Skip to main content
Glama
cloudwarriors-ai

hackyeaster-solver

HackyEaster Solver

MCP server for Claude-driven HackyEaster CTF solving. Uses Scrapling for page fetching and exposes CTF utility tools so Claude can reason through challenges, submit answers via Playwright, and iterate.

Setup

Quick install (no clone needed)

Add to your ~/.mcp.json:

{
  "mcpServers": {
    "hackyeaster": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/cloudwarriors-ai/hackyeaster-solver", "hackyeaster-mcp"]
    }
  }
}

Restart Claude Code. The he_* tools will appear in the MCP servers panel.

Local development

If you want to modify the server or keep persistent state in a known location:

git clone https://github.com/cloudwarriors-ai/hackyeaster-solver.git
cd hackyeaster-solver
uv sync

Then in ~/.mcp.json, point at your local clone:

{
  "mcpServers": {
    "hackyeaster": {
      "command": "bash",
      "args": ["-c", "uv run --directory /path/to/hackyeaster-solver python -m hackyeaster_mcp.server"]
    }
  }
}

Related MCP server: Claude Memory

Tools

Scraping

Tool

Description

he_discover_challenges

Scrape hackyeaster.com and return available challenges

he_fetch_challenge

Fetch and parse a specific challenge page

he_fetch_raw

Fetch any URL and return raw HTML

CTF Utilities

Tool

Description

he_decode

Decode: base64, hex, url, binary, morse, decimal, octal, base32

he_transform

Transform: caesar, rot13, swap_pairs, reverse, rail_fence, vigenere, xor, atbash

he_analyze_image

Download image for visual analysis + QR/barcode detection

he_hash

Compute hashes: md5, sha1, sha256, sha512

State

Tool

Description

he_log_attempt

Record a solve attempt

he_get_progress

View all attempts and solved challenges

he_validate_flag

Check if text matches flag format he20XX{...}

How It Works

Claude is the solver. The MCP server provides the tools; Claude provides the reasoning.

  1. he_discover_challenges — scrape the site for challenges

  2. he_fetch_challenge — read challenge content, hints, embedded data

  3. Claude reasons about the puzzle, calls he_decode / he_transform / he_analyze_image as needed

  4. Playwright MCP (separate, already available in Claude Code) handles form interaction and answer submission

  5. he_log_attempt tracks what was tried and what worked

Requirements

  • Python 3.11+

  • uv

  • Claude Code with MCP support

  • Playwright MCP server (for answer submission when challenges go live)

Architecture

Claude (solver brain)
  |
  +-- hackyeaster MCP -- Scrapling fetch + CTF utils + state
  |
  +-- playwright MCP --- form interaction, submit answers, screenshots

Available Tools

12 tools
he_analyze_imageA

Download an image URL and return it as base64 for visual analysis. Also attempts QR code / barcode detection if pyzbar is available.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesImage URL to download and analyze

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description discloses key behaviors: download, base64 conversion, conditional QR detection based on pyzbar availability. It could mention error handling or size limits, but the core behaviors are transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary purpose, followed by a secondary capability. No extraneous information, every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema, no annotations), the description is quite complete. It covers the core function and additional detection capability. Minor gaps like download failure handling do not significantly detract.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'url' is described in the schema as 'Image URL to download and analyze'. The tool description adds the context of returning base64 and attempting QR detection, which enhances understanding beyond the schema alone. Schema coverage is 100%.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: download an image URL and return it as base64 for visual analysis, with additional QR/barcode detection. The verb 'analyze' and resource 'image' are specific, and it distinguishes itself from sibling tools which focus on hashing, logging, validation, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for image analysis and QR/barcode detection, providing clear context. However, it does not explicitly state when to avoid using this tool or compare it directly to alternatives among siblings, though the context makes it reasonably clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

he_decodeB

Decode data using a specified encoding: base64, hex, url, binary, morse, decimal, octal, base32.

