Skip to main content
Glama
502,608 tools. Updated 2026-09-01 11:10

"Capture The Flag (CTF) cybersecurity competitions and challenges" matching MCP tools:

  • Compare x402 and MPP payment challenges, terms, and seller-declared JSON success-response readiness for one exact public HTTPS GET route before buyer authorization, including URL and realm binding, expiry, cross-protocol economic parity, and exact-route OpenAPI evidence. Use `agent_discoverability_audit` instead when you need to know whether catalogs rank or expose a service. This tool uses no target credential, signature, or target payment, follows no redirect, never reads the paid target body, and reads only the same-origin public OpenAPI document under a strict size cap. A seller declaration is advisory and does not establish runtime validity, seller trust, utility, or settlement reliability.
    Connector
  • Load a public URL in a full browser session. JavaScript runs, the DOM renders, and cookies come back with the response. Use it for single-page apps, lazy-loaded content, or supported browser challenges. For a protected page, call foura_proxy first and pass its returned proxy ID here to reuse that exit. Set unblocker:false when you want the page exactly as it loads.
    Connector
  • Use this when you need the true matches of a JavaScript regular expression rather than predicting regex behavior yourself, which is easy to get wrong. Deterministic: same input, same output. Returns every match with its index, length, matched text, positional capture groups (null for a group that didn't participate), and named groups (an object, or null when the pattern has none). Without the g flag only the first match is returned; with g all matches are collected, capped at 10,000 with truncated=true. Inputs are length-bounded (pattern 2,000 chars, text 50,000 chars) as a ReDoS guard. Example: pattern (?<y>\d{4})-(?<m>\d{2}) over "2024-01" with flag g -> matchCount 1, match "2024-01", groups ["2024","01"], named {y:"2024",m:"01"}.
    Connector
  • List Bill Commons' curated cross-state topic trackers (e.g. artificial intelligence, youth online safety, platform accountability, cybersecurity, cryptocurrency, data privacy, local government & preemption) -- the entry point for "what subjects does Bill Commons track across all 50 states + DC" and "how do I get every bill in one". Each topic is a title/subject membership rule tuned for precision over recall, with a live bill_count and how_to_fetch_bills. This tool does not itself return bill rows -- pair it with search_legislation or the REST API's /topics/{slug} for the bills.
    Connector
  • Golf outright-winner probabilities, normalised across the priced field. Call with NO arguments to list the tournaments currently priced together with their tournament_key values; call again passing tournament_key to get that one tournament with its full player field. GOLF ONLY — use list_tournament_outrights for soccer competitions. Read-only. Between tournaments the no-argument call returns an empty list, which means nothing is currently priced rather than an error; an unrecognised tournament_key returns a tournament_not_found error.
    Connector
  • Search funded-account challenges across all visible prop firms. Filter by challenge rules (account size, fee, steps, profit split, drawdown mode, news/copy/auto trading, weekend holding, …) and by parent-firm properties. Pass propfirmId to list one firm's challenges, or challengeId to fetch specific ones. include=['offers'] returns a deduplicated top-level offers list, with each challenge referencing its applicable offers via offerIds (firm-wide offers included). Uncaptured (null) rule fields are omitted from results and never match filters. This returns each challenge's listed rules and terms, not outcomes: to simulate a challenge found here pass its ids to propfirms_simulate or propfirms_pass_rates, and to screen one strategy across many challenges at once use propfirms_validate_strategy.
    Connector

Matching MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Enables human-in-the-loop interaction for AI coding workflows through native desktop dialogs that present route choices, text input, and image annotation capabilities when AI assistants encounter decision points.
    1
    2
    MIT

