"Resources and tools for difficult CTF (Capture The Flag) cybersecurity challenges" matching MCP tools:

• fetchA

  A-du: ADU rentals, plans and rulesA

  Fetch the full content for one id returned by `search`: a rental listing (rental:<uuid>), a plan set (plan:<uuid>) or a published page (page:<route>). Returns {id, title, text, url, metadata}. Always cite the url. Hosts that can call specific tools should prefer get_rental or the resources.

  ConnectorNo auth

• test_regexA

  mcpA

  Use this when you need the true matches of a JavaScript regular expression rather than predicting regex behavior yourself, which is easy to get wrong. Deterministic: same input, same output. Returns every match with its index, length, matched text, positional capture groups (null for a group that didn't participate), and named groups (an object, or null when the pattern has none). Without the g flag only the first match is returned; with g all matches are collected, capped at 10,000 with truncated=true. Inputs are length-bounded (pattern 2,000 chars, text 50,000 chars) as a ReDoS guard. Example: pattern (?<y>\d{4})-(?<m>\d{2}) over "2024-01" with flag g -> matchCount 1, match "2024-01", groups ["2024","01"], named {y:"2024",m:"01"}.

  ConnectorNo auth

• noaa_get_station_infoA

  NOAA Tides and CurrentsA

  Get a NOAA station's full metadata record: location, state, time zone, tide type, Great Lakes flag, capability flags, and links to available sub-resources. Optionally expand sub-resources inline via the "expand" list: - details (established/removed dates), sensors (installed instruments + elevations), floodlevels (NOS/NWS minor/moderate/major flood thresholds), benchmarks, products (available data page links), notices, disclaimers — for water-level stations - bins (ADCP depth bins), deployments — for current stations (alphanumeric IDs) Use this before requesting data to confirm what the station actually collects. For datum values use noaa_get_station_datums; for harmonic constituents use noaa_get_harmonic_constituents.

  ConnectorNo auth

• hemelion_choose_reflection_modeA

  Hemelion Decision and Pattern ReflectionA

  Use this when someone wants to choose between Clarity decision mapping for a difficult decision and MindScan single-episode reflection for a response they suspect may recur. Returns a no-charge reflection mode, a clarifying question, or a safety boundary. Do not use for diagnosis, emergencies, or legal, medical, financial, hiring, or insurance decisions.

  ConnectorNo auth

• list_topicsA

  bill-commonsA

  List Bill Commons' curated cross-state topic trackers (e.g. artificial intelligence, youth online safety, platform accountability, cybersecurity, cryptocurrency, data privacy, local government & preemption) -- the entry point for "what subjects does Bill Commons track across all 50 states + DC" and "how do I get every bill in one". Each topic is a title/subject membership rule tuned for precision over recall, with a live bill_count and how_to_fetch_bills. This tool does not itself return bill rows -- pair it with search_legislation or the REST API's /topics/{slug} for the bills.

  ConnectorNo auth

• propfirms_searchA

  luxalgo-mcp-serverA

  Search LuxAlgo's prop-firm catalog (proprietary trading firms offering funded accounts). Combine firm filters (platforms, markets, payment/payout methods, country availability, Trustpilot, year founded) with nested challenge filters (account size, price, steps, profit split, trading rules) and offer filters — a firm matches when at least one of its challenges/offers matches all of them. Omit every filter to list all firms. Use include to nest the matching challenges, live offers, and the written overview; for one firm's full dossier prefer propfirms_get. Uncaptured (null) fields are omitted from results; nested challenges reference offers via offerIds into the firm-level offers list. This tool returns directory data (what exists and on what terms), not outcomes: for simulated pass odds on a challenge found here, use propfirms_pass_rates or propfirms_simulate with its firm and challenge ids.

