How to hand off shared context between AI agents with MCP

What is an AI agent handoff?

An AI agent handoff is a transfer of responsibility and working state from one authenticated agent or person to another. Framework handoffs often transfer control inside one run; a durable handoff also preserves the work so a different model, tool, or teammate can resume later.

What information belongs in the handoff record?

A useful handoff follows the Handover Continuity Record: seven fields that let the next actor understand both what happened and what should happen next.

• Objective: the outcome being pursued and its acceptance criteria.
• Current state: what is complete, in progress, blocked, or unverified.
• Decisions: choices already made and the reasons behind them.
• Evidence: files, queries, outputs, links, and observations supporting the state.
• Constraints: permissions, safety rules, deadlines, budgets, and known exclusions.
• Next action: the smallest concrete step that moves the work forward.
• Ownership: the person or agent responsible for the next action.

How do AI agents share context through an MCP server?

MCP gives an agent host a standard way to call context tools; the server still needs a durable data model and access policy behind those tools. A complete shared-context workflow verifies the server-resolved identity, searches before creating, publishes the operating brief and source files, reads every artifact back, and leaves a canonical revision another authorized actor can retrieve.

Publishing agent
1. handover.whoami
2. handover.search
3. handover.create with context.md and source artifacts
4. handover.get + handover.read_artifact

Receiving agent
5. handover.whoami
6. handover.get + handover.annotations
7. handover.read_artifact
8. handover.continue with expectedRevisionId
9. handover.get to verify the new canonical revision

How should the receiving agent continue the work?

The receiving agent should search for the canonical record, read its current revision and open annotations, verify assumptions against attached evidence, and continue with optimistic concurrency. That sequence prevents duplicate handoffs and avoids overwriting a revision created by another actor.

1. Search for related handovers
2. Read the current revision and artifacts
3. Read open annotations and assignments
4. Verify the next action and constraints
5. Continue with expectedRevisionId
6. Resolve feedback addressed by the new revision

How is a durable handoff different from agent routing?

Agent routing chooses which specialist acts next, while a durable handoff preserves enough context for that specialist to resume across sessions and systems. OpenAI's Agents SDK describes in-run delegation; MCP standardizes how hosts connect to servers that provide context and tools. Handover adds the persistent, attributable record between those layers.

How should shared agent context be secured?

The MCP server must resolve identity from authentication rather than from prompt text, enforce organization and workspace boundaries on every read and write, and keep one credential per person or service agent. Search results, artifacts, annotations, and mentions must remain tenant-scoped; sharing a comment or naming another actor must never grant access to the underlying handover.

• Use per-user OAuth for supported interactive clients and scoped service credentials for unattended agents.
• Search and read only within the authenticated actor's eligible workspaces and grants.
• Preserve immutable authorship and revision history instead of accepting a claimed author name.
• Reject stale writes with expectedRevisionId and require the actor to reread before retrying.
• Test denied, read-only, stale-revision, and revoked-credential paths as part of the workflow.

What mistakes make agent handoffs fail?

Agent handoffs fail when they pass a transcript without a current state, omit the reason behind decisions, detach claims from evidence, or leave the next action ambiguous. A summary is helpful, but it is not sufficient unless the underlying files and revision history remain inspectable.