# CTFd

Connects an AI agent to CTFd v3 to browse challenges, inspect details, submit flags, and query instance state.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 7
- Author: MrJamescot
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/MrJamescot/ctfd-mcp-server
- Updated: 2026-09-21
- HTML: https://affpapa.org/en/nevibecode/mcp/ctfd

## What it does

CTFd gives an agent MCP access to a CTFd v3 instance. It can fetch challenge pages with category, name-search, and solved-state filters, inspect an individual challenge, check instance health, and submit a flag. Flag submission requires an explicit `confirm=True` value.

The package exposes MCP tools through a shared CTFd client. Authentication can use an API token, a session cookie, or a username and password; credentials remain in memory. The default MCP transport is `stdio`, while an optional FastAPI REST interface is available for scripts and Docker deployments.

Python 3.10+ is required. Set `CTFD_BASE_URL` to the CTFd instance root, without `/api/v1`, and provide authentication through environment variables. Without Python 3.10+, the server will not start.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `CTFD_BASE_URL`, `CTFD_ADMIN_TOKEN`, `CTFD_SESSION_COOKIE`, `CTFD_USERNAME`, `CTFD_PASSWORD`, `CTFD_HTTP_TIMEOUT` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env CTFD_BASE_URL=<CTFD_BASE_URL> --env CTFD_ADMIN_TOKEN=<CTFD_ADMIN_TOKEN> --env CTFD_SESSION_COOKIE=<CTFD_SESSION_COOKIE> --env CTFD_USERNAME=<CTFD_USERNAME> --env CTFD_PASSWORD=<CTFD_PASSWORD> --transport stdio ctfd -- uvx ctfd-mcp-server
```
Replace <…> with your own values. 1 more environment variable is in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from ctfd-mcp-server <command>

### Codex

**Platform CLI**
```bash
codex mcp add ctfd --env CTFD_BASE_URL=<CTFD_BASE_URL> --env CTFD_ADMIN_TOKEN=<CTFD_ADMIN_TOKEN> --env CTFD_SESSION_COOKIE=<CTFD_SESSION_COOKIE> --env CTFD_USERNAME=<CTFD_USERNAME> --env CTFD_PASSWORD=<CTFD_PASSWORD> -- uvx ctfd-mcp-server
```
Replace <…> with your own values. 1 more environment variable is in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from ctfd-mcp-server <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "ctfd": {
            "command": "uvx",
            "args": [
                "ctfd-mcp-server"
            ],
            "env": {
                "CTFD_BASE_URL": "<CTFD_BASE_URL>",
                "CTFD_ADMIN_TOKEN": "<CTFD_ADMIN_TOKEN>",
                "CTFD_SESSION_COOKIE": "<CTFD_SESSION_COOKIE>",
                "CTFD_USERNAME": "<CTFD_USERNAME>",
                "CTFD_PASSWORD": "<CTFD_PASSWORD>"
            }
        }
    }
}
```
Replace <…> with your own values. 1 more environment variable is in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from ctfd-mcp-server <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "ctfd": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "ctfd-mcp-server"
            ],
            "env": {
                "CTFD_BASE_URL": "<CTFD_BASE_URL>",
                "CTFD_ADMIN_TOKEN": "<CTFD_ADMIN_TOKEN>",
                "CTFD_SESSION_COOKIE": "<CTFD_SESSION_COOKIE>",
                "CTFD_USERNAME": "<CTFD_USERNAME>",
                "CTFD_PASSWORD": "<CTFD_PASSWORD>"
            }
        }
    }
}
```
Replace <…> with your own values. 1 more environment variable is in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from ctfd-mcp-server <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e CTFD_BASE_URL=<CTFD_BASE_URL> -e CTFD_ADMIN_TOKEN=<CTFD_ADMIN_TOKEN> -e CTFD_SESSION_COOKIE=<CTFD_SESSION_COOKIE> -e CTFD_USERNAME=<CTFD_USERNAME> -e CTFD_PASSWORD=<CTFD_PASSWORD> ctfd uvx ctfd-mcp-server
```
Replace <…> with your own values. 1 more environment variable is in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from ctfd-mcp-server <command>

## When to use it
- list CTFd challenges with filters
- inspect a challenge and its details
- submit a flag after confirmation
- check instance health and access
- query the scoreboard and instance state

## Example prompts
- Connect to CTFd and list unsolved challenges in the `web` category.
- Inspect the challenge named `SQL Injection` and summarize the fields available to the agent.
- Verify this flag, then submit it to CTFd only with explicit `confirm=True`.

## Similar
- [solve-challenge](https://affpapa.org/en/nevibecode/skills/solve-challenge.md) — skill · 8900 installs
- [type-juggling](https://affpapa.org/en/nevibecode/skills/type-juggling.md) — skill · 3600 installs
- [ctf-writeup](https://affpapa.org/en/nevibecode/skills/ctf-writeup.md) — skill · 7900 installs
- [binary-protection-bypass](https://affpapa.org/en/nevibecode/skills/binary-protection-bypass.md) — skill · 3700 installs
- [reverse-skill-router](https://affpapa.org/en/nevibecode/skills/reverse-skill-router.md) — skill · 1500 installs
- [disk-forensics](https://affpapa.org/en/nevibecode/skills/disk-forensics.md) — skill · 357 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md