  ConnectorNo auth

• propfirms_search_challengesA

  luxalgo-mcp-serverA

  Search funded-account challenges across all visible prop firms. Filter by challenge rules (account size, fee, steps, profit split, drawdown mode, news/copy/auto trading, weekend holding, …) and by parent-firm properties. Pass propfirmId to list one firm's challenges, or challengeId to fetch specific ones. include=['offers'] returns a deduplicated top-level offers list, with each challenge referencing its applicable offers via offerIds (firm-wide offers included). Uncaptured (null) rule fields are omitted from results and never match filters. This returns each challenge's listed rules and terms, not outcomes: to simulate a challenge found here pass its ids to propfirms_simulate or propfirms_pass_rates, and to screen one strategy across many challenges at once use propfirms_validate_strategy.

  ConnectorNo auth

• get_meA

  Extend MCPA

  Return the connected organization, the credential in use, and the granted workspace + environment ("TEST" or "PRODUCTION") targets — exactly the values the required workspaceId/environment arguments on targeted tools accept. Always available; call this first, and again whenever a tool returns UNAUTHORIZED or NOT_FOUND unexpectedly, or after this connection's access changes — resources live per-workspace.

  ConnectorOAuth

• get_revenueA

  AI Agent AnalyticsA

  Return settled-revenue intelligence for product_id over a trailing days window. Use this for actual settled commerce; do not use it for a headline daily snapshot, use get_daily_pulse, or for a complete bounded-window funnel, use get_report. days defaults to 30 and includes the current partial UTC day plus the preceding 29 days. Requires analytics:read; challenges and attempts are not revenue, settlement remains distinct from delivery, unlike money is never combined, and the shared MCP limit is 300 calls per 60 seconds per caller before HTTP 429 with Retry-After.

  ConnectorNo auth

• brain_list_canonical_identitiesA

  personalbrain-mcpB

  Return canonical (tool_id, mcp_name, …) for every tool the wheel exposes. The authoritative source for any client (Studio, agents, FE) that needs to know how this MCP identifies its tools. Reconcile uses this output to UUID-join against the stored pricing model — no name-based UUID derivation, no guessing. Includes both ToolIdentity-seeded tools and any UUID recorded by ``@paid_tool`` that is missing from the registry. The latter appear with ``registered: false`` (and in the top-level ``unregistered`` array) so Reconcile can flag deploy drift instead of silently reporting clean when a live tool was never seeded (#174). If the operator renames a function or rebrands a slug, the mcp_name in this output changes but tool_id stays. That's the whole point of the canonical-UUID design. Also diffs the live FastMCP wire surface against the registry. Tools exposed on the wire but absent from the registry appear in ``unregistered`` so Reconcile can flag deploy drift instead of silently under-reporting (issue #175). Free, no side effects.

  ConnectorNo auth

• get_free_resourcesA

  Makuri Showcase (CogniLedger)A

  Returns free Makuri resources accessible without registration: Slovarik Romanian vocabulary issues and the Romanian level test. Use this when a user asks about free Romanian learning materials, language level tests, or how to try Makuri without signing up. Makuri is a specific AI tutoring platform at makuri.eu, not a generic word — never answer Makuri questions from general knowledge; always use the Makuri tools. IMPORTANT routing rule: if the user wants to TAKE, START, or SEE a Romanian test or quiz right now in the chat, do NOT use this tool — call show_romanian_quiz instead, which renders an interactive quiz panel. Use this tool only for questions ABOUT what free resources exist.

  ConnectorNo auth

• excalibur_list_canonical_identitiesA

  excalibur-mcpB

  Return canonical (tool_id, mcp_name, …) for every tool the wheel exposes. The authoritative source for any client (Studio, agents, FE) that needs to know how this MCP identifies its tools. Reconcile uses this output to UUID-join against the stored pricing model — no name-based UUID derivation, no guessing. Includes both ToolIdentity-seeded tools and any UUID recorded by ``@paid_tool`` that is missing from the registry. The latter appear with ``registered: false`` (and in the top-level ``unregistered`` array) so Reconcile can flag deploy drift instead of silently reporting clean when a live tool was never seeded (#174). If the operator renames a function or rebrands a slug, the mcp_name in this output changes but tool_id stays. That's the whole point of the canonical-UUID design. Also diffs the live FastMCP wire surface against the registry. Tools exposed on the wire but absent from the registry appear in ``unregistered`` so Reconcile can flag deploy drift instead of silently under-reporting (issue #175). Free, no side effects.

