MCP Observatory
5m ago Tracked 59,449 Last 5m ago 24h 2,443
github TypeScript re-analysis due

Cepeppe/handoff-mcp

github

MCP server that lets a coding agent hand a step to the person at the machine: public handoff formats and reference server (MIT)

maintainer
Cepeppe
licence
MIT
first seen
2026-09-17
last seen
2026-09-17
releases · 30d
7
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret ×11 in Cepeppe/handoff-mcp
capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 821f36c · analyzer v33 · 4h ago

danger signals31

code evidence vv1.7.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 194

filesystem 68

  • fs Cepeppe-handoff-mcp-821f36c/build/bundle.mjs :7 import { readFile, writeFile } from 'node:fs/promises';
  • fs Cepeppe-handoff-mcp-821f36c/build/canary-report.mjs :14 import { readFileSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/build/changelog-section.mjs :14 import { readFileSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/build/check-links.mjs :22 import { readdirSync, readFileSync, statSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/build/format-tarball.mjs :19 import { cpSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/build/gen-contract.mjs :13 import { mkdir, readFile, writeFile } from 'node:fs/promises';
  • fs Cepeppe-handoff-mcp-821f36c/build/sea/build-sea.mjs :30 import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/build/sea/smoke.mjs :20 import { existsSync, readFileSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/build/third-party-notices.mjs :15 import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/build/verify-release.mjs :32 import { createReadStream, createWriteStream } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/src/doctor.ts :26 import { statSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/src/main.ts :28 import { readFileSync } from 'node:fs';
show 28 more
  • fs Cepeppe-handoff-mcp-821f36c/src/mcp/canary.ts :36 import { appendFileSync, mkdirSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/src/platform/ancestors.ts :27 import { readFileSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/src/platform/paths.ts :26 import { readFileSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/src/platform/token.ts :23 import { readFileSync, statSync } from 'node:fs';
  • fs Cepeppe-handoff-mcp-821f36c/src/runbooks/reader.ts :29 import { readdirSync, readFileSync, statSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/codex/app.ts :13 import { mkdtempSync, rmSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/codex/runner.ts :13 import { existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/codex/scenario.ts :9 import { readFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/copilot/editor-runner.ts :27 import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/copilot/record-hook.mjs :15 import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/copilot/runner.ts :21 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/copilot/scenario.ts :10 import { readFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/cursor/editor-runner.ts :18 import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/cursor/record-hook.mjs :15 import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/cursor/runner.ts :17 import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/cursor/scenario.ts :10 import { readFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/kilo-code/runner.ts :19 import { existsSync, mkdirSync, mkdtempSync, realpathSync, rmSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/kilo-code/scenario.ts :9 import { readFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/opencode/runner.ts :14 import { existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/opencode/scenario.ts :9 import { readFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/hooks/record-stop.mjs :26 import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/main.ts :46 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/canary/runner.ts :18 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/contract/capabilities.test.ts :15 import { readFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/contract/channel.test.ts :20 import { readFileSync, readdirSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/contract/matching.test.ts :15 import { readdirSync, readFileSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/contract/mcp-tools.test.ts :11 import { readFileSync, readdirSync } from 'node:fs';
  • fs (weak) Cepeppe-handoff-mcp-821f36c/test/contract/patterns.test.ts :11 import { readFileSync } from 'node:fs';

28 more not shown — this panel samples each group; the count above is the real total.

shell / exec 21

  • shell Cepeppe-handoff-mcp-821f36c/build/format-tarball.mjs :18 import { execFileSync } from 'node:child_process';
  • shell Cepeppe-handoff-mcp-821f36c/build/sea/build-sea.mjs :29 import { execFileSync } from 'node:child_process';
  • shell Cepeppe-handoff-mcp-821f36c/build/sea/smoke.mjs :19 import { spawn } from 'node:child_process';
  • shell Cepeppe-handoff-mcp-821f36c/build/verify-release.mjs :30 import { execFileSync } from 'node:child_process';
  • shell Cepeppe-handoff-mcp-821f36c/src/platform/ancestors.ts :10 * - **macOS**: one `ps -axo pid=,ppid=,comm=` spawn (≈ 20 ms), capped at 200 ms, parsed
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/codex/runner.ts :12 import { execFileSync, spawn } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/copilot/editor-runner.ts :26 import { execFileSync, spawn } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/copilot/record-hook.mjs :14 import { execFileSync } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/copilot/runner.ts :20 import { execFileSync, spawn } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/cursor/editor-runner.ts :17 import { execFileSync, spawn } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/cursor/record-hook.mjs :14 import { execFileSync } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/cursor/runner.ts :16 import { execFileSync, spawn } from 'node:child_process';
show 9 more
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/kilo-code/runner.ts :18 import { execFileSync, spawn } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/canary/agents/opencode/runner.ts :13 import { execFileSync, spawn } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/canary/hooks/record-stop.mjs :25 import { execFileSync } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/canary/runner.ts :17 import { execFileSync, spawn } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/unit/canary/workflow.test.ts :14 import { execFileSync } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/unit/contract-gen.test.ts :12 import { execFileSync } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/unit/docs-links.test.ts :10 import { execFileSync } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/unit/release.test.ts :15 import { execFileSync, spawnSync } from 'node:child_process';
  • shell (weak) Cepeppe-handoff-mcp-821f36c/test/unit/sea.test.ts :10 import { execFileSync } from 'node:child_process';

network 8

  • net Cepeppe-handoff-mcp-821f36c/build/third-party-notices.mjs :142 const response = await fetch(source);
  • net Cepeppe-handoff-mcp-821f36c/build/verify-release.mjs :201 fetch(`https://api.github.com${path}`, {
  • net Cepeppe-handoff-mcp-821f36c/src/channel/client.ts :29 import { connect as netConnect } from 'node:net';
  • net Cepeppe-handoff-mcp-821f36c/src/doctor.ts :27 import { connect as netConnect } from 'node:net';
  • net Cepeppe-handoff-mcp-821f36c/src/hook/stop.ts :34 import { connect as netConnect } from 'node:net';
  • net (weak) Cepeppe-handoff-mcp-821f36c/test/fake-app/fake-app.test.ts :21 import { connect, type Socket } from 'node:net';
  • net (weak) Cepeppe-handoff-mcp-821f36c/test/fake-app/server.ts :30 import { createServer, type Server, type Socket } from 'node:net';
  • net (weak) Cepeppe-handoff-mcp-821f36c/test/unit/channel/endpoint.test.ts :14 import { createServer, type Server, type Socket } from 'node:net';

secrets 1

  • secrets Cepeppe-handoff-mcp-821f36c/build/verify-release.mjs :188 const fromEnv = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;

declared dependencies 14

  • @modelcontextprotocol/sdk@^1.30.0
  • ajv@^8.20.0
  • ajv-formats@^3.0.1
  • @eslint/js@^10.0.1
  • @types/node@^22.20.1
  • esbuild@^0.28.2
  • eslint@^10.10.0
  • eslint-config-prettier@^10.1.8
  • globals@^17.12.0
  • postject@1.0.0-alpha.6
  • prettier@^3.9.6
  • typescript@^5.9.3
show 2 more
  • typescript-eslint@^8.69.0
  • vitest@^5.0.0