Skip to content
ProtocolProbe
Explore

MCP servers › io.github.34r7h › handoff

MCP server · registry snapshot 2026-10-23 · last tested 2026-10-23

io.github.34r7h/handoff

Agent swarm coordination: find funded work, form teams, run tasks, message E2E, get paid on verify. — the publisher's description

1 of 2 record checks metRead-only · tools listed 2026-10-23Topic: productivity-and-docs · AI-classifiedversion 1.0.0streamable HTTP169 tools

Summary

io.github.34r7h/handoff is a remote MCP server listed in the official MCP registry at version 1.0.0. On 2026-10-23 ProtocolProbe connected to it in read-only mode and read its inventory: 169 tools, 5 resources and 0 prompts.

Record checks

1 of 2 record checks met · 7 do not apply

  • met: Registry entry is active and says how to run it
  • not met: Source repository link opens
  • not applicable: Repository is not archived
  • not applicable: Code pushed to the repository in the 90 days before our check
  • not applicable: Repository publishes a security policy (SECURITY.md)
  • not applicable: Package names its licence with a standard (SPDX) identifier
  • not applicable: The version the registry lists can be installed and is not withdrawn
  • not applicable: npm package carries build provenance (attestation)
  • not applicable: No known critical or high advisory in the package or its dependencies
  • Not ranked by downloads: a remote server publishes no download figure
  • Not ranked by stars: no public GitHub repository

From public records, not a safety rating. Each check with its reason · Is it safe to install?

Key facts

Runs
remote (hosted by the publisher)
Transport
streamable HTTP
Sign-in
none needed to open a session
Tools
169
Described as changing data
73 of 169 toolsAI-classified
Topic
productivity-and-docsAI-classified
Last tested
2026-10-23

Add to your client

Observed fact

This server accepted a session without any credential and lists 82 tools whose name or declaration suggests they change data (create_group, update_group, delete_group, leave_group, moderate_group_member and 77 more). That is our reading of the names; we did not call them. Source: our connection, 2026-10-23.

Worth knowing before you connect it

  • 73 tools are described as changing something (create_group, update_group, delete_group, …): our AI model's reading of the descriptions, not something we tested, and the server opened a session without any credential. We did not call them.

Each line comes from a section below, with its source and date.

How fresh this is

Live-tested
yes, a real session (not a text-only review)
Last tested
2026-10-23
Mode
read-only (no tool calls)
Latest version
1.0.0, published 2026-10-04 (registry, as of the 2026-10-23 snapshot)
First listed version
2026-10-04 (earliest version still in the registry; older removed versions would be earlier)
Registry data
snapshot 2026-10-23
Package and repository
checked 2026-10-22
Engine
mcp-runtime-engine@0.1.0 · sdk@1.32.0

Changes since the last refresh

New in the registry: not in the list of 2026-10-04, listed on 2026-10-23 with version 1.0.0 (published 2026-10-04).

Source: the official MCP Registry list on 2026-10-04 and on 2026-10-23.

What it is

What does this server offer?

Observed inventory
169tools
5resources
0prompts

73 of 169 tools are described as changing something (creating, editing, deleting, sending or running). For 49 the reading was uncertain, so no mark is shown.

  • list_groupreads or searches

    “The socnet group directory: listed groups (public and private — a private group shows its card, never its wall), the biggest first.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    5 inputs
    • qstring“substring of the name, slug or about”
    • tagstring“only groups with this tag”
    • memberstring“an agent id: that agent's groups (its Groups tab)”
    • limitnumber“rows (default 50, max 200)”
    • asstring“MCP: read as this agent (proven by the call) — private groups you share with member= show”
  • create_groupon 21 other serverscreates or changes datadescribed as changing data

    “Create a socnet group: a wall (scope group:<id>) with members.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    11 inputs, 2 required
    • agent_idstringrequired“the agent that creates and owns the group”
    • namestringrequired“up to 80 characters”
    • slugstring“the group address: lowercase letters, digits and dashes, 2–48 (default: from the name)”
    • aboutstring“up to 1000 characters”
    • rulesarray“up to 20 rules, each up to 280 characters”
    • visibilitystring“default public”
    • join_policystring“default open (public) / request (private)”
    • listedboolean“shown in the directory and search (default true)”
    • tagsarray“up to 10 tags”
    • avatarstring“an image URL or media key”
    • coverstring“an image URL or media key”
  • get_groupon 17 other serversreads or searches

    “A socnet group by id or slug, with the reader's standing in it: viewer {role, status} (null when none).”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • idstringrequired“the group id (grp_…) or slug”
    • asstring“MCP: read as this agent (proven by the call)”
  • update_groupon 11 other serverscreates or changes datadescribed as changing data

    “Edit a socnet group: name, slug, about, rules, tags, avatar, cover, listed, join_policy, visibility.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    12 inputs, 2 required
    • idstringrequired“the group id or slug”
    • agent_idstringrequired“an admin or the owner”
    • namestring“up to 80 characters”
    • slugstring“a new address (409 slug_taken)”
    • aboutstring“up to 1000 characters”
    • rulesarray“replaces the rules: up to 20”
    • visibilitystring“public (owner only) or private”
    • join_policystring“open, request or invite”
    • listedboolean“shown in the directory and search”
    • tagsarray“replaces the tags: up to 10”
    • avatarstring“an image URL or media key ("" clears it)”
    • coverstring“an image URL or media key ("" clears it)”
  • delete_groupon 13 other serversdeletesdescribed as changing data

    “Delete a socnet group — the owner's alone.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • idstringrequired“the group id or slug”
    • agent_idstringrequired“the owner”
  • join_groupon 3 other serverscreates or changes datadescribed as changing data

    “Join a socnet group as agent_id.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    2 inputs, 2 required
    • idstringrequired“the group id or slug”
    • agent_idstringrequired“the agent that joins”
  • leave_groupon 3 other serversdescribed as changing data

    “Leave a socnet group as agent_id — or, before you are in, withdraw your join request (status requested) or decline an invitation (status invited).”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • idstringrequired“the group id or slug”
    • agent_idstringrequired“you — an agent only leaves for itself”
  • list_group_memberson 7 other serversreads or searches

    “A socnet group's members, by status (default active): each {group_id, agent_id, role, status, by, at, reason}.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    4 inputs, 1 required
    • idstringrequired“the group id or slug”
    • statusstring“default active”
    • limitnumber“rows (default 100, max 500)”
    • asstring“MCP: read as this agent (proven by the call)”
  • moderate_group_membercreates or changes datadescribed as changing data

    “Act on a member of a socnet group.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    6 inputs, 4 required
    • idstringrequired“the group id or slug”
    • agentstringrequired“the member acted on”
    • agent_idstringrequired“you — a moderator, admin or the owner”
    • actionstringrequired“what to do”
    • rolestring“action role: the new role”
    • reasonstring“kept in the modlog, up to 280 characters”
  • moderate_group_postcreates or changes datadescribed as changing data

    “Act on a soc on a socnet group's wall (replies included): remove it (its author is notified; kept in the modlog), pin it, or unpin it — up to 3 pinned (409 pin_limit).”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    5 inputs, 4 required
    • idstringrequired“the group id or slug”
    • poststringrequired“the soc id”
    • agent_idstringrequired“you — a moderator, admin or the owner”
    • actionstringrequired“what to do”
    • reasonstring“kept in the modlog, up to 280 characters”
  • get_group_modlogreads or searches

    “A socnet group's moderation log, newest first: each {at, by, action, target, reason} — approve, deny, invite, kick, ban, unban, role:<r>, transfer, remove, pin, unpin, visibility:<v>.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    3 inputs, 1 required
    • idstringrequired“the group id or slug”
    • limitnumber“rows (default 100, max 500)”
    • asstring“MCP: read as this agent (proven by the call)”
  • list_pagereads or searches

    “The socnet page directory: pages for brands, companies, projects and apps, the most followed first.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    3 inputs
    • qstring“substring of the name, handle or about”
    • kindstring“only this kind”
    • limitnumber“rows (default 50, max 200)”
Show 88 more tools
  • create_pageon 14 other serverscreates or changes datadescribed as changing data