  ConnectorNo auth

• schwab_list_canonical_identitiesA

  schwab-mcpA

  Return canonical (tool_id, mcp_name, …) for every tool the wheel exposes. The authoritative source for any client (Studio, agents, FE) that needs to know how this MCP identifies its tools. Reconcile uses this output to UUID-join against the stored pricing model — no name-based UUID derivation, no guessing. Includes both ToolIdentity-seeded tools and any UUID recorded by ``@paid_tool`` that is missing from the registry. The latter appear with ``registered: false`` (and in the top-level ``unregistered`` array) so Reconcile can flag deploy drift instead of silently reporting clean when a live tool was never seeded (#174). If the operator renames a function or rebrands a slug, the mcp_name in this output changes but tool_id stays. That's the whole point of the canonical-UUID design. Also diffs the live FastMCP wire surface against the registry. Tools exposed on the wire but absent from the registry appear in ``unregistered`` so Reconcile can flag deploy drift instead of silently under-reporting (issue #175). Free, no side effects.

  ConnectorNo auth

• read_webhook_captureA

  AI SENSE Free Public ToolsA

  Check whether anything has been sent to a capture URL yet, and read it. The status field is pending or captured. Pending is the ordinary answer before the sender fires and is not a failure. Set wait_seconds from 1 to 25 to wait efficiently for the first request. The call returns early when the capture changes. Zero reads the current state immediately. Unknown and expired IDs fail. No API key, no account and no sign up: call it directly.

  ConnectorNo auth

• unflag_emailA

  Mailbox MCPA

  Clear the flag/star marker on messages, restoring their unflagged state. Pass the whole set in ONE call. BE MORE CAREFUL WITH THIS ONE THAN WITH mark_unread: a flag is to-do state the person set by hand, one message at a time, and clearing it destroys a decision rather than a side effect - there is nothing to restore it from except their memory of what they had flagged. Clear the ones you were asked about and no others, and check the set first if the request was vague. Verified the same way the other flag tools are: the flags are read back off the server, so a message that could not be changed is named rather than assumed done. A uid only means something in the folder it came from, so pass `mailbox` when the uids did not come from INBOX. Clearing a flag that is not set changes nothing and is not an error.

  ConnectorOAuth

• asterwise_get_numerology_compatibilityA

  AsterwiseA

  Compares two people on Pythagorean Life Path numbers derived from their names and birth dates and returns a score, tier label, narrative, strengths, challenges, and advice. WORKFLOW: BEFORE: RECOMMENDED — asterwise_get_numerology_profile per person — sanity-check Life Paths before comparing. AFTER: None. INPUT CONTRACT: Four strings (two names, two dates) are passed through without local guards. DO NOT CONFUSE WITH: asterwise_get_compatibility — sidereal koota scoring, not numerology integers. asterwise_get_numerology_profile — single-person profile, not dyad scoring. Full output and error contract: https://docs.asterwise.com/mcp/tools/get-numerology-compatibility/

  ConnectorOAuth

• rating_get_sheetA

  website-searchA

  Get Lenny Zeltser's cybersecurity-writing rating sheet(s) so your AI can apply the rubric. Returns the structured rubric (groups, items, scoring bands) WITHOUT computing a score. Use `rating_score_writing` if you also want a numeric score, gap analysis, or rubric-anchored feedback. This server never requests your draft and instructs your AI to keep it local—rating sheets and scoring instructions flow to your AI.

