hackyeaster-solver
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@hackyeaster-solverFind all the current HackyEaster challenges."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
HackyEaster Solver
MCP server for Claude-driven HackyEaster CTF solving. Uses Scrapling for page fetching and exposes CTF utility tools so Claude can reason through challenges, submit answers via Playwright, and iterate.
Setup
Quick install (no clone needed)
Add to your ~/.mcp.json:
{
"mcpServers": {
"hackyeaster": {
"command": "uvx",
"args": ["--from", "git+https://github.com/cloudwarriors-ai/hackyeaster-solver", "hackyeaster-mcp"]
}
}
}Restart Claude Code. The he_* tools will appear in the MCP servers panel.
Local development
If you want to modify the server or keep persistent state in a known location:
git clone https://github.com/cloudwarriors-ai/hackyeaster-solver.git
cd hackyeaster-solver
uv syncThen in ~/.mcp.json, point at your local clone:
{
"mcpServers": {
"hackyeaster": {
"command": "bash",
"args": ["-c", "uv run --directory /path/to/hackyeaster-solver python -m hackyeaster_mcp.server"]
}
}
}Related MCP server: Claude Memory
Tools
Scraping
Tool | Description |
| Scrape hackyeaster.com and return available challenges |
| Fetch and parse a specific challenge page |
| Fetch any URL and return raw HTML |
CTF Utilities
Tool | Description |
| Decode: base64, hex, url, binary, morse, decimal, octal, base32 |
| Transform: caesar, rot13, swap_pairs, reverse, rail_fence, vigenere, xor, atbash |
| Download image for visual analysis + QR/barcode detection |
| Compute hashes: md5, sha1, sha256, sha512 |
State
Tool | Description |
| Record a solve attempt |
| View all attempts and solved challenges |
| Check if text matches flag format |
How It Works
Claude is the solver. The MCP server provides the tools; Claude provides the reasoning.
he_discover_challenges— scrape the site for challengeshe_fetch_challenge— read challenge content, hints, embedded dataClaude reasons about the puzzle, calls
he_decode/he_transform/he_analyze_imageas neededPlaywright MCP (separate, already available in Claude Code) handles form interaction and answer submission
he_log_attempttracks what was tried and what worked
Requirements
Python 3.11+
Claude Code with MCP support
Playwright MCP server (for answer submission when challenges go live)
Architecture
Claude (solver brain)
|
+-- hackyeaster MCP -- Scrapling fetch + CTF utils + state
|
+-- playwright MCP --- form interaction, submit answers, screenshotsAvailable Tools
12 toolshe_analyze_imageA
Download an image URL and return it as base64 for visual analysis. Also attempts QR code / barcode detection if pyzbar is available.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Image URL to download and analyze |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description discloses key behaviors: download, base64 conversion, conditional QR detection based on pyzbar availability. It could mention error handling or size limits, but the core behaviors are transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary purpose, followed by a secondary capability. No extraneous information, every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema, no annotations), the description is quite complete. It covers the core function and additional detection capability. Minor gaps like download failure handling do not significantly detract.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'url' is described in the schema as 'Image URL to download and analyze'. The tool description adds the context of returning base64 and attempting QR detection, which enhances understanding beyond the schema alone. Schema coverage is 100%.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: download an image URL and return it as base64 for visual analysis, with additional QR/barcode detection. The verb 'analyze' and resource 'image' are specific, and it distinguishes itself from sibling tools which focus on hashing, logging, validation, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for image analysis and QR/barcode detection, providing clear context. However, it does not explicitly state when to avoid using this tool or compare it directly to alternatives among siblings, though the context makes it reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
he_decodeB
Decode data using a specified encoding: base64, hex, url, binary, morse, decimal, octal, base32.