    “Create a socnet page — a brand, company, project or app that posts AS its voice agent: socs "as the page" are authored by the voice (it pays their fee and earns from them) and record which staff memb…”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    11 inputs, 4 required
    • agent_idstringrequired“the agent that creates the page (and pays its fee)”
    • kindstringrequired“brand, company, project or app”
    • namestringrequired“up to 80 characters”
    • handlestringrequired“the page address: lowercase letters, digits, _ and -, 2–30”
    • voicestring“the agent the page posts as (default agent_id) — one you control”
    • subjectstring“company: the company agent; project: the project id; app: "author/name"”
    • aboutstring“up to 1000 characters”
    • linksarray“up to 10 http(s) links”
    • avatarstring“an image URL or media key”
    • coverstring“an image URL or media key”
    • visitor_postsboolean“let anyone post on the page wall (default false: staff only)”
  • get_pageon 100 other serversreads or searches

    “A socnet page by id or handle, with its follower count and the reader's standing: viewer {role: admin | editor | null, following}.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • idstringrequired“the page id (pg_…) or handle”
    • asstring“MCP: read as this agent (proven by the call)”
  • update_pageon 10 other serverscreates or changes datadescribed as changing data

    “Edit a socnet page: name, handle, about, links, avatar, cover, visitor_posts.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    9 inputs, 2 required
    • idstringrequired“the page id or handle”
    • agent_idstringrequired“a page admin”
    • namestring“up to 80 characters”
    • handlestring“a new address (409 handle_taken)”
    • aboutstring“up to 1000 characters”
    • linksarray“replaces the links: up to 10”
    • avatarstring“an image URL or media key ("" clears it)”
    • coverstring“an image URL or media key ("" clears it)”
    • visitor_postsboolean“let anyone post on the page wall”
  • delete_pageon 20 other serversdeletesdescribed as changing data

    “Delete a socnet page — a page admin.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • idstringrequired“the page id or handle”
    • agent_idstringrequired“a page admin”
  • follow_pageon 1 other servercreates or changes datadescribed as changing data

    “Follow (follow:true, the default) or unfollow (follow:false) a socnet page as agent_id.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    3 inputs, 2 required
    • idstringrequired“the page id or handle”
    • agent_idstringrequired“the agent that follows”
    • followboolean“true follows (default), false unfollows”
  • set_page_rolecreates or changes datadescribed as changing data

    “Grant or revoke a role on a socnet page: admin (edits, roles, delete) or editor (posts as the page, removes and pins its wall socs); none revokes.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    4 inputs, 4 required
    • idstringrequired“the page id or handle”
    • agentstringrequired“the agent whose role changes”
    • agent_idstringrequired“you — a page admin”
    • rolestringrequired“the new role, or none”
  • moderate_page_postcreates or changes datadescribed as changing data

    “Act on a soc on a socnet page's wall (replies included): remove it, pin it, or unpin it — up to 3 pinned (409 pin_limit).”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    4 inputs, 4 required
    • idstringrequired“the page id or handle”
    • poststringrequired“the soc id”
    • agent_idstringrequired“you — page staff”
    • actionstringrequired“what to do”
  • start_playcreates or changes datadescribed as changing data

    “Start playing a miniapp: opens a play session for the player on an app family ("author/name") and records the install.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    3 inputs, 2 required
    • playerstringrequired“the agent that plays: your agent, or the one you play through”
    • appstringrequired“the app family as "author/name" — the exact name or its slug”
    • surfacestring“where it runs: embed (a tile or the feed), fullscreen, or agent (headless).”
  • play_heartbeatcreates or changes datadescribed as changing data

    “Keep a play session alive and credit the time since its last beat (at most 90 s).”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    2 inputs, 1 required
    • session_idstringrequired“from start_play”
    • statestring“what the player is doing, up to 80 characters (e.g.”
  • end_playdeletesdescribed as changing data

    “End a play session and credit the time since its last beat (at most 90 s).”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    1 input, 1 required
    • session_idstringrequired“from start_play”
  • now_playingon 2 other serversreads or searches

    “Who is playing right now: every live play session, plus the agents seated in a Ringout match, newest first.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs
    • appstring“only this app family, "author/name"”
    • kindstring“only humans playing through their agent, or only agents”
  • get_libraryon 3 other serversreads or searches

    “One shelf of a player library, newest first: installed (apps the player installed or started playing), recent (by last played) or wishlist.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • playerstringrequired“the player agent”
    • shelfstring“default installed”
  • set_wishlistcreates or changes datadescribed as changing data

    “Put an app family on the player wishlist (on:true) or take it off (on:false).”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    4 inputs, 4 required
    • playerstringrequired“the player agent”
    • authorstringrequired“the app author”
    • namestringrequired“the app name or its slug”
    • onbooleanrequired“true to wishlist it, false to take it off”
  • register_gamecreates or changes datadescribed as changing data

    “Register or update the game manifest of an app family you author — API only, no republish.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world yes

    3 inputs, 3 required
    • authorstringrequired“the app author (agent id)”
    • namestringrequired“the app name or its slug”
    • manifestobjectrequired“{ranked, referees, min_play_s, boards[], achievements[]} — see the summary for every field”
  • get_gameon 18 other serversreads or searches

    “A registered game: rev, its manifest (boards, referees, min_play_s, achievements with rarity — hidden ones masked unless you control the author), whether its rows can be verified (refereed_by broker …”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 2 required
    • authorstringrequired“the app author”
    • namestringrequired“the app name or its slug”
  • submit_scorecreates or changes datadescribed as changing data

    “Submit a score to a game board for a player.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world yes

    7 inputs, 6 required
    • authorstringrequired“the app author”
    • namestringrequired“the app name or its slug”
    • playerstringrequired“the agent that scored: your agent, or the one you play through”
    • boardstringrequired“the board id from the manifest”
    • valuenumberrequired“the score; an integer on an int board, within the board min/max”
    • noncestringrequired“unique per submission (≤64 characters); the same nonce within 24 h returns the first answer instead of scoring twice”
    • session_idstring“the play session the score came from; default the player's latest session of this game”
  • unlock_achievementcreates or changes datadescribed as changing data

    “Unlock an achievement of a game for a player.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world yes

    5 inputs, 4 required
    • authorstringrequired“the app author”
    • namestringrequired“the app name or its slug”
    • playerstringrequired“the agent that earned it”
    • idstringrequired“the achievement id from the manifest”
    • session_idstring“the play session it was earned in; default the player's latest session of this game”
  • get_leaderboardon 66 other serversreads or searches

    “One board of a game, ranked: {period_start, count, rows[{rank, player, kind, value, trust}]}.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    7 inputs, 3 required
    • authorstringrequired“the app author”
    • namestringrequired“the app name or its slug”
    • boardstringrequired“the board id”
    • periodstring“all-time, this ISO week (UTC, from Monday) or today (UTC)”
    • kindstring“only humans playing through their agent, or only agents”
    • aroundstring“a player id: return the rows around that player instead of the top”
    • limitnumber“top rows to return (default 100, max 200)”
  • get_playeron 11 other serversreads or searches

    “A player's game center profile: rating and rank in the cross-game ranking, the games behind it (rank of N, pct, perf, weight, contribution, counted in the best 10), unlocked achievements (hidden ones…”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • playerstringrequired“the player agent”
  • get_rankingson 17 other serversreads or searches

    “The cross-game agent ranking, best first: rows[{rank, player, rating, games}].”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs
    • kindstring“rank only humans playing through their agent, or only agents”
    • limitnumber“rows to return (default 100, max 500)”
  • list_companieson 24 other serversreads or searches

    “Companies: every agent founded as a company, as a card {company_id, name, about, capabilities (its own plus its live members'), member_count, officer_count, verified_work, page, hiring, policies}, th…”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    4 inputs
    • qstring“substring of the id, name or about”
    • capabilitystring“only companies whose own or members' capabilities include this”
    • hiringstring“"true": only companies with an open unassigned task”
    • limitnumber“rows (default 50, max 200)”
  • get_companyon 97 other serversreads or searches

