htb-app-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| API_TOKEN | No | Supported alias for compatibility | |
| HTB_TOKEN | No | Supported alias | |
| HTB_TIMEOUT | No | HTTP timeout to HTB in seconds | 30 |
| HTB_MCP_HOST | No | HTTP bind address | 127.0.0.1 |
| HTB_MCP_PATH | No | MCP HTTP path | /mcp |
| HTB_MCP_PORT | No | HTTP port | 8000 |
| HTB_API_TOKEN | No | HTB token for stdio or HTTP fallback | |
| HTB_LOAD_DOTENV | No | Set to 0 to disable .env loading | 1 |
| HTB_API_BASE_URL | No | Override base API URL | https://labs.hackthebox.com/api/v4 |
| HTB_DOWNLOAD_DIR | No | Download directory | downloads |
| HTB_MCP_LOG_LEVEL | No | Server log level | INFO |
| HTB_MCP_TRANSPORT | No | Transport: stdio, http, streamable-http | stdio |
| HTB_MCP_VERBOSE_HTTP | No | Set to 1 to re-enable verbose HTTPX logging | 0 |
| HTB_MCP_JSON_RESPONSE | No | Return JSON responses where supported | 0 |
| HTB_MCP_STATELESS_HTTP | No | HTTP stateless by default | 1 |
| HTB_DOWNLOAD_MIN_INTERVAL | No | Minimum seconds between ZIP downloads | 1.0 |
| HTB_MCP_GRACEFUL_SHUTDOWN_TIMEOUT | No | Graceful shutdown timeout in seconds | 5 |
| HTB_MCP_WINDOWS_SELECTOR_EVENT_LOOP | No | Use selector event loop on Windows | 1 |
Capabilities
Features and capabilities supported by this server
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| htb_whoamiA | Validate the API token and return the authenticated HTB account profile. |
| htb_user_profileB | Return public profile details for an HTB user id. |
| htb_connection_statusB | Return active HTB VPN/lab connections for the authenticated account. |
| htb_vpn_serversA | List VPN servers for product: labs, starting_point, fortresses, or competitive. |
| htb_switch_vpn_serverA | Switch the assigned HTB VPN server to a server id returned by htb_vpn_servers. |
| htb_download_ovpnC | Download an OpenVPN profile for a VPN server id. protocol must be udp or tcp. |
| htb_searchB | Search HTB content. target_type can be all, machines, challenges, users, or teams. |
| htb_list_machinesC | List machines with optional filters. difficulty/state accept comma-separated values. |
| htb_machine_infoB | Return details for a machine by id or slug/name. |
| htb_active_machineA | Return the currently active spawned machine, if one exists. |
| htb_recommended_machinesB | Return HTB recommended machine cards. |
| htb_active_virtual_machineB | Return the active machine or Sherlock VM, if one exists. |
| htb_machine_tasksC | Return task/adventure questions for a machine when available. |
| htb_spawn_machineC | Spawn a machine or Starting Point VM by id. |
| htb_stop_machineC | Terminate a spawned machine or Starting Point VM by id. |
| htb_extend_machineB | Extend the running time for a spawned machine VM by id. |
| htb_reset_machineC | Reset a machine VM. mode: request, vote, or accept_vote. |
| htb_submit_machine_flagC | Submit a user/root machine flag for a machine id. |
| htb_list_challengesC | List challenges. difficulty/status accept friendly aliases; category accepts comma-separated ids. |
| htb_challenge_infoC | Return challenge details by id or slug/name. |
| htb_challenge_categoriesB | List challenge categories and ids useful for filtering. |
| htb_download_challengeB | Download a challenge ZIP by id and optionally extract it under the download directory. |
| htb_start_challengeB | Start a challenge container by challenge id when the challenge supports containers. |
| htb_stop_challengeB | Stop a challenge container by challenge id. |
| htb_start_containerC | Start a container by container id for HTB content that exposes one. |
| htb_stop_containerC | Stop a container by container id for HTB content that exposes one. |
| htb_submit_challenge_flagD | Submit a challenge flag. |
| htb_list_sherlocksC | List Sherlocks with optional filters. category accepts comma-separated ids. |
| htb_sherlock_infoB | Return Sherlock details by id or slug/name. |
| htb_sherlock_tasksB | Return tasks/questions for a Sherlock id. |
| htb_sherlock_progressB | Return progress for a Sherlock id. |
| htb_sherlock_playC | Return Sherlock play metadata and current VM/container state. |
| htb_start_sherlock_vmC | Start a Sherlock VM play instance by Sherlock id. |
| htb_stop_sherlock_vmC | Stop a Sherlock VM play instance by Sherlock id. |
| htb_reset_sherlock_vmC | Reset a Sherlock VM play instance by Sherlock id. |
| htb_download_sherlockC | Download a Sherlock ZIP by id and optionally extract it under the download directory. |
| htb_submit_sherlock_task_flagB | Submit the flag/answer for a Sherlock task id. |
| htb_list_fortressesB | List HTB fortresses. |
| htb_fortress_infoC | Return details for a fortress id. |
| htb_fortress_flagsB | List flag metadata for a fortress id. |
| htb_submit_fortress_flagD | Submit a fortress flag. |
| htb_reset_fortressC | Vote to reset a fortress instance. |
| htb_list_seasonsA | List HTB seasonal machine seasons and their active/ended state. |
| htb_active_season_machineB | Return the currently active seasonal machine card. |
| htb_season_machinesA | List machines for a season id returned by htb_list_seasons. |
| htb_season_rewardsB | List rewards and rank progression data for a season id. |
| htb_season_user_rankB | Return the authenticated user's rank/progress for a season id. |
| htb_season_user_ranksB | Return all seasonal ranks for a specific HTB user id. |
| htb_season_leaderboardC | Return a seasonal leaderboard. leaderboard must be players or teams. |
| htb_season_top_leaderboardC | Return top seasonal leaderboard entries. period: 1Y, 6M, 3M, 1M, or 1W. |
| htb_starting_point_progressA | Return Starting Point tier progress for the authenticated account. |
| htb_starting_point_tierA | Return metadata for a Starting Point tier id. HTB removed the per-tier machine listing endpoint, so only tier metadata (name, description, completion) is returned. Use htb_search or htb_list_machines + htb_machine_info for Starting Point machine details. |
| htb_submit_machine_taskA | Submit the text answer/flag for a Starting Point machine task. Use htb_machine_tasks to list available tasks and their ids for a machine. Returns 'Task flag owned!' on success. |
| htb_list_prolabsA | List all HTB Pro Labs with id, name, version, and subscription state. |
| htb_prolab_overviewB | Return detailed overview for a Pro Lab id (machines count, flags count, social links). |
| htb_prolab_machinesC | List machines in a Pro Lab by id. |
| htb_prolab_flagsC | List flags for a Pro Lab by id. |
| htb_submit_prolab_flagC | Submit a flag for a Pro Lab by id. |
| htb_api_getA | Call a read-only HTB API path for endpoint discovery. Example path: /machine/recommended. Defaults to API v4. Prefix the path with /api/vN (e.g. /api/v5/...) to target another version. |
| htb_api_postA | Call a write HTB API path for endpoint discovery or ad-hoc mutations. Defaults to API v4. Prefix the path with /api/vN to target another version. Example: path=/api/v5/machine/own body_json={"id":395,"flag":"abc"} |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| htb_target_workflow | Create a concise workflow prompt for working on HTB content through this MCP. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| service_map | Read the HTB API surface used by this MCP server. |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/AeonDave/htb-app-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server