handoff-mcp-server
Durable handoffs and shared scratchpad for multi-agent workflows over MCP (HTTP transport).
Endpoints
GET /basic service infoGET /healthhealth and storage statsPOST /mcpJSON-RPC MCP endpointGET /robots.txtdiscovery fileGET /llms.txtdiscovery fileGET /sitemap.xmldiscovery file
Environment Variables
PORTdefault3000DATA_DIRdefault/dataMCP_API_KEYrequired in production (NODE_ENV=production)PUBLIC_MCP_DISCOVERYdefaulttruePUBLIC_BASE_URLoptional, used for absolute links in discovery files
Local Run
npm ci
npm run build
MCP_API_KEY=test-secret node dist/index.js
MCP Auth Behavior
- Discovery methods (
initialize,tools/list,resources/list,prompts/list,ping) can be public whenPUBLIC_MCP_DISCOVERY=true. tools/callrequires valid upstream auth whenMCP_API_KEYis set:Authorization: Bearer <MCP_API_KEY>orx-api-key: <MCP_API_KEY>
Xpay + Railway Configuration (Required)
- Railway variables:
MCP_API_KEY=<your-strong-key>PUBLIC_MCP_DISCOVERY=truePUBLIC_BASE_URL=https://handoff-mcp-server-production.up.railway.app
- Xpay MCP URL:
- Use
https://handoff-mcp-server-production.mcp.xpay.sh/mcp?key=xpay_sk_... - Without
?key=..., Xpay returns auth required and requests will not forward.
- Client calls through Xpay:
- Keep the Xpay key in URL.
- Also send upstream auth header for
tools/call(x-api-keyor Bearer token matchingMCP_API_KEY).
Publishing
MCP Registry
- Server name:
io.github.josephibra/handoff-mcp-server - Primary remote: Xpay URL (with key at client usage time, not committed)
- Secondary remote: Railway URL
Smithery
- Namespace:
josephibrahim - Server ID:
handoff-mcp-server - MCP Server URL:
https://handoff-mcp-server-production.mcp.xpay.sh/mcp?key=xpay_sk_...
Agentverse
- Create a new agent and attach MCP server:
- URL:
https://handoff-mcp-server-production.mcp.xpay.sh/mcp?key=xpay_sk_... - Headers:
x-api-key: <MCP_API_KEY>for tool execution paths
- URL:
Recommended Extra Discovery Listings
- PulseMCP directory
- mcp.so
- OpenTools catalog
- MCPmarket / mcpservers.org
Use the same canonical MCP URL and matching auth notes everywhere to avoid inconsistent behavior.