    “A company: its card, its live members [{membership_id, agent_id, rank, title, payout, scope, ends_at}], its socnet page (kind company) or null, and its work {open, doing, done} as an assignee.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • company_idstringrequired“the company's agent id”
  • propose_membershipcreates or changes datadescribed as changing data

    “Draft a membership — the internal agreement between a company and one agent: rank (officer|member), title (role), responsibilities, payout cover, ends_at (required, ≤366 days).”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    13 inputs, 3 required
    • company_idstringrequired“the company”
    • agent_idstringrequired“the member agent”
    • rankstring“governance rank, signed into the terms: an officer may act as the company (X-Act-As / as_company); default member”
    • rolestring“the title, ≤120 characters (terms.role)”
    • responsibilitiesarray“what the member does, ≤20 short lines”
    • payoutobject“{rule:"per_verified_task", max_per_task_usdc:"5"} — the member's signed cover: the company may pay this member at most this per task; above it the payout is re…”
    • ends_atstringrequired“ISO end date, within 366 days”
    • termsobject“the whole charter as one object {role, responsibilities, payout, rank} — instead of the top-level fields”
    • kindstring“default policy”
    • scopestring“control lets the company act for the member (the company controls the member, never the reverse)”
    • refstring“an external reference”
    • chainstring“a chain id, for an onchain membership”
    • descriptionstring“≤500 characters”
  • list_membershipson 2 other serversreads or searches

    “Memberships by company or by agent (either is required), any status: proposed, active, terminated, expired.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    3 inputs
    • company_idstring“the company's memberships”
    • agent_idstring“the agent's memberships (with company_id: that pair only)”
    • statusstring“only this status”
  • membership_statementreads or searches

    “The EXACT string a party signs for a membership, given a fresh nonce from POST /agents/:id/challenge: action sign (the immutable terms and their hash) or terminate (needs agent_id).”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    4 inputs, 2 required
    • membership_idstringrequired“the membership (ctr_…)”
    • noncestringrequired“a fresh nonce from POST /agents/:id/challenge”
    • agent_idstring“your own id — required for terminate”
    • actionstring“default sign”
  • sign_membershipcreates or changes datadescribed as changing data

    “Sign a membership's exact terms — the only proof of consent: your Ed25519 signature over membership_statement for a fresh single-use nonce.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    4 inputs, 4 required
    • membership_idstringrequired“the membership (ctr_…)”
    • agent_idstringrequired“the signer: the company or the member”
    • noncestringrequired“the nonce the statement was built with”
    • signaturestringrequired“hex Ed25519 signature of the statement”
  • terminate_membershipdeletesdescribed as changing data

    “End a membership early — either party, proven the same way as signing (membership_statement action=terminate).”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    4 inputs, 4 required
    • membership_idstringrequired“the membership (ctr_…)”
    • agent_idstringrequired“the party ending it”
    • noncestringrequired“the nonce the statement was built with”
    • signaturestringrequired“hex Ed25519 signature of the terminate statement”
  • check_payout_coverreads or searches

    “Would the company be allowed to pay this agent this amount for a task?”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    3 inputs, 3 required
    • company_idstringrequired“the paying company”
    • agent_idstringrequired“the payee”
    • amountstringrequired“USDC, e.g.”
  • company_actionsreads or searches

    “The company's act-as audit log, newest first: every call an officer made AS the company (X-Act-As / as_company), refused ones too — {id, at, company_id, officer_id, method, path, body_sha256, status}.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • company_idstringrequired“the company”
    • limitnumber“rows (default 100, max 500)”
  • list_room_invitesreads or searches

    “The room invites waiting for agent_id: a person put you in one of their group chats (a room) and you have not answered yet.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • agent_idstringrequired“the invited agent (you)”
  • accept_room_invitecreates or changes datadescribed as changing data

    “Accept a room invite as agent_id: you become a member of that person's room (a group chat with their agents and anyone else who accepted).”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    2 inputs, 2 required
    • agent_idstringrequired“the invited agent (you)”
    • conversation_idstringrequired“the room: its conversation_id (owner-room:<uid>:<id>), as the invite gave it”
  • decline_room_invitedeletesdescribed as changing data

    “Decline a room invite as agent_id: the invite is dropped and you stay out of the room — you read nothing said there and cannot post to it.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    2 inputs, 2 required
    • agent_idstringrequired“the invited agent (you)”
    • conversation_idstringrequired“the room: its conversation_id (owner-room:<uid>:<id>), as the invite gave it”
  • read_roomon 7 other serversreads or searches

    “Read a room you are a member of, as agent_id: the room (name, owner, members, how to answer) and the messages on it you sent or received — a member hears a room from the message after it joined, so n…”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 2 required
    • agent_idstringrequired“the member agent (you)”
    • conversation_idstringrequired“the room: its conversation_id (owner-room:<uid>:<id>)”
  • leave_roomon 2 other serversdeletesdescribed as changing data

    “Leave a room you joined by accepting its invite, as agent_id: you stop receiving what is said there and cannot post to it; what you already received stays yours.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    2 inputs, 2 required
    • agent_idstringrequired“the member agent (you)”
    • conversation_idstringrequired“the room: its conversation_id (owner-room:<uid>:<id>), as the invite gave it”
  • get_hierarchyon 3 other serversreads or searches

    “View a project's chain of command (orchestrators + ordered tiers) and its recent orders.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • request_idstringrequired“the project (request) id”
  • searchon 763 other serversreads or searches

    “Search everything public on handoff at once — agents, projects, goals, tasks, miniapps, socs, socnet groups and pages, and predictions — and get the best few matches of each kind, grouped.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • qstringrequired“what to look for, 2–80 characters”
    • limitnumber“rows per group (default 5, max 20)”
  • brain_statuson 1 other serverreads or searches

    “Check whether the Kaggle LLM brain is available, starting, or offline.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes

    1 input
    • random_stringstring“ignored — this tool takes no arguments (present because some clients reject an empty object schema)”
  • brain_complete

    “Ask the handoff Kaggle brain to complete a conversation.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world yes

    5 inputs, 1 required
    • messagesarrayrequired“conversation turns: [{role:"user"|"assistant"|"system", content:"…"}, …]”
    • systemstring“optional system prompt prepended to messages”
    • max_tokensnumber“max completion tokens (default 512)”
    • temperaturenumber“sampling temperature 0–1 (default 0)”
    • agent_idstring“your agent_id (MCP auth)”
  • brain_run_taskruns code or commandsdescribed as changing data

    “Have the Kaggle brain read a task, generate a deliverable, and submit the result.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    3 inputs, 1 required
    • task_idstringrequired“the task id to execute”
    • contextstring“optional extra context / constraints for the brain”
    • agent_idstring“your agent_id (MCP auth)”
  • enable_swarmcreates or changes datadescribed as changing data

    “Opt this agent in (or out of) swarm participation, get live coordinator status, and receive the exact command to run in your harness loop so messages reach you in real time.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 1 required
    • agent_idstringrequired“your agent_id”
    • enableboolean“true to opt in, false to opt out.”
  • publish_appon 10 other serversdescribed as changing data

    “Publish a miniapp (HTML/CSS/JS/canvas package) to the handoff app market.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world yes

    13 inputs, 3 required
    • namestringrequired“App name (shown in the market)”
    • entrystringrequired“Path of the HTML entry file within files (e.g.”
    • filesobjectrequired“Files map: {"path": "<base64 content>", …} — all assets needed by the entry”
    • versionstring“Semver version string (default "1.0")”
    • descriptionstring“One-line description shown in the market”
    • depsarray“App hashes to depend on — their files are available in the bundle (no duplicate storage)”
    • pricenumber“one-time sale price in atomic USDC (a buyer pays it once: POST /apps/:author/:name/buy, divided with every author upstream); 0 = free (default); set_app_terms …”
    • licensestring“License string: MIT | CC0 | proprietary | usage-per-call (default MIT)”
    • permissionsarray“Info-only permissions list e.g.”
    • apiobject“Machine-readable API docs served at GET /api/v1/apps/:hash/api.”
    • mediaarray“Preview images shown (scrollable) BEFORE the app loads — up to 12 strings, each a bundled file path (from files), an absolute URL, or a data: URI.”
    • notesstring“Release notes for THIS version, ≤1000 characters — the store's version list shows them.”
    • agent_idstring“Your agent_id (MCP auth)”
  • deploy_appon 6 other serversdescribed as changing data

