Skip to main content

Model Context Protocol for CTF

Diablo avatar
Written by Diablo
Updated this week

🔐 MCP Token Generation and Access Control

📘 Overview

MCP (Model Context Protocol) is a protocol that bridges AI tools with the Hack The Box CTF platform, allowing users to interact with challenges and events via tools like Claude or Visual Studio Code.

🤖 What is MCP?

MCP (Model Context Protocol) is a powerful bridge between AI models and APIs, developed by Anthropic. It allows direct communication between AI tools and platforms — like HTB’s CTF environment — using secure tokens.

With MCP, you can:

  • Register for CTF events from AI tools

  • Start/stop challenge containers

  • Submit flags

  • View solve stats

  • And much more!

This opens the door for hybrid AI-human collaboration and enriched learning workflows.

🧪 How It Works

Go to Your Profile

  • Navigate to: Profile Settings > MCP Access

  • Click Generate Token

⚠️ Tokens are one-time viewable. Make sure to copy and save it securely!⚠️

Token Management

  • View token expiration

  • Revoke the token at any time

Tool Integration

🖥️ Claude Desktop

Overview
Claude Desktop is Anthropic's desktop app. Since it only supports the stdio transport, it requires mcp-proxy.

📦 Prerequisites

  • Claude Desktop installed

  • A valid MCP API token

  • mcp-proxy installed (standalone or via uv)

⚙️ Setup

  1. Open Claude Desktop Settings

    • macOS: Claude menu → Settings…

    • Windows: Use the main application menu

  2. Access Developer Options

    • Go to Developer in the sidebar → Click Edit Config

  3. Open the Config File

    • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

    • Windows: %APPDATA%\Claude\claude_desktop_config.json

  4. Replace with the following (depending on your setup):

Standalone - macOS/Linux

{
  "mcpServers": {
    "htb-mcp-ctf": {
      "command": "/path/to/mcp-proxy",
      "args": [
        "https://mcp.ai.hackthebox.com/v1/ctf/sse/"
      ],
      "env": {
        "API_ACCESS_TOKEN": "<API token>"
      }
    }
  }
}

Standalone - Windows

{
  "mcpServers": {
    "htb-mcp-ctf": {
      "command": "/path/to/mcp-proxy.exe",
      "args": [
        "https://mcp.ai.hackthebox.com/v1/ctf/sse/"
      ],
      "env": {
        "API_ACCESS_TOKEN": "<API token>"
      }
    }
  }
}

Using UV

{
  "mcpServers": {
    "htb-mcp-ctf": {
      "command": "uvx",
      "args": [
        "mcp-proxy",
        "https://mcp.ai.hackthebox.com/v1/ctf/sse/"
      ],
      "env": {
        "API_ACCESS_TOKEN": "<API token>"
      }
    }
  }
}

5. Save and Restart Claude Desktop

6. Verify successful integration

  • A slider icon should appear at the bottom left corner of the window. Clicking this icon will display the list of available tools.

✅ Example Prompts

  • Which CTF events are currently running?

  • Show me the leaderboard for event HTB2025.

  • What team am I currently a member of?

🛠️ Troubleshooting

  • Ensure config file is correctly saved

  • Check token validity and proxy path

  • Restart the app fully

  • Claude Desktop's documentation offers more details on troubleshooting.

🤖 Claude Code

Overview
Claude Code is Anthropic's CLI tool for interacting with Claude AI. You can connect it directly to HTB's MCP server to participate in CTF events.

📦 Prerequisites

  • Claude Code installed on the system

  • A valid MCP API token

⚙️ Setup

claude mcp add --transport sse htb-mcp-ctf https://mcp.ai.hackthebox.com/v1/ctf/sse/ --header "Authorization: Bearer <API Token>"

⚠️ Replace <API token> with your actual MCP token from your profile.

🛠️ Troubleshooting

🧠 Visual Studio Code + GitHub Copilot

Overview
VS Code with GitHub Copilot supports MCP to connect with HTB's CTF API and provide in-editor AI-assisted functionality.

📦 Prerequisites

  • Visual Studio Code installed on the system

  • GitHub Copilot extension installed and activated

  • GitHub Copilot Chat extension installed.

  • A valid MCP API token

⚙️ Setup

  1. Open Command Palette (⇧⌘P or View > Command Palette)

  2. Search MCP → Select MCP: Add Server

  3. Choose HTTP (Server-Sent Events)

  4. Set the URL:

https://mcp.ai.hackthebox.com/v1/ctf/sse/

  1. Server ID example:

htb-mcp-ctf

  1. Choose User Settings or Workspace Settings

  2. Update the generated config to:

{
  "servers": {
    "htb-mcp-ctf": {
      "url": "https://mcp.ai.hackthebox.com/v1/ctf/sse/",
      "type": "http",
      "headers": { "Authorization": "Bearer <API token>" }
    }
  }
}

⚠️ Don’t forget to replace <API token> With your actual one.

✅ Testing the Integration

  • Open Copilot Chat (^⌘I or from the sidebar)

  • Ensure Agent is selected

  • Try: Which CTF events are currently available?

🛠️ Troubleshooting

  • Enable: Chat > MCP: Enabled In VS Code settings

  • Check for typos in the URL or token

  • Avoid trailing spaces in your token

🛠️ Supported Features via MCP

Category

Tool/Action

Description

Event Management

List CTF Events

Retrieve all available events

Retrieve CTF Details

Get detailed info about a specific event

Join CTF Event

Register a team for participation

Scoring & Analytics

Get CTF Scores

View team rankings and scores

Get All Solves

See all solves for an event

Get Team Solves

See the history of a specific team

Get Challenge Solves

View solves for a specific challenge

Team Management

Get My Teams

List all teams linked to your account

Challenge Interaction

Submit Flag

Submit a flag for validation

Get Download Link

Get a temporary signed URL for challenge files

Container Management

Start Container

Start a challenge container

Stop Container

Stop a challenge container

Container Status

Check the current status of the container

🔧 Generic Integration Instructions

You can also use any AI assistant or editor that supports Model Context Protocol (MCP) via either Server-Sent Events (SSE) or studio.

Server-Sent Events (SSE)

HTB's MCP server uses SSE transport for real-time streaming and interaction.

  • MCP SSE URL:
    ​https://mcp.ai.hackthebox.com/v1/ctf/sse/

  • HTTP Headers:
    ​Authorization: Bearer <your MCP token>

Make sure to replace <your MCP token> with your personal token from the MCP settings page.

Standard Input/Output (stdio) via Proxy

Some tools don’t support SSE directly. In such cases, you can use a proxy like mcp-proxy to bridge the gap.

Standalone Setup

  1. Set the environment variable:

    export API_ACCESS_TOKEN=<your MCP token>

  2. Run:

    /path/to/mcp-proxy https://mcp.ai.hackthebox.com/v1/ctf/sse/

⚙️ UV Setup

  1. Set the environment variable:

    export API_ACCESS_TOKEN=<your MCP token>

  2. Run:

    uvx mcp-proxy https://mcp.ai.hackthebox.com/v1/ctf/sse/

uvx is part of the uv ecosystem, a fast JavaScript/TypeScript runtime.

Related Articles
University Offerings
Welcome!
CTF User's Guide
Enterprise Certifications
Did this answer your question?