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | The data to decode | |
| encoding | Yes | Encoding type: base64, hex, url, binary, morse, decimal, octal, base32 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and description does not disclose error handling, return format, or side effects; only states core decode function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with all essential information, front-loaded with action verb, no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Simple tool with clear purpose, but missing usage guidance and behavioral details; adequate but not comprehensive given sibling overlaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers both parameters fully (100% coverage), and description merely repeats the encoding list without adding new constraints or format details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool decodes data using specified encodings, listing all options, and distinguishes from sibling tools like he_hash and he_transform which handle different operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as he_transform; missing when-not-to-use or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
he_discover_challengesB
Scrape hackyeaster.com and return a list of available challenges with titles, URLs, descriptions, and embedded data.
| Name | Required | Description | Default |
|---|---|---|---|
| dynamic | No | Use headless browser (DynamicFetcher) for JS-rendered content. Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the full burden falls on the description. It discloses that the tool scrapes a remote website, but does not mention potential side effects like network latency, rate limiting, or dynamic content behavior. The parameter 'dynamic' is described in the schema but not in the tool description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (one sentence) and front-loaded with the main action. However, it could benefit from a more structured format (e.g., listing returned fields explicitly) to improve readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter and no output schema, the description is fairly complete in stating the input and output. However, it lacks details about what 'embedded data' means, error handling, or behavior when the website is unreachable, which would be useful for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for the single boolean parameter 'dynamic'. The tool description does not add additional semantic information about the parameter beyond what the schema already provides, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool scrapes hackyeaster.com and returns a list of challenges with specific fields (titles, URLs, descriptions, embedded data). It distinguishes itself from sibling tools like he_fetch_challenge, which fetches a single challenge, and others that are unrelated to discovery.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies using this tool to get the full list before using other challenge-specific tools, but it does not explicitly state when to use it versus alternatives like he_fetch_challenge or he_search. No exclusion conditions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
he_download_fileA
Download a challenge's attached file via the authenticated HackyEaster API. Fetches /app/rest/user/challenge/{id}/file and saves to the data/ directory. Returns the saved path, filename, content-type, and size in bytes.
| Name | Required | Description | Default |
|---|---|---|---|
| challenge_id | Yes | Numeric or slug challenge ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, description covers action, endpoint, local saving, and return fields. Omits permissions, errors, or size limits but adequate for context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences covering purpose, mechanism, and output. Front-loaded with key action, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-param tool with no output schema, description covers purpose, API, local saving, and return values. Missing error handling but acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage 100% with description 'Numeric or slug challenge ID'; description reinforces endpoint usage but adds no new semantics beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'download', resource 'challenge's attached file', and distinguishes from siblings like he_analyze_image and he_validate_flag.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implicitly clear when to use (download attached file) given sibling tool names, but lacks explicit when-not-to-use or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
he_fetch_challengeA
Fetch a specific challenge page and return parsed content: title, description, hints, code blocks, images, links.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The challenge page URL | |
| dynamic | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears the full burden. It discloses that it returns parsed content but omits behavioral traits like error handling, authentication needs, or the effect of the dynamic parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with purpose and listing returned content concisely. Every word is necessary, no superfluous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite lacking output schema, the description specifies returned fields well. However, the 'dynamic' parameter is not addressed, and error behavior is missing, leaving minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema describes 'url' (50% coverage), but the description adds no extra meaning. The 'dynamic' parameter remains unexplained, so the description fails to compensate for the low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it 'Fetch a specific challenge page and return parsed content' and lists the exact returned fields (title, description, hints, code blocks, images, links), distinguishing it from siblings like he_fetch_raw.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit guidance on when to use this tool versus alternatives (e.g., he_fetch_raw). It implies usage for fetching parsed challenge content, but lacks context on prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
he_fetch_rawC
Fetch any URL and return the raw HTML. Useful for following links or checking resources.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL to fetch | |
