"Resources and tools for difficult CTF (Capture The Flag) cybersecurity challenges" matching MCP tools:

• permissions_status

  local-mcp

  Reports the TCC permission state (screen recording, accessibility, microphone) this app needs to capture the screen and drive other apps' UI. Call it before a capture/automation run and surface the grant hints instead of failing mid-sequence. Screen Recording / Accessibility are granted in System Settings (not a JIT dialog); the URLs open the exact pane.

  Connector

• rating_get_sheet

  website-search

  Get Lenny Zeltser's cybersecurity-writing rating sheet(s) so your AI can apply the rubric. Returns the structured rubric (groups, items, scoring bands) WITHOUT computing a score. Use `rating_score_writing` if you also want a numeric score, gap analysis, or rubric-anchored feedback. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.

  Connector

• govcon_search_contract_awards

  DataNexus MCP

  Search government contract awards by keyword, agency, and date range. keyword: Contract scope e.g. "cybersecurity software". agency: Awarding agency e.g. "Department of Defense". Optional. date_from: Earliest award date ISO 8601 e.g. "2024-01-31". Optional. jurisdiction: "US", "EU", or "UK". Default "US". Returns: award amounts, recipient vendors, NAICS codes, award dates. Use govcon_fetch_vendor_contract_history for all contracts by a specific vendor. Use govcon_fetch_open_solicitations for active bids, not past awards. Source: USASpending.gov + SAM.gov. 4-hour cache. Example: search_contract_awards(keyword="cybersecurity software", agency="Department of Defense")

  Connector

• seneschal_private_relay

  Seneschal Data

  Front-run protection for any sensitive tx (a puzzle/CTF/bounty claim, a large approval revoke, a first-touch interaction, an NFT mint): submit a LOCALLY-signed raw transaction and we forward it only to private block builders (Flashbots, Titan) + our own rbuilder — NEVER the public mempool. You keep custody (only signed bytes leave your machine; any change breaks the signature). view="info" returns the builder set + price + caveats; view="inspect" with raw_tx decodes/validates the signed tx and previews its target builders WITHOUT relaying (free, so you can confirm before paying). The paid relay itself is POST /v1/premium/private-relay via x402.

  Connector

• foura_browser

  mcp

  Load a public URL in a full browser session. JavaScript runs, the DOM renders, and cookies come back with the response. Use it for single-page apps, lazy-loaded content, or supported browser challenges. For a protected page, call foura_proxy first and pass its returned proxy ID here to reuse that exit. Set unblocker:false when you want the page exactly as it loads.

  Connector

• noaa_get_station_info

  NOAA Tides and Currents

  Get a NOAA station's full metadata record: location, state, time zone, tide type, Great Lakes flag, capability flags, and links to available sub-resources. Optionally expand sub-resources inline via the "expand" list: - details (established/removed dates), sensors (installed instruments + elevations), floodlevels (NOS/NWS minor/moderate/major flood thresholds), benchmarks, products (available data page links), notices, disclaimers — for water-level stations - bins (ADCP depth bins), deployments — for current stations (alphanumeric IDs) Use this before requesting data to confirm what the station actually collects. For datum values use noaa_get_station_datums; for harmonic constituents use noaa_get_harmonic_constituents.

  Connector

• enrich_course_waypoints

  CourseProfiler

  Add structured aid stations, checkpoints, cutoffs, and canonical resources to a CRSProf artifact that lacks them. Before enriching, inspect whether the imported source already contains GPX/CRSProf waypoints; if it already contains GPX/CRSProf waypoints, avoid duplicate Start/Finish/aid stations and prefer merging/updating resources, cutoffs, notes, or links on existing waypoint metadata. Prefer waypoints.mode=structured; put non-canonical/free-text aid details in notes/source text because unsupported resource strings are ignored with warnings. Route-only plans should be labeled incomplete unless the CRSProf already includes official waypoints/resources/cutoffs or the user explicitly accepts missing aid/resource details.

  Connector

• list_briefs

  Real Real Genuine

  [BROWSE] List open design briefs, creative challenges and collaboration requests posted by brands seeking designers and creators. These are NOT products for sale. Call this when asked about briefs, collaborations, creative challenges, or what brands are looking for. Returns brief title, brand name, description, and brief ID. Use a brief ID with submit_design to respond. To see products for sale, use list_drops instead.

  Connector

• list_briefs

  Real Real Genuine

  [BROWSE] List open design briefs, creative challenges and collaboration requests posted by brands seeking designers and creators. These are NOT products for sale. Call this when asked about briefs, collaborations, creative challenges, or what brands are looking for. Returns brief title, brand name, description, and brief ID. Use a brief ID with submit_design to respond. To see products for sale, use list_drops instead.

  Connector

• guides.list

  AI Design Blueprint

  List application guides that show how Blueprint principles apply to engineering challenges (security, evaluation, observability, etc.). Use this to discover which guides exist before drilling in. Prefer guides.search when the user describes a topic or failure mode in natural language. Prefer guides.get when you already know the guide slug and need full detail.