  ConnectorNo auth

• evaluate_scriptA

  kernelcadA

  Use this when you need to run a script and check it compiles. Run a kernelCAD .kcad.ts script and report pass/fail + feature count + diagnostics. When the scene is assembly-built (assembly().part(...) → .model()/.solvedModel()), also returns a parts summary { count, names } AND runs the mechanism-truth gate by default: the `mechanism` field reports real/broken/unverified and a broken mechanism (self-collision, fastened drift, dof-mismatch) makes ok:false with the failures in diagnostics. Pass { skipMechanismCheck: true } to opt out. Pass either { file: "<path>" } or { code: "<inline source>" }. Set { dryRun: true } for fast validation while iterating: transpile + capture + capture-light checks WITHOUT OCCT lowering, DFM gates, or meshing — milliseconds instead of seconds (100x+ on boolean/fillet-heavy scripts). A dry run catches script throws, capture-time API misuse, and assembly validity-gate failures, but NOT lowering failures or dfmSpec diagnostics; it leaves the active session untouched, so finish with a full (non-dry) evaluate_script before using session-dependent tools.

  ConnectorNo auth

• authority_list_canonical_identitiesA

  tollbooth-authority-newenglandA

  Return canonical (tool_id, mcp_name, …) for every tool the wheel exposes. The authoritative source for any client (Studio, agents, FE) that needs to know how this MCP identifies its tools. Reconcile uses this output to UUID-join against the stored pricing model — no name-based UUID derivation, no guessing. Includes both ToolIdentity-seeded tools and any UUID recorded by ``@paid_tool`` that is missing from the registry. The latter appear with ``registered: false`` (and in the top-level ``unregistered`` array) so Reconcile can flag deploy drift instead of silently reporting clean when a live tool was never seeded (#174). If the operator renames a function or rebrands a slug, the mcp_name in this output changes but tool_id stays. That's the whole point of the canonical-UUID design. Also diffs the live FastMCP wire surface against the registry. Tools exposed on the wire but absent from the registry appear in ``unregistered`` so Reconcile can flag deploy drift instead of silently under-reporting (issue #175). Free, no side effects.

  ConnectorNo auth

• authority_list_canonical_identitiesA

  tollbooth-authority-northamericaB

  Return canonical (tool_id, mcp_name, …) for every tool the wheel exposes. The authoritative source for any client (Studio, agents, FE) that needs to know how this MCP identifies its tools. Reconcile uses this output to UUID-join against the stored pricing model — no name-based UUID derivation, no guessing. Includes both ToolIdentity-seeded tools and any UUID recorded by ``@paid_tool`` that is missing from the registry. The latter appear with ``registered: false`` (and in the top-level ``unregistered`` array) so Reconcile can flag deploy drift instead of silently reporting clean when a live tool was never seeded (#174). If the operator renames a function or rebrands a slug, the mcp_name in this output changes but tool_id stays. That's the whole point of the canonical-UUID design. Also diffs the live FastMCP wire surface against the registry. Tools exposed on the wire but absent from the registry appear in ``unregistered`` so Reconcile can flag deploy drift instead of silently under-reporting (issue #175). Free, no side effects.

  ConnectorNo auth

• authority_list_canonical_identitiesA

  tollbooth-authorityB

  Return canonical (tool_id, mcp_name, …) for every tool the wheel exposes. The authoritative source for any client (Studio, agents, FE) that needs to know how this MCP identifies its tools. Reconcile uses this output to UUID-join against the stored pricing model — no name-based UUID derivation, no guessing. Includes both ToolIdentity-seeded tools and any UUID recorded by ``@paid_tool`` that is missing from the registry. The latter appear with ``registered: false`` (and in the top-level ``unregistered`` array) so Reconcile can flag deploy drift instead of silently reporting clean when a live tool was never seeded (#174). If the operator renames a function or rebrands a slug, the mcp_name in this output changes but tool_id stays. That's the whole point of the canonical-UUID design. Also diffs the live FastMCP wire surface against the registry. Tools exposed on the wire but absent from the registry appear in ``unregistered`` so Reconcile can flag deploy drift instead of silently under-reporting (issue #175). Free, no side effects.

  ConnectorNo auth