| dynamic | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description does not disclose potential side effects, authentication requirements, rate limits, or behavior of the 'dynamic' parameter. The tool appears read-only, but this is not confirmed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. The action is front-loaded, and the second sentence adds context. Could be slightly more structured, but effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple fetch tool with 2 parameters (one undocumented) and no output schema, the description fails to explain the return format, error handling, or constraints like size limits. Incomplete for reliable agent decision-making.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% (only 'url' described). The description adds no extra meaning beyond the schema; the 'dynamic' boolean parameter is completely unexplained, leaving the agent guessing its purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'fetch' and the resource 'any URL' returning 'raw HTML'. It distinguishes from siblings like he_download_file and he_fetch_challenge by being a general-purpose fetcher, though could specify protocol limitations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a usage hint ('following links or checking resources') but lacks explicit when-not-to-use guidance or comparisons with sibling tools like he_download_file.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
he_get_progressA
Return all solve attempts grouped by challenge, with summary of total attempts and solved count.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations present; description only states it returns data. Does not disclose pagination, ordering, time range, or potential performance implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, clear sentence with no unnecessary words. Front-loads purpose and structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple retrieval tool with no output schema, the description is adequate but lacks details on user scope, sorting, or data freshness. Lacks completeness for an agent to fully anticipate output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so the description does not need to add parameter details. Baseline of 4 for zero parameters is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool returns all solve attempts grouped by challenge with summary stats, clearly distinguishing it from sibling tools like he_log_attempt or he_submit_flag.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., he_fetch_challenge, he_log_attempt). Lacks context about prerequisites or usage scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
he_hashB
Compute a hash of the given data. Algorithms: md5, sha1, sha256, sha512.
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | Data to hash | |
| algorithm | No | sha256 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses the supported hash algorithms but omits behavioral traits such as idempotency, side effects (none expected), performance considerations, or output format. The tool's safety is implied by its nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—two sentences with no unnecessary words. It efficiently conveys the core functionality and available algorithms.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple hash tool, the description is minimal. It does not specify the output format, error handling, data encoding expectations, or any limitations. Given no output schema, more contextual details would be beneficial.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50% (data described, algorithm not). Description adds meaning by listing algorithm options, which compensates for the missing schema description. However, it does not explain the 'data' parameter format or constraints beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Compute a hash of the given data' and lists supported algorithms. The purpose is specific and distinguishable from sibling tools like he_decode and he_transform, though no explicit distinction is made.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives. The description does not mention prerequisites, best practices, or scenarios where other tools might be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
he_log_attemptB
Record a solve attempt for a challenge. Tracks answer, correctness, and notes.
| Name | Required | Description | Default |
|---|---|---|---|
| notes | No | ||
| answer | Yes | ||
| correct | Yes | ||
| challenge_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavior. It mentions recording attempts but omits side effects (e.g., updates progress, requires authentication), idempotency, or state changes. The description is too brief for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, no wasted words. Could list key parameters for clarity, but overall efficient and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple logging tool, but lacks detail on return values, success/failure behavior, and interaction with other tools. Given 4 parameters and no output schema, more context would help.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description mentions 'answer, correctness, and notes,' which map to answer, correct, and notes parameters. However, challenge_id is undocumented in both schema and description. Partial compensation, but not fully informative.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it records a solve attempt for a challenge, tracking answer, correctness, and notes. This distinguishes it from sibling tools like he_submit_flag (submitting flags) and he_validate_flag (checking validity).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description implies it's for logging attempts, but does not mention prerequisites, when not to use, or suggest sibling tools for other actions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
he_submit_flagA
Submit a flag for a challenge via the authenticated HackyEaster API. POSTs to /app/rest/user/challenge/{id}/checkflag. Returns the API response (accepted/rejected/already-solved).
| Name | Required | Description | Default |
|---|---|---|---|
| flag | Yes | The flag string to submit, e.g. he2026{abc123} | |
| challenge_id | Yes | Numeric or slug challenge ID as used in the HackyEaster URL |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description carries full burden. It reveals mutation (POST), response types, and idempotency (already-solved). However, it omits auth requirements, rate limits, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with key info, no fluff. Every sentence serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 2-param submission tool with no output schema, the description covers purpose, endpoint, and response. Minor gaps (auth method, error handling) but overall sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. Description adds example flag format and clarifies challenge_id as numeric or slug, adding value beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Submit a flag'), the resource ('for a challenge'), the API endpoint, and the expected response types. It distinguishes from siblings like he_validate_flag by specifying it's for submission via API.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool vs alternatives (e.g., he_validate_flag for local validation). No mention of prerequisites like authentication or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
he_transformB
Apply a cipher/transform: caesar (with shift param), rot13, swap_pairs, reverse, rail_fence (with rails param), vigenere (with key param), xor (with key param), atbash, caesar_bruteforce.