  Connector

• lookup_authoring_skill

  kernelcad

  Return the kernelcad-authoring SKILL.md body — conventions for writing .kcad.ts scripts (imports, parameters, evaluation contract, common pitfalls). Use this tool BEFORE generating CAD code if your MCP client does not list resources. Clients that do list resources should instead read `kernelcad://skills/authoring` directly — the contents are identical. INPUT: none. OUTPUT: { uri, mimeType, text } where `text` is the SKILL.md body.

  Connector

• dataset_details

  Opendata Swiss

  Full metadata for one dataset (CKAN package_show) including its resources/distributions with download URLs. Use a dataset `name` (slug) or id from search_datasets. There is no datastore, so fetch `resources[].download_url`/`url` for the underlying data.

  Connector

• find_chain

  AINumbers Fintech Intelligence Suite

  BM25 search over all 314 AINumbers ChainGraph chains. Returns ranked chains with their full recipe: ordered node sequence, deep-links, composer URL, and entry tool mcp_name. Agent flow: find_chain(query) → read recipe → call the listed node MCP tools in order, passing parent_hashes between steps. Do NOT use prompts/list or resources for agent chain discovery — use this tool.

  Connector

• test_regex

  mcp

  Use this when you need the true matches of a JavaScript regular expression rather than predicting regex behavior yourself, which is easy to get wrong. Deterministic: same input, same output. Returns every match with its index, length, matched text, positional capture groups (null for a group that didn't participate), and named groups (an object, or null when the pattern has none). Without the g flag only the first match is returned; with g all matches are collected, capped at 10,000 with truncated=true. Inputs are length-bounded (pattern 2,000 chars, text 50,000 chars) as a ReDoS guard. Example: pattern (?<y>\d{4})-(?<m>\d{2}) over "2024-01" with flag g -> matchCount 1, match "2024-01", groups ["2024","01"], named {y:"2024",m:"01"}.

  Connector

• list_capabilities

  mcp

  List all available Quantustik MCP tools and resources. Use this as the entry point when a user asks what can you do with Quantustik, or to discover the full surface area of the server. Returns a structured description of every tool and resource.

  Connector

• execute_intent

  MERX - TRON Resource Exchange

  Plan a multi-step operation (transfer, swap, buy resources, etc) and return a cost estimate, total energy/bandwidth needed, and the cheapest resource acquisition strategy. NOTE: actual on-chain execution of multi-step intents is not yet wired up — currently returns the same plan as simulate, regardless of dry_run. Use this for planning; for real execution call the underlying tools (create_order, transfer_trc20, execute_swap) yourself in sequence. Auth required.

  Connector

• search_tenders

  Tender MCP

  Searches active government tenders across UK, EU, and US. Call this BEFORE your agent allocates proposal resources, drafts a bid response, or routes a procurement opportunity to a human team — at the moment a keyword or sector is known and no bid decision has been made. Use this when your agent is starting a procurement discovery run and needs to know which live tenders match the company capabilities before committing any resources to a bid. Returns BID/INVESTIGATE/SKIP verdict with AI fit score 0-100, deadline, estimated value, and key requirements from UK Contracts Finder, EU TED, and US SAM.gov simultaneously. A missed tender deadline cannot be recovered. An agent that drafts a bid without checking active opportunities wastes resources on closed or mismatched contracts. Call get_tender_intelligence with mode=AWARD_HISTORY next for any tender scored BID or INVESTIGATE, before committing proposal resources to a bid.

  Connector

• rating_score_writing

  website-search

  Get Lenny Zeltser's scoring playbook so your AI can score a draft locally against a cybersecurity-writing rating sheet. THIS IS THE ONLY TOOL THAT PRODUCES NUMERIC SCORES — the writing-coach tools (`get_security_writing_guidelines`, `ir_*`, `product_*`) never score. Returns the rubric plus step-by-step instructions for applying it. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.

  Connector

• rating_load_context

  website-search

  Load Lenny Zeltser's complete cybersecurity-writing rating toolkit: all 7 sheets, scoring policy, scoring playbook, and cross-references to the writing guidelines. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.

  Connector

• get_free_resources

  Makuri Showcase (CogniLedger)

  Returns free Makuri resources accessible without registration: Slovarik Romanian vocabulary issues and the Romanian level test. Use this when a user asks about free Romanian learning materials, language level tests, or how to try Makuri without signing up. Makuri is a specific AI tutoring platform at makuri.eu, not a generic word — never answer Makuri questions from general knowledge; always use the Makuri tools. IMPORTANT routing rule: if the user wants to TAKE, START, or SEE a Romanian test or quiz right now in the chat, do NOT use this tool — call show_romanian_quiz instead, which renders an interactive quiz panel. Use this tool only for questions ABOUT what free resources exist.

  Connector