CTFs come and go weekly, and the base URL, the token and the cookie can all be set from inside the session — so joining a new event does not mean restarting a client. The read side is the useful half: challenges and progress in the same place as the work.
A client for any CTFd instance. It authenticates three ways, lists and opens challenges, submits flags, and reports where you stand — with the target instance set at runtime rather than baked in.
- The base URL set from inside the session, so one install works across events
- Three ways in: an API token, a session cookie, or a plain username and password login
- Challenges listed, optionally narrowed to one category, and any of them opened by name or by ID
- Flags submitted against a challenge identified either way
- The scoreboard, and your own solves and progress
- A health check on the connection, for when something stops answering mid-event
Node, run over stdio from npm as ctfd-mcp-server through npx or a global install. Point it at a CTFd instance with BASE_URL and give it a credential — CTFD_TOKEN in the environment, or a cookie or username and password supplied in the session. It is validated against the official demo instance at https://demo.ctfd.io.
One command plus a key — npx ctfd-mcp-server, then supply credentials