HandoffProbe

It currently ships 22 stable attack cases, and the latest work has been less about adding more IDs and more about tightening one boundary I keep coming back to: does the original authorization still survive after an agent handoff or protocol translation?

A request can be perfectly valid structurally and still become broader by the time it reaches the downstream tool.

I’ve been turning those cases into deterministic A2A → MCP fixtures and discussing the boundary in a few current A2A/MCP threads. One of those conversations has already turned into a deeper discussion around context binding and the final authorization point before a downstream effect.

The next thing I care about most is real usage rather than adding more surface area: CI runs, concrete handoff cases, and feedback from people actually building agent-to-agent or agent-to-tool workflows.

If you’re working with A2A, MCP, or another agent handoff boundary, I’d genuinely be interested in the failure case you’re most worried about.

HandoffProbe v0.2.0 is now public.

This release deliberately focuses on product coherence rather than just adding more attacks.

The stable surface remains at 22 attacks, while the CLI, report schema and deterministic exit semantics stay unchanged. The npm package boundary is tighter, and newer A2A → MCP crossing-corpus work remains explicitly in research/conformance instead of quietly becoming part of the public CLI/API.

I also verified a clean external install and execution after publication.

Release:
https://github.com/Heaviside479/handoffprobe/releases/tag/v0.2.0

I’m especially interested in feedback on whether keeping the stable product surface separate from newer research tooling feels like the right boundary.

I’ve been thinking a lot about a security gap in AI systems:

An agent can look secure on its own.
A tool can look secure on its own.
A protocol can look secure on its own.

But when control passes from one component to another, important guarantees can quietly break.

That’s the problem I built HandoffProbe around.

HandoffProbe is a local-first open-source CLI for adversarial security testing of AI agent handoffs.

The goal is to make boundary failures reproducible and testable instead of hand-wavy.

The kinds of questions I care about are things like:

• does a handoff widen authority or permissions?

• does identity / tenant context survive the transition?

• can untrusted tool output get reinterpreted as instructions downstream?

• are approvals, constraints and audit lineage preserved across the handoff?

• can replay or malformed payloads trigger unexpected behavior?

The current version is early, but public and usable.

I wanted to start with a deterministic local tool rather than a hosted security layer, because I think developers need something they can run directly against their own agent workflows and CI.

Right now I’m especially interested in feedback on three things:

1. Which handoff failure mode worries you most in real agent systems?

2. Is local-first CLI the right starting point, or would you expect this problem to be solved somewhere else in the stack?

3. If you were evaluating a tool like this, what would make it immediately useful to you?

If anyone here is building agentic systems, security tooling, or protocol infrastructure, I’d love to hear how you think about this problem.