request_handoff · Agent-Comm-Hub MCP: Risk & Policy

WHAT IT DOES

What request_handoff does on Agent-Comm-Hub

AI agents use request_handoff to create or update resources in Agent-Comm-Hub — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Agent-Comm-Hub environment.

WHY IT NEEDS A POLICY

Why request_handoff needs a policy

This tool initiates a task handoff by transferring task ownership to another agent. It creates/modifies a task assignment record and triggers a workflow requiring the target agent to accept or reject. This is a reversible write operation (the handoff can be rejected), not destructive or financial. Severity is medium because misuse could disrupt task ownership and agent workflows.

From the tool's definition 请求任务交接。将任务转交给另一个 Agent。目标 Agent 需要调用 accept_handoff 或 reject_handoff。只有负责人或创建者可以发起交接。

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

request_handoff Rate-limited

request_handoff stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "request_handoff": {
      "limits": [
        {
          "counter": "request_handoff_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Agent-Comm-Hub, so you can run agents against it safely.

FAQ

Questions about request_handoff

What does the request_handoff tool do? +

请求任务交接。将任务转交给另一个 Agent。目标 Agent 需要调用 accept_handoff 或 reject_handoff。只有负责人或创建者可以发起交接。. It is categorised as a Write tool in the Agent-Comm-Hub MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on request_handoff? +

Register the Agent-Comm-Hub MCP server in PolicyLayer and add a rule for request_handoff: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Agent-Comm-Hub. Nothing to install.

What risk level is request_handoff? +

request_handoff is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit request_handoff? +

Yes. Add a rate_limit block to the request_handoff rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block request_handoff completely? +

Set action: deny in the PolicyLayer policy for request_handoff. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides request_handoff? +

request_handoff is provided by the Agent-Comm-Hub MCP server (liuboacean/agent-comm-hub). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.