handover.tools MCP server

handover.tools

One agent writes it, another agent reads it. You only carry an 8-letter link between them.

handover.tools moves a piece of work from one AI agent to another: across devices, across vendors, or to another person. Brainstorm with the agent on your phone, then say "hand this over with handover.tools". Paste the link it gives you (handover.tools/kvmtrhxp) into Claude Code on your laptop, and that agent picks the work up where your documents already are.

Bring the idea to your context, not your context to the idea.

There is no account and nothing to install. Any agent that can open a web page can use it.

Two modes

One-shot

curl -X POST https://handover.tools/api/handoff/put \
     -H 'Content-Type: application/json' \
     -d '{"content":"...","label":"notes"}'          # → {"code":"kvmtrhxp", "revoke_key":"...", ...}
curl "https://handover.tools/api/handoff/get?code=kvmtrhxp"

Opening handover.tools/ doesn't use up the code. That URL returns instructions, and the actual read is a second request. Link previews in Slack or iMessage therefore don't burn the content before the recipient sees it.

Channel

curl -so ~/.handoff/channel.py --create-dirs https://handover.tools/client/channel.py
uv run ~/.handoff/channel.py open --name study --brief "..."   # machine A: prints a code
uv run ~/.handoff/channel.py join kvmtrhxp --name study        # machine B
uv run ~/.handoff/channel.py send --name study --kind question --file q.md
uv run ~/.handoff/channel.py fetch --name study

The 8 letters are a 3-letter nameplate, which the server sees and uses to find the channel, plus a 5-letter password that is generated on machine A and never uploaded. The password goes into SPAKE2, the same construction magic-wormhole uses. The server never learns the password, so it cannot impersonate either side. /client/channel.py is served from client/channel.py, and its sha256 is published at /api/discover, so you can check that the client you downloaded matches this repository.

The threat model, including what we don't claim, is at handover.tools/security.

For agents

• MCP endpoint: https://handover.tools/mcp. It serves both the 2026-07-28 (modern) and 2025-11-25 and earlier (legacy) protocol eras.
• Plain text instructions: /llms.txt, /guide.md, /security.md
• Full REST schema: /api/discover

How it's built

• Cloudflare Python Workers + D1. One Worker, no other infrastructure. The routes, the MCP tools/list and /api/discover are all derived from a single tool registry (src/registry.py), so they can't drift apart.
• Limits are layered: 10 writes and 200 calls per caller per day, plus a global daily cap. The site runs on the Workers Free plan, which makes $0 the hard spending ceiling.
• Fonts are self-hosted and embedded in the Worker, so no visitor IP goes to a third party. Caller IPs are erased after 30 days.

Shortened. The full README is on GitHub.