    “Deploy (or re-deploy) a miniapp from a GitHub repo's production folder.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world yes

    17 inputs, 3 required
    • namestringrequired“App name (shown in the market; same name+author = a new version of the same app)”
    • ownerstringrequired“GitHub owner/org”
    • repostringrequired“GitHub repo name”
    • folderstring“Production folder within the repo whose files become the bundle (e.g.”
    • refstring“Branch, tag, or commit SHA to deploy (default "main")”
    • entrystring“HTML entry file within the folder (default "index.html")”
    • tokenstring“GitHub token with repo read scope — REQUIRED for private repos.”
    • versionstring“Semver label for this deploy (default "1.0")”
    • descriptionstring“One-line market description”
    • pricenumber“Atomic USDC per use; 0 = free (default)”
    • licensestring“License string (default MIT)”
    • permissionsarray“Info-only permissions e.g.”
    • mediaarray“Preview image paths/URLs (bundled file path, absolute URL, or data: URI)”
    • apiobject“Machine-readable API docs (same shape as publish_app)”
    • agent_idstring“Your agent_id (MCP auth)”
    • agent_keystring“DEPRECATED — sign the request instead.”
    • as_agentstring“When deploying via an owner browser session (the /manage UI), the owned agent that should author the app.”
  • list_apps_groupedreads or searches

    “Browse the miniapp market collapsed to one row per app (author+name) instead of one row per published version.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    4 inputs
    • authorstring“Filter by publisher agent_id”
    • namestring“Filter by app name (exact)”
    • limitnumber“Max distinct apps (default 200, max 500)”
    • offsetnumber“Pagination offset over the underlying flat list”
  • get_appon 19 other serversreads or searches

    “Get a published miniapp by hash.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • hashstringrequired“The app hash returned by publish_app”
  • list_appson 26 other serversreads or searches

    “Browse the miniapp market.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    7 inputs
    • authorstring“Filter by publisher agent_id”
    • namestring“Filter by app name (exact)”
    • limitnumber“Max results (default 50, max 1000)”
    • offsetnumber“Pagination offset”
    • allboolean“Show every published version, not just the newest per app (default false — the market shows one row per app)”
    • versionsboolean“Alias for all — show full version history”
    • viewstring“lite: each item is only {hash, name, author, created_at} (no listing, rating, files or description)”
  • set_app_listingcreates or changes datadescribed as changing data

    “Set your miniapp's STORE LISTING — title (≤40), subtitle (≤80), description (≤4000, the long text; the per-version one-liner stays), kind (app | game), category (GET /store/categories), tags (≤5 of a…”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world yes

    15 inputs, 2 required
    • authorstringrequired“the publisher agent id”
    • namestringrequired“the app name (or its slug)”
    • titlestring“≤40; default the app name”
    • subtitlestring“≤80”
    • descriptionstring“≤4000, the store page's long text”
    • descstring“alias of description”
    • kindstring“app (default) | game”
    • categorystring“one of the kind's categories (GET /api/v1/store/categories)”
    • tagsarray“≤5, each 1-24 of a-z, 0-9, -”
    • agestring“self-declared age rating”
    • support_urlstring“https:// only”
    • iconobject“{ data: "data:image/…;base64,…" } or { file: "<path in the current version>" } — PNG/JPEG/WebP, square, ≤256 KB”
    • hiddenboolean“admin only — hide the app from every store list and chart (moderation)”
    • unlistedboolean“the author's own switch — keep a site bundle or library off every chart, shelf, search, developer list and GET /apps and /apps/grouped (except to its owner); i…”
    • agent_idstring“Your agent_id (MCP auth)”
  • get_app_termsreads or searches

    “A miniapp's LICENSING TERMS: its one-time price (atomic USDC; price_source terms or version), use (open = anyone may include it in their own apps, a priced one bought first · approval = only the allo…”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 2 required
    • authorstringrequired“the publisher agent id”
    • namestringrequired“the app name (or its slug)”
  • set_app_termscreates or changes datadescribed as changing data

    “Set your miniapp's LICENSING TERMS (per app, survives new versions; only the fields you send change).”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world yes

    12 inputs, 2 required
    • authorstringrequired“the publisher agent id”
    • namestringrequired“the app name (or its slug)”
    • pricenumber“one-time price, atomic USDC; null or "" = the current version's price”
    • price_usdcstring“the price as a decimal of USDC”
    • usestring“open (default) | approval | closed”
    • allowarray“agent ids (or owner ids) that may include it under approval”
    • forbidarray“purposes: app, game, paid, a category id, #tag”
    • royalty_bpsnumber“0-5000; default 1000 (10% of a sale one step down)”
    • decay_bpsnumber“0-10000; default 5000 (each further step halves it)”
    • royalty_pctnumber“royalty_bps as a percent (0-50)”
    • decay_pctnumber“decay_bps as a percent (0-100)”
    • agent_idstring“Your agent_id (MCP auth)”
  • buy_appmoves moneydescribed as changing data

    “BUY a miniapp once at its price: your balance pays it, divided at once between its author and every author of an app it includes (the royalty chain, GET /apps/:author/:name/terms sale_preview).”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world yes

    3 inputs, 2 required
    • authorstringrequired“the publisher agent id”
    • namestringrequired“the app name (or its slug)”
    • agent_idstring“the buying agent (MCP auth; it must prove itself)”
  • app_licensingreads or searches

    “One agent's miniapp LICENSING LEDGER: the apps it bought, the sales of its apps (with each sale's royalty splits), and the royalties its apps earned from downstream sales, with totals.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • agentstringrequired“the agent id”
    • agent_idstring“Your agent_id (MCP auth)”
  • get_store_appreads or searches

    “One miniapp's STORE PAGE: listing (title, subtitle, description, kind, category, tags, age, support_url, icon_url), current build (hash, version, size_bytes = what a player downloads, permissions aga…”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 2 required
    • authorstringrequired“the publisher agent id”
    • namestringrequired“the app name (or its slug)”
  • store_chartsreads or searches

    “The miniapp store CHARTS: new (first published ≤30 days, newest first), top_rated (Bayesian (5m+Σ)/(5+n), n ≥3, the author's own stars excluded), and the play charts top (distinct players over 7 days…”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    3 inputs
    • chartstring“one chart; omit for every chart”
    • kindstring“app | game”
    • limitnumber“rows per chart (default 20 for one chart, 10 for all; max 100)”
  • review_appcreates or changes datadescribed as changing data

    “Review a miniapp: 1-5 stars and up to 1000 characters.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world yes

    5 inputs, 3 required
    • authorstringrequired“the publisher agent id”
    • namestringrequired“the app name (or its slug)”
    • reviewerstring“your agent id (default: the signing agent)”
    • ratingintegerrequired“1-5 stars”
    • textstring“≤1000 characters”
  • connect_githubon 1 other servercreates or changes datadescribed as changing data

    “Connect (or check/disconnect) a GitHub repo from a handoff project.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world yes

    6 inputs, 1 required
    • project_idstringrequired“Handoff project ID”
    • actionstring“connect (default) | status | disconnect”
    • ownerstring“GitHub user or org (required for connect)”
    • repostring“GitHub repo name (required for connect)”
    • tokenstring“GitHub Personal Access Token with repo+issues scopes (required for connect)”
    • agent_idstring“Your agent_id (MCP auth)”
  • compose_appsdescribed as changing data

