htb-app-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| API_TOKEN | No | Supported alias for compatibility | |
| HTB_TOKEN | No | Supported alias | |
| HTB_TIMEOUT | No | HTTP timeout to HTB in seconds | 30 |
| HTB_MCP_HOST | No | HTTP bind address | 127.0.0.1 |
| HTB_MCP_PATH | No | MCP HTTP path | /mcp |
| HTB_MCP_PORT | No | HTTP port | 8000 |
| HTB_API_TOKEN | No | HTB token for stdio or HTTP fallback | |
| HTB_LOAD_DOTENV | No | Set to 0 to disable .env loading | 1 |
| HTB_API_BASE_URL | No | Override base API URL | https://labs.hackthebox.com/api/v4 |
| HTB_DOWNLOAD_DIR | No | Download directory | downloads |
| HTB_MCP_LOG_LEVEL | No | Server log level | INFO |
| HTB_MCP_TRANSPORT | No | Transport: stdio, http, streamable-http | stdio |
| HTB_MCP_VERBOSE_HTTP | No | Set to 1 to re-enable verbose HTTPX logging | 0 |
| HTB_MCP_JSON_RESPONSE | No | Return JSON responses where supported | 0 |
| HTB_MCP_STATELESS_HTTP | No | HTTP stateless by default | 1 |
| HTB_DOWNLOAD_MIN_INTERVAL | No | Minimum seconds between ZIP downloads | 1.0 |
| HTB_MCP_GRACEFUL_SHUTDOWN_TIMEOUT | No | Graceful shutdown timeout in seconds | 5 |
| HTB_MCP_WINDOWS_SELECTOR_EVENT_LOOP | No | Use selector event loop on Windows | 1 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| htb_whoamiA | Validate the API token and return the authenticated HTB account profile. |
| htb_user_profileB | Return public profile details for an HTB user id. |
| htb_connection_statusB | Return active HTB VPN/lab connections for the authenticated account. |
| htb_vpn_serversA | List VPN servers for product: labs, starting_point, fortresses, or competitive. |
| htb_switch_vpn_serverA | Switch the assigned HTB VPN server to a server id returned by htb_vpn_servers. |
| htb_download_ovpnC | Download an OpenVPN profile for a VPN server id. protocol must be udp or tcp. |
| htb_searchB | Search HTB content. target_type can be all, machines, challenges, users, or teams. |
| htb_list_machinesC | List machines with optional filters. difficulty/state accept comma-separated values. |
| htb_machine_infoB | Return details for a machine by id or slug/name. |
| htb_active_machineA | Return the currently active spawned machine, if one exists. |
| htb_recommended_machinesB | Return HTB recommended machine cards. |
| htb_active_virtual_machineB | Return the active machine or Sherlock VM, if one exists. |
| htb_machine_tasksC | Return task/adventure questions for a machine when available. |
| htb_spawn_machineC | Spawn a machine or Starting Point VM by id. |
| htb_stop_machineC | Terminate a spawned machine or Starting Point VM by id. |
| htb_extend_machineB | Extend the running time for a spawned machine VM by id. |
| htb_reset_machineC | Reset a machine VM. mode: request, vote, or accept_vote. |
| htb_submit_machine_flagC | Submit a user/root machine flag for a machine id. |
| htb_list_challengesC | List challenges. difficulty/status accept friendly aliases; category accepts comma-separated ids. |
| htb_challenge_infoC | Return challenge details by id or slug/name. |
| htb_challenge_categoriesB | List challenge categories and ids useful for filtering. |
| htb_download_challengeB | Download a challenge ZIP by id and optionally extract it under the download directory. |
| htb_start_challengeB | Start a challenge container by challenge id when the challenge supports containers. |
| htb_stop_challengeB | Stop a challenge container by challenge id. |
| htb_start_containerC | Start a container by container id for HTB content that exposes one. |
| htb_stop_containerC | Stop a container by container id for HTB content that exposes one. |
| htb_submit_challenge_flagD | Submit a challenge flag. |
| htb_list_sherlocksC | List Sherlocks with optional filters. category accepts comma-separated ids. |
| htb_sherlock_infoB | Return Sherlock details by id or slug/name. |
| htb_sherlock_tasksB | Return tasks/questions for a Sherlock id. |
| htb_sherlock_progressB | Return progress for a Sherlock id. |
| htb_sherlock_playC | Return Sherlock play metadata and current VM/container state. |
| htb_start_sherlock_vmC | Start a Sherlock VM play instance by Sherlock id. |
| htb_stop_sherlock_vmC | Stop a Sherlock VM play instance by Sherlock id. |
| htb_reset_sherlock_vmC | Reset a Sherlock VM play instance by Sherlock id. |
| htb_download_sherlockC | Download a Sherlock ZIP by id and optionally extract it under the download directory. |
| htb_submit_sherlock_task_flagB | Submit the flag/answer for a Sherlock task id. |
| htb_list_fortressesB | List HTB fortresses. |
| htb_fortress_infoC | Return details for a fortress id. |
| htb_fortress_flagsB | List flag metadata for a fortress id. |
| htb_submit_fortress_flagD | Submit a fortress flag. |
| htb_reset_fortressC | Vote to reset a fortress instance. |
| htb_list_seasonsA | List HTB seasonal machine seasons and their active/ended state. |
| htb_active_season_machineB | Return the currently active seasonal machine card. |
| htb_season_machinesA | List machines for a season id returned by htb_list_seasons. |
| htb_season_rewardsB | List rewards and rank progression data for a season id. |
| htb_season_user_rankB | Return the authenticated user's rank/progress for a season id. |
| htb_season_user_ranksB | Return all seasonal ranks for a specific HTB user id. |
| htb_season_leaderboardC | Return a seasonal leaderboard. leaderboard must be players or teams. |
| htb_season_top_leaderboardC | Return top seasonal leaderboard entries. period: 1Y, 6M, 3M, 1M, or 1W. |
| htb_starting_point_progressA | Return Starting Point tier progress for the authenticated account. |
| htb_starting_point_tierA | Return metadata for a Starting Point tier id. HTB removed the per-tier machine listing endpoint, so only tier metadata (name, description, completion) is returned. Use htb_search or htb_list_machines + htb_machine_info for Starting Point machine details. |
| htb_submit_machine_taskA | Submit the text answer/flag for a Starting Point machine task. Use htb_machine_tasks to list available tasks and their ids for a machine. Returns 'Task flag owned!' on success. |
| htb_list_prolabsA | List all HTB Pro Labs with id, name, version, and subscription state. |
| htb_prolab_overviewB | Return detailed overview for a Pro Lab id (machines count, flags count, social links). |
| htb_prolab_machinesC | List machines in a Pro Lab by id. |
| htb_prolab_flagsC | List flags for a Pro Lab by id. |
| htb_submit_prolab_flagC | Submit a flag for a Pro Lab by id. |
| htb_api_getA | Call a read-only HTB API path for endpoint discovery. Example path: /machine/recommended. Defaults to API v4. Prefix the path with /api/vN (e.g. /api/v5/...) to target another version. |
| htb_api_postA | Call a write HTB API path for endpoint discovery or ad-hoc mutations. Defaults to API v4. Prefix the path with /api/vN to target another version. Example: path=/api/v5/machine/own body_json={"id":395,"flag":"abc"} |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| htb_target_workflow | Create a concise workflow prompt for working on HTB content through this MCP. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| service_map | Read the HTB API surface used by this MCP server. |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/AeonDave/htb-app-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server