ParametersJSON Schema
NameRequiredDescriptionDefault
dataYesThe data to decode
encodingYesEncoding type: base64, hex, url, binary, morse, decimal, octal, base32

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and description does not disclose error handling, return format, or side effects; only states core decode function.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with all essential information, front-loaded with action verb, no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Simple tool with clear purpose, but missing usage guidance and behavioral details; adequate but not comprehensive given sibling overlaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers both parameters fully (100% coverage), and description merely repeats the encoding list without adding new constraints or format details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool decodes data using specified encodings, listing all options, and distinguishes from sibling tools like he_hash and he_transform which handle different operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives such as he_transform; missing when-not-to-use or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

he_discover_challengesB

Scrape hackyeaster.com and return a list of available challenges with titles, URLs, descriptions, and embedded data.

ParametersJSON Schema
NameRequiredDescriptionDefault
dynamicNoUse headless browser (DynamicFetcher) for JS-rendered content. Default false.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the full burden falls on the description. It discloses that the tool scrapes a remote website, but does not mention potential side effects like network latency, rate limiting, or dynamic content behavior. The parameter 'dynamic' is described in the schema but not in the tool description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (one sentence) and front-loaded with the main action. However, it could benefit from a more structured format (e.g., listing returned fields explicitly) to improve readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one parameter and no output schema, the description is fairly complete in stating the input and output. However, it lacks details about what 'embedded data' means, error handling, or behavior when the website is unreachable, which would be useful for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for the single boolean parameter 'dynamic'. The tool description does not add additional semantic information about the parameter beyond what the schema already provides, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scrapes hackyeaster.com and returns a list of challenges with specific fields (titles, URLs, descriptions, embedded data). It distinguishes itself from sibling tools like he_fetch_challenge, which fetches a single challenge, and others that are unrelated to discovery.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies using this tool to get the full list before using other challenge-specific tools, but it does not explicitly state when to use it versus alternatives like he_fetch_challenge or he_search. No exclusion conditions are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

he_download_fileA

Download a challenge's attached file via the authenticated HackyEaster API. Fetches /app/rest/user/challenge/{id}/file and saves to the data/ directory. Returns the saved path, filename, content-type, and size in bytes.

ParametersJSON Schema
NameRequiredDescriptionDefault
challenge_idYesNumeric or slug challenge ID

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, description covers action, endpoint, local saving, and return fields. Omits permissions, errors, or size limits but adequate for context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences covering purpose, mechanism, and output. Front-loaded with key action, no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-param tool with no output schema, description covers purpose, API, local saving, and return values. Missing error handling but acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage 100% with description 'Numeric or slug challenge ID'; description reinforces endpoint usage but adds no new semantics beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states verb 'download', resource 'challenge's attached file', and distinguishes from siblings like he_analyze_image and he_validate_flag.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implicitly clear when to use (download attached file) given sibling tool names, but lacks explicit when-not-to-use or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

he_fetch_challengeA

Fetch a specific challenge page and return parsed content: title, description, hints, code blocks, images, links.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesThe challenge page URL
dynamicNo

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears the full burden. It discloses that it returns parsed content but omits behavioral traits like error handling, authentication needs, or the effect of the dynamic parameter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence, front-loaded with purpose and listing returned content concisely. Every word is necessary, no superfluous text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite lacking output schema, the description specifies returned fields well. However, the 'dynamic' parameter is not addressed, and error behavior is missing, leaving minor gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema describes 'url' (50% coverage), but the description adds no extra meaning. The 'dynamic' parameter remains unexplained, so the description fails to compensate for the low schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it 'Fetch a specific challenge page and return parsed content' and lists the exact returned fields (title, description, hints, code blocks, images, links), distinguishing it from siblings like he_fetch_raw.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide explicit guidance on when to use this tool versus alternatives (e.g., he_fetch_raw). It implies usage for fetching parsed challenge content, but lacks context on prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

he_fetch_rawC

Fetch any URL and return the raw HTML. Useful for following links or checking resources.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesURL to fetch
dynamicNo