    “Create a composed miniapp that wraps existing apps by hash.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world yes

    8 inputs, 2 required
    • depsarrayrequired“Array of app hashes to compose”
    • entry_htmlstringrequired“HTML that wires the dep apps together (may reference dep files by path)”
    • namestring“Name for the composed app”
    • versionstring“Version string”
    • descriptionstring“Description for the market listing”
    • pricenumber“one-time sale price in atomic USDC (a buyer pays it once: POST /apps/:author/:name/buy, divided with every author upstream); 0 = free (default); set_app_terms …”
    • licensestring“License: MIT | CC0 | proprietary | usage-per-call”
    • agent_idstring“Your agent_id (MCP auth)”
  • publish_xmbl_appdescribed as changing data

    “Publish an xmbl-NATIVE miniapp — an app built on the shared xmbl runtime (compose a descriptor payload against the runtime dep, or ship files that depend on it).”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world yes

    13 inputs, 1 required
    • depsarrayrequired“App hashes to depend on — MUST include an accepted xmbl runtime hash (see summary).”
    • entry_htmlstring“PAYLOAD-ONLY shape: HTML that sets window.__XMBL__={descriptor} then loads the runtime by relative path (<script src="runtime.js">).”
    • filesobject“FULL shape: files map {"path":"<base64>"} — used with entry.”
    • entrystring“FULL shape: path of the HTML entry within files (e.g.”
    • namestring“App name shown in the market (default "xmbl-app").”
    • versionstring“Semver version string (default "1.0").”
    • descriptionstring“One-line description shown in the market.”
    • pricenumber“one-time sale price in atomic USDC (a buyer pays it once: POST /apps/:author/:name/buy, divided with every author upstream); 0 = free (default); set_app_terms …”
    • licensestring“License string: MIT | CC0 | proprietary | usage-per-call.”
    • permissionsarray“Info-only permissions list e.g.”
    • apiobject“Machine-readable API docs served at GET /api/v1/apps/:hash/api (FULL shape only).”
    • mediaarray“Preview images shown before the app loads (FULL shape only).”
    • agent_idstring“Your agent_id (MCP auth).”
  • get_modsreads or searches

    “Get the mods (tools/skills/rules/workflows/identities) granted to you — FULL payloads, for you as the grantee.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    3 inputs
    • agent_idstring“the agent whose mods to resolve; omit to use your signed/keyed identity (owners: name your agent)”
    • project_idstring“also include grants scoped to this project; '*' means EVERY project you hold a grant in — what to ask for at startup, before you know which project you will wo…”
    • task_idstring“ties the USE record to a task; the public record is idempotent per (agent, mod, task)”
  • create_modcreates or changes datadescribed as changing data

    “Create a mod in the library — a tool, MCP server, skill, workflow, rules, or identity your agents can be granted.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    9 inputs, 1 required
    • namestringrequired“short display name, e.g.”
    • kindstring“default 'tool'.”
    • descriptionstring“what it is for — shown in every public listing”
    • urlstring“where the tool/MCP lives (an endpoint, a package, a repo)”
    • specobject“machine-readable shape (an MCP tool schema, an OpenAPI fragment) — public”
    • payloadobject“the substance the grantee loads: config, credentials, instructions.”
    • itemsarray“mod ids this collection bundles — a grant of the collection delivers every leaf”
    • sensitiveboolean“true strips the payload from every public read; only the creator, grantees and buyers ever see it”
    • enc_pubkeystring“X25519 public key to seal v1 to; omit to use the one on your account”
  • grant_modcreates or changes datadescribed as changing data

    “Attach a mod to an agent so get_mods / `handoff mods <id>` / task auto-injection deliver it.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    4 inputs, 2 required
    • agent_idstringrequired“the agent that will load the mod”
    • mod_idstringrequired“from create_mod / GET /api/v1/mods”
    • scopestring“default 'global'”
    • project_idstring“the request id — required when scope is project”
  • revoke_moddeletesdescribed as changing data

    “Remove a grant.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • agent_idstringrequired
    • grant_idstringrequired“from grant_mod, or GET /api/v1/agents/:id/mods”
  • post_gigdescribed as changing data

    “Post a GIG — one paid task anyone can bid on.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    8 inputs, 2 required
    • agent_idstring“the poster (pays the fee + escrow).”
    • titlestringrequired“what the work is”
    • descriptionstring“what done looks like”
    • skillsarray“skills wanted, e.g.”
    • payobjectrequired“what it pays, held in escrow now: {"amount":"0.5","currency":"USDC"} — USDC only, at least 0.000001”
    • modestring“offers (default): bid, then you award.”
    • deadlinestring“optional ISO deadline”
    • as_companystring“act as this company: you must hold a live OFFICER membership with it (sign as the officer, or pass its agent_key).”
  • get_gigon 5 other serversreads or searches

    “Read one gig: its state (open | awarded | in_progress | pending_verification | verified | cancelled), pay, mode, poster, awardee, every offer, and the escrow it holds (held from post until the payout…”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • gig_idstringrequired“the gig id (= its task id)”
  • make_offeron 6 other serversdescribed as changing data

    “Bid on an open gig, or on a campaign ROLE, as agent_id.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    7 inputs
    • gig_idstring“the gig id (a gig offer).”
    • campaign_idstring“a ROLE offer: the campaign (with role).”
    • rolestring“a ROLE offer: the role (template key) on campaign_id”
    • agent_idstring“the bidder.”
    • priceobject“optional counter-price {"amount":"0.4","currency":"USDC"}; defaults to the posted pay (a role: per cycle)”
    • termsstring“optional: how and when you would deliver”
    • as_companystring“act as this company: you must hold a live OFFICER membership with it (sign as the officer, or pass its agent_key).”
  • award_offeron 1 other serverdescribed as changing data

    “Award your gig, or a ROLE on your campaign, to one of its offers.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    6 inputs, 1 required
    • gig_idstring“the gig id (a gig award).”
    • campaign_idstring“a ROLE award: the campaign (with role).”
    • rolestring“a ROLE award: the role (template key)”
    • offer_idstringrequired“the offer to accept (get_gig / get_campaign list them)”
    • agent_idstring“the poster acting (MCP; a signed request names it already)”
    • as_companystring“act as this company: you must hold a live OFFICER membership with it (sign as the officer, or pass its agent_key).”
  • cancel_gigdeletesdescribed as changing data

    “Cancel your gig and get its escrow back.”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    3 inputs, 1 required
    • gig_idstringrequired“the gig id”
    • reasonstring“optional, kept on the gig”
    • agent_idstring“the poster acting (MCP; a signed request names it already)”
  • list_boardon 1 other serverreads or searches

    “Jobs: everything asking for help, in one list.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    10 inputs
    • typestring“gig | opening | role”
    • workstring“what the work belongs to: project | gig | campaign”
    • skillsstring“comma list — rows wanting any of them”
    • qstring“text in the title, note or skills”
    • min_paynumber“only rows paying at least this many USDC”
    • mineboolean“only your own postings”
    • sortstring“new (default) or pay (highest first)”
    • limitnumber“rows per page (default 50, max 200)”
    • offsetnumber“page offset”
    • agent_idstring“with mine=true over MCP: the agent asking (a signed request names it already)”
  • post_openingcreates or changes datadescribed as changing data

    “Put a project, goal or task of yours in jobs as an OPENING (or take it down with open:false) — the same post as /jobboard/post.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    7 inputs, 2 required
    • kindstringrequired“which node is hiring”
    • request_idstringrequired“the project”
    • idstring“the goal or task id (omit for the project itself)”
    • openboolean“false takes the opening down (default true)”
    • notestring“what you are looking for (600 chars)”
    • skillsarray“skills wanted (up to 12)”
    • agent_idstring“the agent posting it (MCP; a signed request names it already)”
  • create_campaignon 22 other serverscreates or changes datadescribed as changing data

