CTFd MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| BASE_URL | Yes | The base URL of the CTFd instance (e.g., https://demo.ctfd.io). | |
| CTFD_TOKEN | No | Authentication token for CTFd. | |
| CTFD_COOKIE | No | Session cookie for CTFd. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| set_base_urlB | Configure the CTFd instance this server talks to. Args: url: absolute http(s) URL of the CTFd instance, e.g. https://ctf.example.com |
| set_tokenB | Use an API token for authentication (stored in memory only, never logged). Args: token: CTFd API access token. |
| set_cookieB | Use a session cookie for authentication (memory only, never logged). Args: cookie: full session cookie value, e.g. "session=abc..." or "name=..; session=..". |
| loginB | Log in to CTFd with a username and password (kept in memory only). Creates a session cookie; the password is never returned. Args: username: CTFd account name. password: CTFd account password. |
| challengesA | List challenges with optional filters and pagination. Args: category: filter by challenge category (exact match). search: case-insensitive substring match on challenge name. solved: only show solved (True) or unsolved (False) challenges. page: page number (1-based) when no filters are applied. per_page: number of challenges per page (1-100). |
| challengeB | Get the full detail of a single challenge by numeric id or name. Includes description, category, value, files, hints and connection info. Args: identifier: challenge id (e.g. "3") or challenge name. |
| submit_flagA | Submit a flag for a challenge. Safety: requires confirm=True. Provide exactly one of challenge_id or challenge_name. The flag value is never logged. Args: flag: the flag to submit. challenge_name: name of the challenge to submit against. challenge_id: numeric id of the challenge to submit against. confirm: must be set to True as an explicit submission opt-in. |
| download_fileA | Download a challenge attachment to the local machine. Challenge detail ( Args: file_url: absolute http(s) URL or site-relative path to the file. dest_dir: optional local directory to store the file in (default: CTFD_DOWNLOAD_DIR or ./downloads). |
| unlock_hintA | Unlock a challenge hint and return its content. WARNING: on CTFd a hint with a non-zero Args:
hint_id: numeric id of the hint (see the |
| scoreboardA | Return the public CTFd scoreboard (top standings). |
| progressA | Return the authenticated user's progress (score and solved challenges). |
| instance_infoA | Return safe, public metadata about the configured CTFd instance. No secrets are included. |
| auth_statusA | Report whether the current session is authenticated and which auth mode is active. Reveals no tokens/cookies/passwords. |
| healthA | Perform a health check: CTFd reachability, API status and authentication state. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 14 tools
Most tools have clearly distinct purposes, but the authentication group (set_token, set_cookie, login, auth_status) plus health overlap around session/state checking, and challenge vs challenges differ only by singular/plural which can cause misselection. Descriptions do help disambiguate the intended usage.
A mix of conventions: verb_noun tools (set_token, submit_flag, download_file, unlock_hint) coexist with bare-noun tools (challenges, challenge, scoreboard, progress, instance_info, health). Each name is readable in isolation, but there is no single predictable pattern.
14 tools is well within a healthy range and each earns its place, covering setup, auth, challenge interaction, and status without bloat.
For a player-facing CTFd client the surface is strong: auth, listing/reading challenges, flag submission, file download, hint unlock, scoreboard, and progress. Minor gaps remain (e.g. category listing, team/teammate endpoints), but core workflows have no dead ends.