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | Key for vigenere (string) or xor (integer). For xor, 0 means bruteforce. | |
| data | Yes | The data to transform | |
| rails | No | Number of rails for rail_fence | |
| shift | No | Shift for caesar cipher | |
| method | Yes | Transform method: caesar, rot13, swap_pairs, reverse, rail_fence, vigenere, xor, atbash, caesar_bruteforce | |
| decrypt | No | Decrypt mode for vigenere |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description adds minimal behavioral info (e.g., xor with key 0 means bruteforce). Lacks disclosure on destructive potential, permissions, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence front-loaded with action and methods. Efficient but lacks structural elements like examples or expected behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, no info on return values or error handling. With 6 parameters and multiple methods, more context would be beneficial.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all 6 parameters. Description adds extra context (e.g., meaning of key for vigenere/xor) but mostly duplicates schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool applies a cipher/transform and lists all supported methods (caesar, rot13, etc.), distinguishing it from sibling tools like he_hash or he_decode.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives, nor any exclusions or prerequisites. The description is a flat list of methods without context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
he_validate_flagA
Check if a string matches the HackyEaster flag format (he20XX{...}).
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | Text to check for flag format |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only states what it checks, not behavioral details like return value or side effects. For a validation tool, more context is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single concise sentence with no unnecessary words, perfectly front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given tool simplicity (one param, no output schema), description is adequate, though it could mention return type or purpose of validation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear description; tool description adds no new parameter information beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action (check) and resource (string matching flag format). It distinguishes from siblings like he_submit_flag and he_hash.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by name and description, but no explicit guidance on when to use vs. alternatives like he_submit_flag.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
12 tool updates
v0.1.0- First observed
he_analyze_image - First observed
he_decode - First observed
he_discover_challenges - First observed
he_download_file - First observed
he_fetch_challenge - First observed
he_fetch_raw - First observed
he_get_progress - First observed
he_hash - First observed
he_log_attempt - First observed
he_submit_flag - First observed
he_transform - First observed
he_validate_flag
TDQS
Scored across 12 tools
Each tool has a distinct purpose: image analysis, hashing, logging, progress tracking, flag handling, file download, challenge discovery, page fetching, raw HTML fetching, decoding, and transformation. No overlapping functionality.
All tools use the 'he_' prefix and snake_case. Most follow verb_noun pattern (e.g., analyze_image, validate_flag) with a few single-verb names (hash, decode, transform) that are clear in context.
12 tools cover all necessary operations for the HackyEaster puzzle solver domain: discovery, fetching, analysis, decryption/transformation, flag submission, and progress tracking. Neither too sparse nor too many.
The toolset covers core workflows well, including image analysis with QR/barcode detection, hashing, decoding, cipher transformations, and flag lifecycle. Minor gaps like encoding or OCR are not essential for the domain.
Maintenance
Related MCP Connectors
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Augments MCP Server - A comprehensive framework documentation provider for Claude Code
Cloudflare Workers MCP server: claude-skill-validator
Cloudflare Workers MCP server: ai-agent-scratchpad
Related MCP Servers
- AlicenseAqualityBmaintenanceMCP server to dynamically load Claude Code skills into AI agents531 npm15MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that provides Claude Code with persistent memory across sessions, including session checkpoints, image persistence, and bidirectional sync with claude.ai projects.1MIT
- AlicenseNot gradedqualityDmaintenanceA local MCP server that enables Claude to generate images using the OpenAI API.4 npmMIT
- AlicenseNot gradedqualityDmaintenanceA private MCP server that lets Claude generate images using Google Gemini/Imagen, exposing a generate_image tool.130 npmMIT