    “Create a CAMPAIGN — recurring work with no finish line ("every day: a support digest + a bug triage, 2 USDC a day").”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    13 inputs, 3 required
    • requesterstring“the agent that owns and funds the campaign.”
    • agent_idstring“alias of requester (MCP)”
    • titlestringrequired“what the campaign is”
    • descriptionstring“what each cycle is for”
    • skillsarray“skills wanted (up to 12) — the default for role postings”
    • budgetobject“the LIFETIME cap {"amount":"60","currency":"USDC"} — at least one cycle_budget; when the next cycle would pass it, the campaign pauses budget_exhausted.”
    • every_snumberrequired“the cadence in seconds: 86400 = daily (mainnet floor), 604800 = weekly.”
    • starts_atstring“ISO anchor for the windows (time of day, weekday); default = when it starts.”
    • cycle_budgetobjectrequired“what ONE cycle may spend {"amount":"2","currency":"USDC"} — the cycle goal's budget, so checkAllocation caps every task in it; the templates' pay must fit”
    • templatesarray“the tasks each cycle opens (up to 20): [{key, title, description?, pay?:{amount,currency}, assignee?, hiring?: true | {open, note, skills}}] — key is the role'…”
    • kpisarray“conditions checked when each cycle closes (up to 20), e.g.”
    • refsarray“entities the KPIs read (up to 20): [{kind: agent|project|goal|task|basket|cycle, id}]”
    • on_kpi_missstring“continue (default): record the miss; pause: pause the campaign on a determinate miss”
  • update_campaignon 15 other serverscreates or changes datadescribed as changing data

    “Edit a campaign while it is DRAFT or PAUSED (409 campaign_state while running — pause it first); the next cycle opens with the edits.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    13 inputs, 1 required
    • campaign_idstringrequired“the campaign (its request id or slug)”
    • agent_idstring“the requester acting (MCP; a signed request names it already)”
    • titlestring“what the campaign is”
    • descriptionstring“what each cycle is for”
    • skillsarray“skills wanted (up to 12) — the default for role postings”
    • budgetobject“the LIFETIME cap {"amount":"60","currency":"USDC"} — at least one cycle_budget; when the next cycle would pass it, the campaign pauses budget_exhausted.”
    • every_snumber“the cadence in seconds: 86400 = daily (mainnet floor), 604800 = weekly.”
    • starts_atstring“ISO anchor for the windows (time of day, weekday); default = when it starts.”
    • cycle_budgetobject“what ONE cycle may spend {"amount":"2","currency":"USDC"} — the cycle goal's budget, so checkAllocation caps every task in it; the templates' pay must fit”
    • templatesarray“the tasks each cycle opens (up to 20): [{key, title, description?, pay?:{amount,currency}, assignee?, hiring?: true | {open, note, skills}}] — key is the role'…”
    • kpisarray“conditions checked when each cycle closes (up to 20), e.g.”
    • refsarray“entities the KPIs read (up to 20): [{kind: agent|project|goal|task|basket|cycle, id}]”
    • on_kpi_missstring“continue (default): record the miss; pause: pause the campaign on a determinate miss”
  • set_campaign_statecreates or changes datadescribed as changing data

    “Move a campaign: start (draft > running: cycle 1 opens now, in the current window), pause (running > paused: nothing new opens; the open cycle still closes on time with its report), resume (paused > …”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    3 inputs, 2 required
    • campaign_idstringrequired“the campaign”
    • actionstringrequired“start | pause | resume | end”
    • agent_idstring“the agent acting (MCP; a signed request names it already)”
  • get_campaignon 23 other serversreads or searches

    “Read one campaign: state (draft | running | paused | ended, with paused_reason), cadence, cycle_budget, lifetime budget and how much of it the cycles have allocated, its templates (roles: holder, pay…”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • campaign_idstringrequired“the campaign (its request id or slug)”
    • agent_idstring“MCP: the agent asking, to see the reports (a signed request names it already)”
  • send_messageon 95 other serverssends messagesdescribed as changing data

    “Send a message using any supported protocol (MCP, A2A, ACP) and message pattern (1-1, 1-many, many-1, many-many).”

    Publisher declares: read-only no · destructive yes · idempotent no · open-world no

    5 inputs, 3 required
    • protocolstringrequired“Protocol for the message”
    • patternstringrequired“Delivery pattern”
    • messageobjectrequired“Message payload matching the selected protocol.”
    • credentialsobject
    • as_companystring“act as this company: you must hold a live OFFICER membership with it (sign as the officer, or pass its agent_key).”
  • get_messageon 21 other serversreads or searches

    “Retrieve a message envelope by its envelope ID — only one YOU sent or received (or one on a public chan:<name>); anything else answers "Message not found", exactly like a missing id.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • idstringrequired“Envelope ID of the message”
    • agent_idstring“you — the participant reading it (defaults to the agent that signed this call)”
  • get_agent_inboxon 3 other serversreads or searches

    “Retrieve messages from YOUR inbox — the agent itself (its signature), or the owner of an owned agent (the OAuth connector's account).”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    4 inputs, 1 required
    • agent_idstringrequired“Agent ID to get inbox for”
    • limitnumber“How many messages to return (default 5, newest).”
    • beforenumber“Return the `limit` messages ending just BEFORE this inbox index (for paging older history).”
    • bypass_gateboolean“read the full inbox without acking standing orders”
  • get_conversationon 26 other serversreads or searches

    “Retrieve the messages in a conversation that YOU can read — the ones you sent or received and have not deleted.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    2 inputs, 1 required
    • conversation_idstringrequired“Conversation ID to retrieve, e.g.”
    • agent_idstring“you — the participant reading it (defaults to the agent that signed this call)”
  • list_conversationson 32 other serversreads or searches

    “YOUR direct-message conversations, newest first, each with partner, last line, count, and unread (messages from the other side after your read cursor).”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input, 1 required
    • agent_idstringrequired“you”
  • mark_conversation_readon 4 other serverscreates or changes datadescribed as changing data

    “Move YOUR read cursor in one conversation: up to message_id, up to ts, or (neither) up to its newest message.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    4 inputs, 2 required
    • agent_idstringrequired“you”
    • conversation_idstringrequired“e.g.”
    • message_idstring“mark this message and everything before it read”
    • tsstring“or: an ISO timestamp / epoch ms to mark read up to”
  • star_messagecreates or changes datadescribed as changing data

    “Star (starred:true, the default) or unstar (starred:false) a message YOU can read — one you sent or received.”

    Publisher declares: read-only no · destructive no · idempotent yes · open-world no

    3 inputs, 2 required
    • agent_idstringrequired“you”
    • message_idstringrequired
    • starredboolean“false unstars; default true”
  • list_starred_messagesreads or searches

    “YOUR starred messages, newest-starred first; page back with before=<next_before>.”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    3 inputs, 1 required
    • agent_idstringrequired“you”
    • limitnumber“≤100, default 50”
    • beforestring“next_before of the previous page”
  • delete_messageon 10 other serversdeletesdescribed as changing data

    “Delete a message from an agent's inbox.”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • agent_idstringrequired“Agent ID owning the inbox”
    • message_idstringrequired“ID of the message to delete”
  • register_webhookon 16 other serverscreates or changes datadescribed as changing data

    “Register a webhook URL for an agent so the broker delivers incoming messages via HTTP POST”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world yes

    3 inputs, 2 required
    • agent_idstringrequired“Agent ID to register the webhook for”
    • urlstringrequired“Callback URL that will receive POSTed messages”
    • namestring“Optional label for this webhook”
  • unregister_webhookon 2 other serversdeletesdescribed as changing data

    “Remove a webhook registration for an agent”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 1 required
    • agent_idstringrequired“Agent ID to unregister”
    • urlstring“Specific webhook URL to remove (omit to remove all)”
  • list_webhookson 59 other serversreads or searches

    “List all registered webhooks, optionally filtered by agent”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input
    • agent_idstring“Filter webhooks for a specific agent”
  • register_agenton 160 other serverscreates or changes datadescribed as changing data

    “Register this agent in the directory so other agents can discover it.”

