Skip to main content
Glama
scoringengine

Scoring Engine MCP Server

Official
README.md
# Scoring Engine MCP Server

An MCP (Model Context Protocol) server for [Scoring Engine](https://github.com/scoringengine/scoringengine) - an open-source platform for running Red/White/Blue team cybersecurity competitions.

## Features

This MCP server provides programmatic access to all Scoring Engine API functionality:

### Scoreboard
- Get bar chart data (team scores)
- Get line chart data (score progression over rounds)

### Overview
- Get current round data
- Get overview status for all teams and services
- Get column headers
- Get detailed competition data

### Team Management
- Get team statistics (placement, score)
- Get team services with status and check history
- Get current service status

### Service Management
- Get check history for services
- Update service account credentials (blue team)
- Update service host/port (blue team)

### Statistics
- Get round statistics with up/down counts

### Flags (Red/White team)
- Get active flags
- Get flag solve status
- Get flag scoring totals

### Injects
- List team injects
- Get inject details
- Submit injects
- View/add comments
- List inject files

### Notifications
- List all notifications
- Get unread notifications

### Admin (White team only)
- Team/user management
- Engine control (pause/resume)
- Service configuration
- Inject template management
- Scoring and grading
- Settings management

## Installation

```bash
npm install
npm run build
```

## Configuration

Set the following environment variables:

| Variable | Description | Default |
|----------|-------------|---------|
| `SCORING_ENGINE_URL` | Base URL of your Scoring Engine instance | `http://localhost` |
| `SCORING_ENGINE_SESSION` | Session cookie value for authentication | (empty) |

### Getting the Session Cookie

1. Log in to your Scoring Engine instance in a web browser
2. Open Developer Tools (F12)
3. Go to Application > Cookies
4. Copy the value of the `session` cookie

## Usage with Claude Desktop

Add to your Claude Desktop configuration (`claude_desktop_config.json`):

```json
{
  "mcpServers": {
    "scoringengine": {
      "command": "node",
      "args": ["/path/to/scoringengine-mcp/dist/index.js"],
      "env": {
        "SCORING_ENGINE_URL": "https://your-scoring-engine.example.com",
        "SCORING_ENGINE_SESSION": "your-session-cookie-value"
      }
    }
  }
}
```

## Usage with Claude Code

Add to your Claude Code MCP settings:

```json
{
  "mcpServers": {
    "scoringengine": {
      "command": "node",
      "args": ["/path/to/scoringengine-mcp/dist/index.js"],
      "env": {
        "SCORING_ENGINE_URL": "https://your-scoring-engine.example.com",
        "SCORING_ENGINE_SESSION": "your-session-cookie-value"
      }
    }
  }
}
```

## Available Tools

### Scoreboard Tools
- `scoreboard_get_bar_data` - Get team bar chart data
- `scoreboard_get_line_data` - Get team line chart data

### Overview Tools
- `overview_get_round_data` - Get current round info
- `overview_get_data` - Get team/service overview
- `overview_get_columns` - Get column headers
- `overview_get_detailed_data` - Get detailed data for display

### Team Tools
- `team_get_stats` - Get team placement and score
- `team_get_services` - Get team's services with details
- `team_get_services_status` - Get current service status

### Service Tools
- `service_get_checks` - Get check history
- `service_update_account` - Update account credentials
- `service_update_host` - Update service hostname
- `service_update_port` - Update service port

### Stats Tools
- `stats_get_rounds` - Get round statistics

### Flags Tools (Red/White team)
- `flags_get_active` - Get active flags
- `flags_get_solves` - Get solve status
- `flags_get_totals` - Get scoring totals

### Injects Tools
- `injects_list` - List team injects
- `inject_get` - Get inject details
- `inject_submit` - Submit an inject
- `inject_get_comments` - Get inject comments
- `inject_add_comment` - Add a comment
- `inject_get_files` - List inject files

### Notifications Tools
- `notifications_list` - List all notifications
- `notifications_unread` - Get unread notifications

### Admin Tools (White team only)
- `admin_get_teams` - List all teams
- `admin_add_user` - Create user
- `admin_add_team` - Create team
- `admin_update_password` - Change user password
- `admin_toggle_engine` - Pause/resume engine
- `admin_get_engine_status` - Check if paused
- `admin_get_engine_stats` - Get engine statistics
- `admin_get_worker_stats` - Get worker stats
- `admin_get_queue_stats` - Get queue stats
- `admin_get_round_progress` - Get round progress
- `admin_update_check` - Modify check results
- `admin_update_host` - Change service host
- `admin_update_port` - Change service port
- `admin_update_points` - Update point values
- `admin_update_worker_queue` - Assign worker queue
- `admin_update_target_round_time` - Set round duration
- `admin_update_worker_refresh_time` - Set refresh interval
- `admin_injects_get_templates` - List inject templates
- `admin_injects_get_template` - Get template details
- `admin_injects_create_template` - Create template
- `admin_injects_update_template` - Update template
- `admin_injects_delete_template` - Delete template
- `admin_inject_grade` - Grade an inject
- `admin_injects_get_scores` - Get inject scores
- `admin_injects_get_bar_chart` - Get inject chart data
- `admin_update_setting` - Update settings
- `admin_update_environment_info` - Update environment
- `admin_update_property` - Update properties

## Development

```bash
# Install dependencies
npm install

# Build
npm run build

# Watch mode
npm run watch

# Run directly with ts-node
npm run dev
```

## License

MIT

TDQS

B3.2/5.0

Scored across 53 tools

Disambiguation2/5

Several tool pairs perform overlapping actions (e.g., admin_update_port vs service_update_port, overview_get_data vs overview_get_detailed_data, team_get_services vs team_get_services_status) with only permission scope or detail level differing. This makes it difficult for an agent to know which tool to invoke without deep context.

Naming Consistency4/5

Tool names consistently follow a snake_case resource_action pattern with clear prefixes (admin_, service_, team_, etc.). Minor deviations like inject_get (singular) vs injects_list (plural) are understandable and do not cause confusion.

Tool Count1/5

With 53 tools, the surface is overwhelming and exceeds the 'extreme mismatch' threshold. While the domain is complex, the sheer number of admin update variants and overlapping read/update tools makes it impractical for an agent to efficiently select the right tool.

Completeness4/5

The tool set provides broad coverage of the scoring engine's core domains: notifications, scoreboard, overview, teams, services, flags, injects, and extensive admin controls. Minor gaps exist (e.g., no mark-notification-read, no team/service CRUD beyond updates), but these are workaroundable.

Maintenance

ActivityInactive
ResponsivenessNo issues