Disclosure: this article contains affiliate links. If you buy through them we may earn a commission at no additional cost to you. Our recommendations are based on the evidence recorded alongside this article, and prices were verified on the date shown.

What changed and why it matters

A Show HN post titled "Reproduce a cross-company AI agent handoff, including its revocation" was submitted by a user going by chuks. It points to one project: ratify-agent-relay-harness, with its source hosted at github.com/identities-ai/ratify-agent-relay-harness. If you came here searching for the best way to reproduce this specific demo, this repository is the only named match — there is no second implementation in the record to weigh it against.

The title itself tells you the scope of what's being reproduced: an AI agent's session, credentials, or task gets handed off from one company's system to another's, and the repo also demonstrates revoking that handoff after the fact. That second half is the part worth verifying yourself rather than taking on faith. A handoff mechanism that can't actually be revoked once granted isn't a security control — it's a liability wearing a security control's name.

What to look for

Before you clone anything or point a CI pipeline at it, work through these in order:

• Source you can read end to end. You should be able to open every file involved in the handoff and the revocation path, not just a README describing them. The source for this project sits at github.com/identities-ai/ratify-agent-relay-harness — go there first.
• Named provenance. Know who submitted it and where, so you have a way back to the origin if the repository moves or forks. This one was submitted to Show HN by chuks; that's the trail to follow if the link ever breaks.
• Scope match. A title naming both "handoff" and "revocation" tells you it claims to cover both halves of the problem. If you only need one half — say, the handoff mechanics without the revocation flow — confirm that split exists in the actual code rather than assuming the README's framing maps cleanly onto the file structure.
• Stated runtime requirements. Look for what the maintainer says the project needs to run, in the repository itself. Don't infer requirements from the project's category or from what similar tools usually need.
• Hosting cost, checked at the source. If your plan is to stand up a live instance rather than run it locally, get the hosting platform's current pricing and plan limits before you commit a workflow to it. A number you remember from six months ago, or from someone else's blog post, is not the number that applies to your account today.

Notice what's missing from that list: nothing here asks you to trust a star count, a launch-day upvote total, or a comment thread's vibe. None of those are in the sourced record for this project, and none of them tell you whether the revocation path actually revokes anything.

Recommended options

This is the only named option the evidence supports, so treat it as a single candidate to evaluate on its own merits rather than as the winner of a comparison that never happened.

ratify-agent-relay-harness

• Best for: engineers who want a concrete, inspectable implementation of a cross-company agent handoff and its revocation, to read line by line rather than take on faith from a written spec.
• Skip it if: you need a second, independently-built implementation to cross-check this one against. None is named in the sourced record, which means you're evaluating this repository against your own requirements, not against a competing approach.

If your goal is simply to understand how a handoff-plus-revocation flow can be structured, cloning this one repository and reading the revocation code path is the direct route — there's no shortlist to narrow down, because there's no second list.

Common mistakes

Treating a Show HN demo as production-ready. A Show HN post is a submission for feedback, not a certification. Read the code as a working example of an approach, not as something to point live traffic at unmodified.

Trusting the word "revocation" without reading the revocation path. The title promises revocation; verify what that means in the code before you rely on it. "Revocation" can mean anything from deleting a token to invalidating a whole session chain, and only the source tells you which.

Skipping the provenance check. Know that this came from a Show HN submission by chuks before you fork it into your own infrastructure. If you can't trace a piece of code back to who published it and where, you can't tell whether a later version is trustworthy either.

Assuming a free hosting tier will cover a multi-service demo like this without checking. Before you decide whether a free plan will carry the workload, [check Vercel's current pricing and plan limits directly](See current pricing at the merchant) rather than relying on a figure you saw somewhere else — plans and limits change, and the only way to know what applies to your account today is to look it up at the source.

Skipping the license check. Before you adapt any part of this repository into your own system, confirm what the repository's license actually permits. Don't assume public visibility on GitHub means unrestricted reuse.

The decision here isn't which of several products to buy — it's whether to trust one specific, sourced repository enough to build on it. Read ratify-agent-relay-harness's revocation path yourself before you rely on it, and price your hosting at the source before you deploy it.