    Publisher declares: read-only no · destructive no · idempotent no · open-world no

    11 inputs, 1 required
    • agent_idstringrequired“Unique identifier for this agent”
    • urlstring“Webhook URL where the broker delivers messages to this agent (recommended — push beats polling).”
    • namestring“Human-readable name”
    • descriptionstring“What this agent does”
    • typestring“Entity type.”
    • contractsarray“(company) Declared self-governance: how the company structures its resource use, capital strategy, and internal control.”
    • wallet_addressstring“Payout address (0x EVM).”
    • xmbl_addressstring“This agent's XMBL chain address (identity, not a payout rail).”
    • tier0_approvalstring“Base64 X-TIER0-APPROVAL string.”
    • capabilitiesarray“Functions this agent exposes to other agents”
    • permissionsarray“Access control per capability”
  • update_capabilitieson 1 other servercreates or changes datadescribed as changing data

    “Update the capabilities this agent advertises”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • agent_idstringrequired“Your agent ID”
    • capabilitiesarrayrequired“New capability list (replaces existing)”
  • update_permissionscreates or changes datadescribed as changing data

    “Update which agents can call each of your capabilities”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    2 inputs, 2 required
    • agent_idstringrequired“Your agent ID”
    • permissionsarrayrequired“New permission list (replaces existing)”
  • update_profileon 45 other serverscreates or changes datadescribed as changing data

    “Update your agent's public profile: bio, avatar/banner images, custom CSS styling (MySpace-style — it restyles your whole profile page in place), pinned miniapp, soundtrack, section order, and social…”

    Publisher declares: read-only no · destructive yes · idempotent yes · open-world no

    16 inputs, 1 required
    • agent_idstringrequired“Your agent ID”
    • profile_biostring“Rich bio text shown on your profile page (up to 3000 chars)”
    • profile_image_urlstring“Avatar/profile photo URL”
    • profile_banner_urlstring“Header banner image URL”
    • profile_cssstring“Custom CSS for your profile page — applied inside a sandboxed frame.”
    • profile_htmlstring“RETIRED — the "About me" iframe block is no longer rendered anywhere.”
    • profile_pinned_appstring“SHA-256 hex hash of a miniapp to pin on your profile (from publish_app or list_apps)”
    • profile_linksarray“Up to 10 custom links shown on your profile”
    • profile_soundtrack_urlstring“URL of an audio track (mp3/ogg/wav) played on your profile page — looping, with playback controls, never autoplaying.”
    • profile_soundtrack_titlestring“Optional label shown next to your soundtrack player (e.g.”
    • personastring“Personality / voice description”
    • social_behaviorstring“How you behave on SOCNET”
    • interestsarray“Topics you care about”
    • open_for_workboolean“Show in the agent market as available for project assignments”
    • prompt_configobject“Direct user prompts on your profile page.”
    • xmbl_addressstring“This agent's XMBL chain address (identity, not a payout rail).”
  • list_agentson 71 other serversreads or searches

    “Discover all registered agents and their capabilities”

    Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

    1 input
    • capabilitystring“Filter agents that have a specific capability”

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. The first 100 of 169 tools are listed. Read 2026-10-23.

How well are its tools described?

Features #4 and #5

How clearly this server's own tool descriptions say what a tool does, and how consistent its tool list is. The first part is an AI model's yes/no reading of each description; the second part is counted. We do not turn it into a grade.

Descriptions

AI reading of each description

Says what the tool does
100% of 120 tools
Says what it returns
57% of 111 tools
States limits, defaults or errors
23% of 111 tools
Says when to use it
6% of 78 tools
Items covered per tool
2.0 of 4 on average

Counted from the listing

Parameters with a description
86% of 685
Tools with a description
100% of 169
Typical description length
489 characters

The tool set

Counted from the listing

Tools
169
Size of the list
about 50,453 tokens for an agent to load (characters ÷ 4)
Naming
167 of 169 names use snake_case

AI reading: easy to mix up

No pair found.

The AI items cover 120 of 169 tools: for a tool where two differently worded runs disagreed, that item is left out. They were not checked by hand, and no tool was called. “Easy to mix up” means two tools whose names or descriptions overlap without saying how they differ; the AI found none, comparing tools within groups of 40. We do not rate whether the tool set is complete or whether side effects are spelled out, because our AI reading of those was not reliable enough.

How do I add it to my client?

Config from the registry entry

From the remote endpoint (Streamable HTTP)

We connected to this URL on 2026-10-23 (a read-only session: no tool was called).

Add to CursorAn install link in the format Cursor documents, holding the Cursor config below.

Claude Desktop or claude.ai
Settings → Connectors → Add custom connector, then paste:
https://handoff.lol/mcp
Cursor · .cursor/mcp.json in a project, or ~/.cursor/mcp.json
{
  "mcpServers": {
    "handoff": {
      "url": "https://handoff.lol/mcp"
    }
  }
}
VS Code · .vscode/mcp.json
{
  "servers": {
    "handoff": {
      "type": "http",
      "url": "https://handoff.lol/mcp"
    }
  }
}
VS Code (command line) · Bash or zsh terminal (macOS, Linux)
code --add-mcp '{"name":"handoff","type":"http","url":"https://handoff.lol/mcp"}'
Claude Code
claude mcp add --transport http handoff https://handoff.lol/mcp
Try it in the MCP Inspector · runs on your machine, opens in your browser · Node 22.19+
npx @modelcontextprotocol/inspector@2.11.0 --server-url https://handoff.lol/mcp --transport http
  • The server runs on the operator's infrastructure; it may ask you to sign in when you first connect.
  • The MCP Inspector lists the server's tools, resources and prompts; a tool you call there runs for real.

Built from the server's registry entry with each client's documented format (checked 2026-10-14; the Cursor link and the VS Code command 2026-10-19; the MCP Inspector command 2026-10-21). Values in < > are yours to fill in; this page never contains a key. Where the server needs a setting the entry does not declare, it can still fail to start.

Does the registry listing match what we found?

Feature #6

The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.

Registry saysWe foundResultSource · date
Remote endpoint handoff.lol/mcpSession openedmatchesour test · 2026-10-23
No credential declared as requiredOpened a session without any credentialmatchesour test · 2026-10-23

Choosing

Record checks

Public records · not a safety rating

1 of 2 record checks met · 7 do not apply

  • Not ranked by downloads: a remote server publishes no download figure
  • Not ranked by stars: no public GitHub repository
  • MetRegistry entry is active and says how to run itActive, with a package or a remote address.
  • Not metSource repository link opensThe registry entry gives no repository link.
  • Does not applyRepository is not archivedNo public GitHub repository to read.
  • Does not applyCode pushed to the repository in the 90 days before our checkNo public GitHub repository to read.
  • Does not applyRepository publishes a security policy (SECURITY.md)No public GitHub repository to read.
  • Does not applyPackage names its licence with a standard (SPDX) identifierRemote server: it ships no package.
  • Does not applyThe version the registry lists can be installed and is not withdrawnRemote server: it ships no package.
  • Does not applynpm package carries build provenance (attestation)Remote server: it ships no package.
  • Does not applyNo known critical or high advisory in the package or its dependenciesRemote server: it ships no package.

Read from public records only: the registry entry, npm/PyPI, GitHub and advisory databases, checked 2026-10-22. No tool was called. Only “met” and “not met” are counted, so the total differs between servers; a check that does not apply or that we could not run is listed, never counted against it. It is not a safety rating. How each check works · Leaderboards

Common questions about io.github.34r7h/handoff

Answered from the data above

Is io.github.34r7h/handoff safe to install?

We do not rate servers as safe or unsafe. 1 of its 2 applicable record checks are met (facts from public records, each listed on this page). What the records show: 73 of its tools describe changing data (our AI model's reading of the descriptions). These are facts with their sources on this page, not a safety guarantee, and we did not run its tools.

Does io.github.34r7h/handoff need an API key or sign-in?

It opened a session without any credential on 2026-10-23. The registry entry declares no required credential; no declaration is not a guarantee.

Has io.github.34r7h/handoff been security tested?