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, and the description does not disclose potential side effects, authentication requirements, rate limits, or behavior of the 'dynamic' parameter. The tool appears read-only, but this is not confirmed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words. The action is front-loaded, and the second sentence adds context. Could be slightly more structured, but effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple fetch tool with 2 parameters (one undocumented) and no output schema, the description fails to explain the return format, error handling, or constraints like size limits. Incomplete for reliable agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (only 'url' described). The description adds no extra meaning beyond the schema; the 'dynamic' boolean parameter is completely unexplained, leaving the agent guessing its purpose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'fetch' and the resource 'any URL' returning 'raw HTML'. It distinguishes from siblings like he_download_file and he_fetch_challenge by being a general-purpose fetcher, though could specify protocol limitations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a usage hint ('following links or checking resources') but lacks explicit when-not-to-use guidance or comparisons with sibling tools like he_download_file.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

he_get_progressA

Return all solve attempts grouped by challenge, with summary of total attempts and solved count.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations present; description only states it returns data. Does not disclose pagination, ordering, time range, or potential performance implications.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, clear sentence with no unnecessary words. Front-loads purpose and structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple retrieval tool with no output schema, the description is adequate but lacks details on user scope, sorting, or data freshness. Lacks completeness for an agent to fully anticipate output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so the description does not need to add parameter details. Baseline of 4 for zero parameters is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool returns all solve attempts grouped by challenge with summary stats, clearly distinguishing it from sibling tools like he_log_attempt or he_submit_flag.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives (e.g., he_fetch_challenge, he_log_attempt). Lacks context about prerequisites or usage scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

he_hashB

Compute a hash of the given data. Algorithms: md5, sha1, sha256, sha512.

ParametersJSON Schema
NameRequiredDescriptionDefault
dataYesData to hash
algorithmNosha256

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses the supported hash algorithms but omits behavioral traits such as idempotency, side effects (none expected), performance considerations, or output format. The tool's safety is implied by its nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise—two sentences with no unnecessary words. It efficiently conveys the core functionality and available algorithms.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple hash tool, the description is minimal. It does not specify the output format, error handling, data encoding expectations, or any limitations. Given no output schema, more contextual details would be beneficial.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (data described, algorithm not). Description adds meaning by listing algorithm options, which compensates for the missing schema description. However, it does not explain the 'data' parameter format or constraints beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Compute a hash of the given data' and lists supported algorithms. The purpose is specific and distinguishable from sibling tools like he_decode and he_transform, though no explicit distinction is made.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives. The description does not mention prerequisites, best practices, or scenarios where other tools might be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

he_log_attemptB

Record a solve attempt for a challenge. Tracks answer, correctness, and notes.

ParametersJSON Schema
NameRequiredDescriptionDefault
notesNo
answerYes
correctYes
challenge_idYes

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavior. It mentions recording attempts but omits side effects (e.g., updates progress, requires authentication), idempotency, or state changes. The description is too brief for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, no wasted words. Could list key parameters for clarity, but overall efficient and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a simple logging tool, but lacks detail on return values, success/failure behavior, and interaction with other tools. Given 4 parameters and no output schema, more context would help.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description mentions 'answer, correctness, and notes,' which map to answer, correct, and notes parameters. However, challenge_id is undocumented in both schema and description. Partial compensation, but not fully informative.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it records a solve attempt for a challenge, tracking answer, correctness, and notes. This distinguishes it from sibling tools like he_submit_flag (submitting flags) and he_validate_flag (checking validity).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. The description implies it's for logging attempts, but does not mention prerequisites, when not to use, or suggest sibling tools for other actions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

he_submit_flagA

Submit a flag for a challenge via the authenticated HackyEaster API. POSTs to /app/rest/user/challenge/{id}/checkflag. Returns the API response (accepted/rejected/already-solved).