Matching MCP Connectors

  • Write a piece of customer feedback to the spine (the agent's own hand, not just reading) and return the created insight. Fires the same insight.created webhook a manual capture does — a real side-effect, so only capture genuine signal. Resolve account_id via get_customer_360 and feature_id via list_features and tie them when known; kind='opportunity' marks a prioritisable ask. Only body is required.
    Connector
  • Get the project owner's current subscription: plan, active flag, period start/end, cancel-at-period-end flag, external Paddle subscription id, and whether a payment method is on file at the provider. Owner-only; requires a token minted with the billing scope.
    Connector
  • Get Lenny Zeltser's cybersecurity-writing rating sheet(s) so your AI can apply the rubric. Returns the structured rubric (groups, items, scoring bands) WITHOUT computing a score. Use `rating_score_writing` if you also want a numeric score, gap analysis, or rubric-anchored feedback. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.
    Connector
  • List competitions accessible on your plan. Free tier: 12 majors. Use the returned `code` (e.g., "PL", "PD", "CL") for downstream calls.
    Connector
  • Copy the previous period’s "nothing this period" and "does not apply" answers into this period, for sections that have no answer yet. It NEVER copies a review confirmation — a review is about this period’s content and cannot be inherited. Last period’s answer is not evidence about this period: list what it would copy to your user, section by section, and get their go-ahead before calling it. Answers already recorded for this period are left alone. Generate a fresh version after your last capture change — finalisation checks the version’s frozen capture state, not today’s.
    Connector
  • Answer 'which challenges would MY strategy actually pass?' in one call: simulate the given strategy through every simulatable challenge in the live directory (optionally scoped by productType, account-size range, priceMax, or firm) and split the results by an explicit, caller-stated bar. Describe the strategy EITHER as real trades (rSeries/rSeriesText R-multiples, preferred: the stationary block bootstrap preserves streaks, which is what breaches loss limits) OR as summary stats (winRate + avgWinR, optional spreads), plus tradesPerDay and risk sizing (riskMode + riskValue). The bar is minPassPerAttempt (a fraction, default 0.5) with optional requirePositiveEv; always state the bar when relaying results. Returns per challenge: pass probability per attempt with 95% CI, P(funded), expected attempts and total cost, EV over the funded horizon, P(EV>0), assumption flag ids, and which rule semantics were inferred from listing text. HONESTY FRAME: this is a screen of distributions for the caller's inputs and bar, NOT a ranking or endorsement; challenges whose rules cannot be encoded honestly are excluded and counted, never guessed; flagged (unsimulated) rules make numbers optimistic, so relay flags. One full simulation runs per challenge (default 5,000 paths each; results are deterministic per seed), and scopes above 40 challenges are refused rather than silently truncated: narrow the scope instead. Numbers move with risk sizing; sweep one challenge with propfirms_optimal_risk afterwards. Fees and expected costs use the directory's listed prices (live discounts are NOT applied); prices, firm profiles, and current offers are directory data (propfirms_search_challenges, propfirms_get, propfirms_search_offers).
    Connector
  • Corrects a pending self-registration draft's metadata before approval. Requires the access code returned by self_register_agent_card. Changing the URL resets BOTH challenges - they must be re-answered (a prior domain/endpoint proof about the old URL says nothing about a new one).
    Connector
  • Get Lenny Zeltser's scoring playbook so your AI can score a draft locally against a cybersecurity-writing rating sheet. THIS IS THE ONLY TOOL THAT PRODUCES NUMERIC SCORES — the writing-coach tools (`get_security_writing_guidelines`, `ir_*`, `product_*`) never score. Returns the rubric plus step-by-step instructions for applying it. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.
    Connector
