Model Context Protocol (MCP) server for interacting with CTFd instances - authenticate, retrieve challenges, submit flags
Ctfd MCP server is a locally run integration for AI assistants that speak the Model Context Protocol. Model Context Protocol (MCP) server for interacting with CTFd instances - authenticate, retrieve challenges, submit flags.
A lightweight and extensible Model Context Protocol (MCP) server for interacting with any CTFd instance. This project enables AI tools and automation to authenticate, retrieve challenges, and submit flags through MCP tools.
This project acts as a bridge between CTFd and AI-driven systems by providing a unified interface. It supports multiple authentication modes, dynamic base URL control, and direct MCP tool integration.
You will need 2 environment variables: BASE_URL, CTFD_TOKEN. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
ctfd-mcp-server on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.
Among the developer tooling options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. It is maintained by tomek7667; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
{
"mcpServers": {
"ctfd": {
"command": "npx",
"args": ["-y", "ctfd-mcp-server"],
"env": {
"BASE_URL": "https://demo.ctfd.io",
"CTFD_TOKEN": "<your ctfd api token>"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| BASE_URL | Endpoint or connection string the server talks to. | Yes |
| CTFD_TOKEN | Credential the server authenticates with. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.