ctfd-mcp
About
MCP server for CTFd that lets regular users browse challenges, manage dynamic instances, and submit flags.
Details
- Author
- umbra2728
- Categories
- Developer Tools, Security, Other
Jump to
Setup
Install ctfd-mcp in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/umbra2728/ctfd-mcp
Follow the installation instructions in the repository README, then restart your MCP client.
MCP server that lets a regular CTFd user list challenges, read details, start/stop dynamic docker instances, and submit flags.
You can store them in a.envfile in the repo root:
CTFD_URL=https://ctfd.example.com/ CTFD_USERNAME=your_username CTFD_PASSWORD=your_password # or, if you prefer to use a token: # CTFD_TOKEN=your_ctfd_api_token_here # or, if tokens are disabled: # CTFD_SESSION=your_session_token_here # and, if the owl plugin enforces CSRF: # CTFD_CSRF_TOKEN=your_csrf_token_here
- From PyPI (recommended):uvx ctfd-mcp --help
- From source checkout (no install):uvx --from . ctfd-mcp --help
# installed from PyPI uvx ctfd-mcp # from local checkout uvx --from . ctfd-mcp
{ "mcpServers": { "ctfd-mcp": { "command": "uvx", "args": ["ctfd-mcp"], "env": { "CTFD_URL": "https://ctfd.example.com", "CTFD_TOKEN": "your_user_token" } } } }
[mcp_servers.ctfd-mcp] command = "uvx" args = ["ctfd-mcp"] [mcp_servers.ctfd-mcp.env] CTFD_URL = "https://ctfd.example.com" CTFD_TOKEN = "your_user_token"
- list_challenges(category?, only_unsolved?)— list visible challenges, optional category/unsolved filter.
- challenge_details(challenge_id)— description (HTML +description_text), metadata, attachment URLs, solved status.
- submit_flag(challenge_id, flag)— attempt a flag; returns status/message.
- start_container(challenge_id)— unified start; auto-detects dynamic_docker, ctfd-owl or k8s/api/v1/k8s.
- stop_container(container_id?, challenge_id?)— unified stop; whale can be stopped with justcontainer_id, owl/k8s needchallenge_id.
Attachments are returned as absolute URLs infiles; the client/host can fetch them directly.
- resource://ctfd/challenges/{challenge_id}— markdown snapshot of a challenge (metadata, description, attachment URLs, connection info if present).
If something breaks or you have questions, reach out:
- Telegram: @ismailgaleev
- Jabber:ismailgaleev@chat.merlok.ru
- Email:umbra2728@gmail.com
- Runuv run pytest.
- Timeouts are configurable via env:CTFD_TIMEOUT(total),CTFD_CONNECT_TIMEOUT,CTFD_READ_TIMEOUT(seconds). Defaults are 20s total / 10s connect / 15s read.
- Dev dependencies:uv sync --group dev
- Lint/format:uv run ruff check .anduv run ruff format .
- Tests:uv run pytest
- Pre-commit:uv run pre-commit install(seeCONTRIBUTING.md)
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.
Model Context Protocol Servers Repository for OpenZeppelin Products
Enable AI agents to secure code with Semgrep.
Model Context Protocol server for Skycloak managed Keycloak. Manage clusters, realms, applications, SSO and users from any MCP client.
Dependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.
Security scanner for MCP servers and AI agent tooling. Detects prompt injection, command injection, auth bypass, and excessive permissions.
Remote MCP server (Streamable HTTP) at https://mcp.agenticrail.nz/ — deterministic step-order enforcement for AI agents. evaluate_step returns ALLOW or DENY before a step runs; verify_receipt proves a sequence's Ed25519-signed, hash-chained receipt chain is intact. No auth required: omit the bearer token and calls run on the public demo key. That first clause matters — the form has no "remote/hosted" field, and putting the endpoint in the description is the convention on that list ("Fully REMOTE! Just use…"). The rest mirrors your own server card verbatim, so the listing and the card can't drift.
An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.
Deterministic security preflight for AI agents. Check URLs, files and shell commands before acting.
AI-powered code quality analysis to detect best practice violations, security issues, and architectural problems in real-time.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