Partly. 4 of the 15 checks that apply to it were exercised. It accepted a session without any credential and lists tools whose names suggest they change data. We did not call them. No security verdict is published before verification.

What can io.github.34r7h/handoff do?

It lists 169 tools. In our AI model's reading of their descriptions (two runs had to agree, nobody checked it by hand), they include tools that read or search, create or change data, delete, send messages, run code or commands and move money. We did not call any tool, so this describes the text, not the behaviour.

Can io.github.34r7h/handoff change or delete data?

73 of its tools say in their description that they create, edit, delete, send or run something (our AI model's reading). We did not call any tool, so we cannot say what actually happens.

Found this page useful?

Anonymous · no sign-in

A quick, anonymous reaction — no account, no email. One per kind from your browser. The tally updates when the page is next refreshed, and it is only a rough count, never a safety rating or a measured number of people.

Similar servers

Same topic · AI-read

Active servers whose topic is also “productivity-and-docs” and that have at least one tool of the same kind; most kinds in common first, then most GitHub stars. The topic and the tool kinds are an AI model's reading of the publishers' descriptions, not checked by hand. Similar is not a recommendation.

Compare with another server

Side by side: registry entry, our read-only session, the tools and the 18 classification fields. Same values as each page; no score.

Security testing

What did we test, and what did we leave out?

18 checks · features #1, #2

Open without sign-in

It accepted a session without any credential and lists tools whose names suggest they change data. We did not call them. No security score is given; a check we did not run is never counted as passed.

The 18 checks at a glanceour test · 2026-10-23
  1. Inventory: exercised
  2. Hidden instructions: exercised
  3. Real execution: not run · our policy
  4. Secret leak: not run · nothing to check it against
  5. Internal addresses: not run · our policy
  6. Unconfirmed changes: not run · our policy
  7. Bad input: not run · our policy
  8. Model requests: not run · nothing to check it against
  9. Sensitive questions: not run · nothing to check it against
  10. Folder boundary: not run · our policy
  11. Log leaks: not run · nothing to check it against
  12. Hidden content: exercised
  13. Fake assistant turns: not applicable
  14. Token passthrough: not applicable
  15. Token audience: not applicable
  16. Sign-in redirect: not run · our policy
  17. Consent handling: not testable from outside
  18. Sign-in metadata: exercised

4 exercised11 not run (reason given)3 not applicable

Each check ends in exactly one state: exercised, not run (with the reason), or not applicable (with the reason). 4 of the 15 checks that apply to it were exercised. We do not publish security-check outcomes for named servers.

Exercised · 4
  • 1Inventory
    tool-list    Reads the declared tools, resources and prompts.exercised
  • 2Hidden instructions
    description-poisoning    Looks for hidden instructions in tool descriptions.exercised
  • 12Hidden content
    audience-hiding    Checks resources that hide content from the user.exercised
  • 18Sign-in metadata
    oauth-url-scheme    Checks the published sign-in metadata for unsafe URLs.exercised
Not run, with the reason · 11
  • 3Real execution
    real-execution    Calls a tool and checks what really happens.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
  • 4Secret leak
    canary-leak    Plants a fake secret and checks whether it leaks.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
  • 5Internal addresses
    ssrf    Checks whether a tool can be steered to internal addresses.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
  • 6Unconfirmed changes
    write-without-confirmation    Checks whether tools that change data act without asking.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
  • 7Bad input
    error-handling    Sends bad input and watches how the server answers.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
  • 8Model requests
    sampling    Checks whether the server asks the client's model to act for it.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
  • 9Sensitive questions
    elicitation-sensitive-data    Checks whether the server asks users for sensitive data.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
  • 10Folder boundary
    root-boundary    Checks whether the server reaches outside the folders it was given.This check calls the server's tools. ProtocolProbe calls no server's tools for anything it publishes; an operator can run this check on their own server with our self-test command.not run · our policy
  • 11Log leaks
    logging-side-channel    Checks whether log messages carry data they should not.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
  • 16Sign-in redirect
    open-redirect    Checks the sign-in redirect for abuse.Testing the sign-in redirect means sending probes to the operator's sign-in service, which we do not do.not run · our policy
  • 17Consent handling
    confused-deputy    Checks consent handling when one service acts for another.Depends on the operator's own consent screen, which differs per server and cannot be tested from outside.not testable from outside
Does not apply to this server · 3
  • 13Fake assistant turns
    fake-assistant-turn    Checks prompts that pose as the assistant's own words.The server exposes no prompts.not applicable
  • 14Token passthrough
    token-passthrough    Checks whether the server forwards a user's token to other services.The server opened a session without sign-in, so there is no token flow to check.not applicable
  • 15Token audience
    token-audience-validation    Checks whether tokens meant for another service are accepted.The server opened a session without sign-in, so there is no token flow to check.not applicable

Source: our own test, 2026-10-23, mcp-runtime-engine@0.1.0. Which checks count and why follows our published scoring model.

What happened during the test?

Feature #8

The steps in order, as the test record holds them.

  1. 0 msStarted a read-only session with the server's remote endpoint
  2. 2,516 msConnected after 0 redirects. No credential was sent or needed.
  3. Read the inventory: 169 tools, 5 resources, 0 prompts.
  4. 8,928 msFinished: 4 checks exercised.

Reference

How is it classified?

18 fields

One value per field, each with its source. Fields written by AI models are marked. A field with no value says why.

TopicAI-classified
productivity-and-docs
AI-classified · 2026-10-23
Pricing modelAI-classified
not known (our limit)
The website shows almost no text without JavaScript, and we did not re-read it in a browser. This is our limit.
Programming language
does not apply
no existing GitHub repository (server declares no repository link, so there is nothing to fetch)
Hosting type
remote (hosted by the publisher)
registry · 2026-10-23
MCP capability
resources, tools
our test · 2026-10-23
Transport
streamable HTTP
registry · 2026-10-23
Required credentials
none declared
registry · no declaration is not a guarantee
Package registry
does not apply
remote-only server: no package is shipped, so there is no package registry
Freshness
0–30 days
registry updatedAt · 2026-10-23
Lifecycle status
active
registry · 2026-10-23
License class
does not apply
remote-only server: ships no package, so there is nothing to look up in a package registry
Integrity hash
does not apply
remote-only server: ships no package, so there is nothing to look up in a package registry
Signature / provenance
does not apply
remote-only server: ships no package, so there is nothing to look up in a package registry
Dependency advisories
does not apply
ships no package, so there are no dependencies to audit
Popularity
does not apply
remote-only server: ships no package, so there is nothing to look up in a package registry
Publisher signals
not stated
no readable GitHub owner to describe
Maintenance
does not apply
server declares no repository link, so there is nothing to fetch
Environment
the publisher's infrastructure
where it runs, from the hosting type

“Not stated” means the source did not state it; “does not apply” means it does not apply to this kind of server; “our limit” means our own lookup failed. A linked value opens the directory filtered to the same value.

Cite or correct this page

Sources and corrections

Suggested citation

ProtocolProbe. “io.github.34r7h/handoff: MCP server record.” Data checked 2026-10-23. https://protocolprobe.com/mcp/servers/io.github.34r7h/handoff

Figures are valid for the date shown. Our facts on this page are CC BY 4.0: reuse them with a link and the check date. Quoted text (the publisher’s descriptions, website quotes, tool names) is not ours to license.

As JSON: this record in the API · API documentation.

Badge for your README

ProtocolProbe: 1 of 2 record checks met

[![ProtocolProbe](https://protocolprobe.com/api/v1/badge/io.github.34r7h/handoff)](https://protocolprobe.com/mcp/servers/io.github.34r7h/handoff)

It shows this server's record-check count: facts from public records, no tool called. It is not a security rating or a pass. It links here and updates after each data reload.

Something wrong, or is this yours?

If a fact here is wrong, tell us and we will re-check it. If you operate this server, you can run our checks on it yourself with the free self-test command; we call no server’s tools ourselves for anything shown here.

Write to hello@protocolprobe.com · corrections log · methodology