  • [PLAY] Active VIA network quests for agents. Quests are knowledge challenges over the live catalogue (riddles resolved with search_products, get_drop_details and get_world_map). Correct answers earn VIA Points, the cross-brand loyalty balance. Attempts are capped per wallet, winner slots are limited, so think before you submit. Answer with submit_quest_answer.
    Connector
  • For puzzle/CTF/bounty contracts: classifies each as locked_no_payout (funded but a correct solution pays nothing — the funds can never leave, e.g. TeikhosBounty), frontrun_bait (pays msg.sender/tx.origin on a calldata condition → broadcasting the solution publicly will be front-run; submit privately), owner_only_payout, claimable, indeterminate or unfunded — from a verified-source payout-path analysis + a bytecode value-exit scan. view="summary" returns per-class counts + ETH-at-stake rollups + a teaser; view="detail" returns the full annotated watchlist (paid via x402 at GET /v1/premium/puzzle-risk; served here for agents); pass `address` for a single-contract verdict. Heuristic — verify on-chain before acting.
    Connector
  • Return a list of hands-on SecDim Play secure coding challenges (labs) related to a detected or suspected vulnerability. SecDim Play challenges are scored, hands-on labs: find and fix a real vulnerability in running code to earn points and badges. Use this tool to: - Find hands-on SecDim Play labs for specific vulnerabilities like XSS, SQL Injection, etc. - Explore OWASP Top 10 vulnerabilities and related labs - Provide additional resources and guides to help developers improve their secure coding skills For structured tutorial content (text, video, and lab-based courses) on the same vulnerability, use search_learn_courses (SecDim Learn) instead or in addition. Args: search: Search term for the vulnerability (e.g., 'xss', 'sql-injection', 'injection') cwe: Common Weakness Enumeration (CWE) ID to filter by owasp: OWASP category to filter by (e.g., 'a03:2021') technology: Technology or framework to filter by (e.g., 'react', 'django') language: Programming language to filter by (e.g., 'javascript', 'python') difficulty: Difficulty level to filter by (e.g., 'trivial', 'easy', 'medium', 'hard') type: Challenge format to filter by (e.g., 'battle', 'exploitation', 'incident-response') mitre: MITRE ATT&CK ID to filter by (e.g., 'T1102.003') SecDim Play challenges (labs) each simulate a real vulnerability. They are scored according to the following difficulty levels: - Trivial: Easy to find and path vulnerabilities. It can be completed in 5-10 minutes. 1-15 points. - Easy: Known vulnerabilities. It can be completed in 10-30 minutes. 16-35 points. - Medium: Known vulnerabilities but require defence-in-depth patch. It can be completed in 20-30 minutes. 36-70 points. - Hard: Hard to find or patch vulnerabilities. It can be completed in 30-60 minutes. 71-100 points. - Battle: SecDim Flagship attack and defence challenge that require both vulnerability exploitation and mitigation skills. Points are accumulated. Returns: Dictionary containing SecDim Play labs results or error If there are no results, user can perform a manual search on the SecDim Play frontend (SECDIM_PLAY_FRONTEND_BASE_URL)
    Connector
  • Discover which matches have prediction-market odds coverage in the in-play odds tape (odds_ticks): per-match tick counts by source (polymarket = CLOB midpoint, apifootball = de-vigged bookmaker odds), in-play tick counts vs kickoff, capture span, live dataset totals (computed from the table, never hardcoded), and upcoming fixtures already mapped for capture. In-play odds are unbackfillable — a match that passed uncaptured stays uncovered. Use tokenintel_match_odds to fetch a covered match's probability curves.
    Connector
  • Press-move-release mouse drag in native capture coordinates. Use for drawing, sliders, selection boxes, and drag-and-drop. Side effect: mouse_down → moves → mouse_up on the remote desktop. Prefer input.send_actions if the drag is one step in a longer predictable sequence.
    Connector
  • Start a device-wide NATIVE network packet capture on an iOS device. Captures REAL packets at the network layer, mostly TLS-encrypted, so there are NO HTTP bodies — the result is a Wireshark .pcapng for packet-level analysis. One capture per device. Optionally filter by `process` (process name, e.g. mobilesafari / backboardd) or `interfaceName` (e.g. en0), and auto-stop after `packets` frames. End with ios_pcap_stop. (For Safari HTTP traffic with bodies, use ios_safari_capture_network instead.)
    Connector