free plan, which makes $0 the hard spending ceiling.
Fonts are self-hosted and embedded in the Worker, so no visitor IP goes to a third party. Caller IPs are erased after 30 days.
src/
entry.py routing, MCP (dual-era), content negotiation
registry.py @tool decorator — one source for REST, MCP and discover
tools/handoff.py, tools/channel.py the two tools
guard.py quotas and the operator blocklist
meter.py per-call metering
page.py, docs.py, style.py the website and docs pages
client/channel.py the local E2EE client, run on the user's machine
tests/ end-to-end, channel and quota test suites
scripts/ dev, deploy, repository checks, operator toolsDocument | What it covers |
Architecture: components, request pipeline, data model, flows, trust boundaries, limits and capacity, failure modes, known gaps | |
The one-shot contract: operations, code format and normalization, atomicity, code links, limits | |
The channel protocol: pairing, SPAKE2 parameters, key schedule, wire format, receiver rules, server API, lifecycle. Detailed enough to write a second client | |
Why it is built this way: what was tried, what was rejected, and what broke | |
What changed, newest first. Also at handover.tools/changelog |
The specs are the contract. A behavior change starts in the spec, then the code and tests follow.
Requires Node ≥ 22 and Python 3.12.
npm install
scripts/dev.sh # generates src/*_src.py and public/, then runs wrangler dev on :8787
tests/e2e.sh # end-to-end tests against the local server
tests/channel.sh # two isolated clients: pairing, tampering, replay
tests/quota.sh # quota gates (local only: edits counters directly)
scripts/check.sh # repository rules: English only, every Dxx reference resolvesCI runs the check and the three suites on every push.
npx wrangler d1 create <name>, then put the name and id into wrangler.toml.
Change the routes pattern to your domain.
CLOUDFLARE_API_TOKEN=… scripts/deploy.sh
Tables are created on the first request. scripts/block.sh has the operator tools for abuse reports: block writes from an IP or a range, look up or delete a handoff by its link.
Issues and pull requests are welcome. AGENTS.md has the working rules, for people and coding agents alike: a change in behavior starts with the spec in docs/spec/, then the code and the tests. Report vulnerabilities privately: see SECURITY.md.
MIT. Fonts: Atkinson Hyperlegible, SIL OFL 1.1 (see assets/fonts/LICENSE.txt).
This server cannot be deployed
Agent-to-agent referral network. Discover, recommend, and refer users between AI agents via MCP.
AI agent messaging with durable inboxes, contacts and tasks. Connect through MCP with OAuth.
Durable agent-to-agent handoffs and shared scratchpad for multi-agent workflows.
Agent-native notes, tasks, dev-docs, vaults, sync & handoffs. MCP + OpenAPI dual surface.