ParametersJSON Schema
NameRequiredDescriptionDefault
flagYesThe flag string to submit, e.g. he2026{abc123}
challenge_idYesNumeric or slug challenge ID as used in the HackyEaster URL

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, description carries full burden. It reveals mutation (POST), response types, and idempotency (already-solved). However, it omits auth requirements, rate limits, or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with key info, no fluff. Every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 2-param submission tool with no output schema, the description covers purpose, endpoint, and response. Minor gaps (auth method, error handling) but overall sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. Description adds example flag format and clarifies challenge_id as numeric or slug, adding value beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Submit a flag'), the resource ('for a challenge'), the API endpoint, and the expected response types. It distinguishes from siblings like he_validate_flag by specifying it's for submission via API.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives (e.g., he_validate_flag for local validation). No mention of prerequisites like authentication or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

he_transformB

Apply a cipher/transform: caesar (with shift param), rot13, swap_pairs, reverse, rail_fence (with rails param), vigenere (with key param), xor (with key param), atbash, caesar_bruteforce.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoKey for vigenere (string) or xor (integer). For xor, 0 means bruteforce.
dataYesThe data to transform
railsNoNumber of rails for rail_fence
shiftNoShift for caesar cipher
methodYesTransform method: caesar, rot13, swap_pairs, reverse, rail_fence, vigenere, xor, atbash, caesar_bruteforce
decryptNoDecrypt mode for vigenere

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description adds minimal behavioral info (e.g., xor with key 0 means bruteforce). Lacks disclosure on destructive potential, permissions, or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence front-loaded with action and methods. Efficient but lacks structural elements like examples or expected behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, no info on return values or error handling. With 6 parameters and multiple methods, more context would be beneficial.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all 6 parameters. Description adds extra context (e.g., meaning of key for vigenere/xor) but mostly duplicates schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool applies a cipher/transform and lists all supported methods (caesar, rot13, etc.), distinguishing it from sibling tools like he_hash or he_decode.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives, nor any exclusions or prerequisites. The description is a flat list of methods without context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

he_validate_flagA

Check if a string matches the HackyEaster flag format (he20XX{...}).

ParametersJSON Schema
NameRequiredDescriptionDefault
textYesText to check for flag format

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description only states what it checks, not behavioral details like return value or side effects. For a validation tool, more context is needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single concise sentence with no unnecessary words, perfectly front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given tool simplicity (one param, no output schema), description is adequate, though it could mention return type or purpose of validation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a clear description; tool description adds no new parameter information beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action (check) and resource (string matching flag format). It distinguishes from siblings like he_submit_flag and he_hash.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by name and description, but no explicit guidance on when to use vs. alternatives like he_submit_flag.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 12 tool updatesv0.1.0
    • First observedhe_analyze_image
    • First observedhe_decode
    • First observedhe_discover_challenges
    • First observedhe_download_file
    • First observedhe_fetch_challenge
    • First observedhe_fetch_raw
    • First observedhe_get_progress
    • First observedhe_hash
    • First observedhe_log_attempt
    • First observedhe_submit_flag
    • First observedhe_transform
    • First observedhe_validate_flag

TDQS

A3.7/5.0

Scored across 12 tools

Disambiguation5/5

Each tool has a distinct purpose: image analysis, hashing, logging, progress tracking, flag handling, file download, challenge discovery, page fetching, raw HTML fetching, decoding, and transformation. No overlapping functionality.

Naming Consistency5/5

All tools use the 'he_' prefix and snake_case. Most follow verb_noun pattern (e.g., analyze_image, validate_flag) with a few single-verb names (hash, decode, transform) that are clear in context.

Tool Count5/5

12 tools cover all necessary operations for the HackyEaster puzzle solver domain: discovery, fetching, analysis, decryption/transformation, flag submission, and progress tracking. Neither too sparse nor too many.

Completeness4/5

The toolset covers core workflows well, including image analysis with QR/barcode detection, hashing, decoding, cipher transformations, and flag lifecycle. Minor gaps like encoding or OCR are not essential for the domain.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers