Skip to main content
Glama
ballz4z4

FlagForge MCP Server

by ballz4z4

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
FLAGFORGE_TOKENYesBearer token of the agent (created from admin → Agents). Must be an agent principal token (role: reader/solver/submitter/admin) or an admin bootstrap token. Permissions are enforced according to the token's role.
FLAGFORGE_BASE_URLYesThe base URL of the FlagForge web app. For example, http://localhost:3000

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": true
}

Tools

Functions exposed to the LLM to take actions

NameDescription
list_eventsA

List CTF events with challenge/solved counts

create_eventA

Create a new CTF event (requires admin role)

list_challengesC

List challenges in an event (by event id or slug)

get_challengeA

Get one challenge's summary: description, status, tags, flag status, lock owner

create_challengeA

Create (write) a new challenge in an event — for manual entry, mockups, or archiving self-made challenges

update_challengeC

Update an existing challenge's fields (title, description, points, tags...)

delete_challengeA

Delete a challenge and its evidence/flags/artifacts (admin only, cascades)

claim_challengeA

Lock a challenge to this agent (15-min lease; 409 if someone else holds it)

release_challengeB

Release the claim/lock on a challenge

set_challenge_statusC

Update working status: unopened | triaging | in_progress | blocked | solved | verified | failed

list_evidenceC

List evidence recorded on a challenge

save_evidenceA

Record evidence during solving (hypothesis, observation, command output...)

list_flagsA

List flags on a challenge (redacted previews only — the vault never returns plaintext)

submit_flag_candidateB

Store a flag candidate for a challenge (encrypted at rest, deduplicated)

get_writeupA

Read a challenge's writeup (Thai human + English AI)

save_writeupA

Save a writeup as markdown. Record Thai for human review, English for AI-generated.

Markdown is rendered on the challenge page — headings, code blocks, tables and images all display. To embed an image:

  1. upload it with upload_artifact → returns an artifact id

  2. reference it in the markdown as alt text

External image URLs (https://...) also render. Do NOT use relative paths like /_astro/... — they will 404 on the FlagForge site.

search_knowledgeA

Search across all events: challenge descriptions, writeups (Thai/English), tags — find how similar challenges were solved before

list_artifactsB

List files/artifacts attached to a challenge (images, pcaps, notes) with sha256

upload_artifactA

Upload a file (screenshot, pcap, note) to a challenge as an artifact.

Provide either a local file path (read from disk) or raw content bytes with a filename. Returns the artifact record — use its id to embed images in writeups: alt text

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ballz4z4/flagforge-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server