MCP.Market

CTFd MCP server

by MrJamescot·io.github.MrJamescot/ctfd-mcp-server·v1.0.4·7 stars
No reviews yet

MCP server for CTFd v3: list challenges, submit flags, and query scoreboards via AI agents.

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Growing

7 stars68 downloads/wk

Reviews

Write one

Nobody has reviewed CTFd yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

CTFd tools (14, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • auth_status

    Report whether the current session is authenticated and which auth mode is active.

  • challenge

    Get the full detail of a single challenge by numeric id or name.

  • challenges

    List challenges with optional filters and pagination.

  • download_file

    Download a challenge attachment to the local machine.

  • health

    Perform a health check: CTFd reachability, API status and authentication state.

  • instance_info

    Return safe, public metadata about the configured CTFd instance.

  • login

    Log in to CTFd with a username and password (kept in memory only).

  • progress

    Return the authenticated user's progress (score and solved challenges).

  • scoreboard

    Return the public CTFd scoreboard (top standings).

  • set_base_url

    Configure the CTFd instance this server talks to.

  • set_cookie

    Use a session cookie for authentication (memory only, never logged).

  • set_token

    Use an API token for authentication (stored in memory only, never logged).

  • submit_flagwrite action

    Submit a flag for a challenge.

  • unlock_hint

    Unlock a challenge hint and return its content.

Public scan report

scanner v0.1.10 · 2026-10-16 · same rubric, same numbers if you re-run it

no findings
  • Code scan14 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 25 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How CTFd compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 65% of 48,243 servers
Tools
14
the typical server has 7
Tools that change things
7%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
7
more than 86% of 28,706 servers
Downloads a week
68
more than 52% of 12,306 servers with a package

What its tools let an agent do: 10 read · 4 change

Release history: 2 versions in the registry since 2026-09-20, latest 2026-09-21, typically one every 1 day.

Install CTFd in Claude Code, Cursor or VS Code

claude mcp add ctfd-mcp-server -- uvx ctfd-mcp-server
Add to Cursor

What the publisher says

From the CTFd repository's README, as published. We do not edit it. Read it on GitHub

CTFd MCP Server

<!-- mcp-name: io.github.MrJamescot/ctfd-mcp-server -->

A Model Context Protocol (MCP) server for interacting with any CTFd v3 instance. It lets AI tools (Claude Desktop, Cursor, custom agents, ...) authenticate, list and inspect challenges, submit flags, and query instance state through a stable, type-safe interface.

The project ships two interfaces built on the same client library:

debugging, and Docker deployments.

  • MCP tools (primary) — ctfdmcpserver.py, used over stdio or sse.
  • REST API (optional) — server/main.py, a FastAPI mirror for scripting,
┌──────────────────────────────────────────────┐
 AI agent / MCP  │            FastMCP (MCP tools)               │
 client ────────►│  set_token · login · challenges · submit_flag │
                 └──────────────────┬───────────────────────────┘
                                    │  shared client
                 ┌──────────────────▼───────────────────────────┐
 curl / scripts ─►│  FastAPI REST (/api/v1/...)  (optional)      │
                 └──────────────────┬───────────────────────────┘
                                    │
                 ┌──────────────────▼───────────────────────────┐
                 │   server.ctfd_client.CTFdClient               │
                 │   └─ gateway.py  (HTTP, auth, timeouts)       │
                 └──────────────────┬───────────────────────────┘
                                    │ HTTPS / HTTP
                              ┌─────▼─────┐
                              │   CTFd    │
                              └───────────┘

Credentials (token / cookie / password) live in memory only and are never echoed in tool output, written to server_state.json, or logged.

Features

form login (with CSRF handling).

  • Multiple authentication modes — API token, session cookie, or username/password

and solved/unsolved filters, plus per-challenge detail retrieval.

  • Rich challenge queries — paginated listing with category, search (name),

success/failure, and surfaces rate-limit errors. Flags are never logged.

  • Safe flag submission — requires an explicit confirm=True, returns clear

authentication-status tool that reveal no secrets.

  • Instance introspection — public instance info, health check, and an

ChallengeNotFoundError, SubmissionError, ValidationError, ConfigurationError.

  • Consistent structured errors — AuthenticationError, CTFdAPIError,

full-dump downloads.

  • Pagination by default — one page of challenges per call; no accidental

no retries for POSTs (no duplicate submissions), strict JSON/content parsing.

  • Hardened HTTP — configurable timeouts, one safe retry for idempotent GETs,

and at runtime.

  • REST + MCP from one codebase — identical behaviour on both interfaces.
  • No hardcoded instance — BASE_URL is validated and configurable at startup

Installation

Requires Python 3.10+.

The fastest way is to install from PyPI:

pip install ctfd-mcp-server

# MCP stdio server with env config:
CTFD_BASE_URL=https://ctf.example.com CTFD_ADMIN_TOKEN=ctfd_... ctfd-mcp

# optional REST interface:
ctfd-rest

For MCP clients, point your config at the packaged entry point:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

CTFd: common questions

Is CTFd MCP server safe?
Mostly: it is graded B (83/100). Read the CTFd safety report
How do I install CTFd?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does CTFd need an API key?
Yes. The registry entry asks for CTFD_ADMIN_TOKEN, CTFD_SESSION_COOKIE, CTFD_PASSWORD.
Is CTFd maintained?
The last commit was 46 days ago (2026-09-21). The latest release is v1.0.4.
How does CTFd compare with other MCP servers?
safety score 83/100 (higher than 65% of 48,243 servers); tools 14 (the typical server has 7); tools that change things 7% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.