EZ XBow Challenge

You run an AI-powered MCP server for CTF-style challenges. This server exposes a complete API so your agent can list challenges, attempt solutions, access knowledge docs, and persist work across sessions in a secure, isolated environment.

How to use

Start by launching the MCP server in either mock mode for local testing or against a real platform. In mock mode, you simulate challenges and validate your workflow locally. In real mode, you connect to your live platform using your authentication token and streamable mode for real-time results.

Once the server is running, you can interact through your MCP client to access features such as listing current challenges, marking a challenge as in progress, retrieving hints (with score deductions), submitting flags, and writing notes to capture discoveries for future sessions.

How to install

# Prerequisites
# - Go 1.24.7 or newer
# - Docker with buildx support

# Build the MCP server
go build -o xbow-mcp ./cmd/main.go

Configuration and usage notes

There are two primary ways to run the server depending on your testing or deployment needs:

Mock mode lets you run a self-contained MCP server that serves challenges from a local directory. This is ideal for development and validating your agent workflow without connecting to a real platform.

Real mode connects to your actual XBow platform using a base URL and an authentication token. This enables real scoring and interaction with live challenges.

Running in mock mode

Use the mock flag to start the server on your local machine. This starts an in-memory simulation of the platform and serves on the specified address.

./xbow-mcp --mock  -listen 127.0.0.1:8080

Running against a real platform

Provide the base URL of your XBow platform and your authentication token. Use streamable mode for continuous data flow and specify the listening address for the MCP server.

./xbow-mcp \
  -xbow-url https://your-xbow-platform.com \
  -xbow-token YOUR_AUTH_TOKEN \
  -mode streamable \
  -listen 127.0.0.1:8080

Local storage and persistence

The server saves per-challenge attempts and notes under the local storage paths. This helps you track progress across sessions and reuse observations when you revisit challenges.

Note the following local storage locations for reference:

-  .challenge_history/{challenge_code}/  — attempt metadata, notes, and history
-  .kail-history/  — command execution logs from the persistent Kali container

Available tools

list_challenges

Retrieve current stage challenges with difficulty and target information to plan your attempts.

do_challenge

Mark a challenge as in progress and increment the attempt counter to track your experimentation.

get_challenge_hint

Fetch the hint for a challenge; resolving hints may affect scoring.

submit_answer

Submit your solution flags and receive scoring feedback from the platform.

get_ctf_skill

Access technical documentation covering XSS, SQLi, SSTI, SSRF, IDOR, XXE, LFI, code execution, and related topics.

write_challenge_note

Save discoveries and attempts for future reference across sessions.

read_challenge_note

View historical notes; notes may reset after every nine attempts.

kail_terminal

Run commands inside the persistent Kali container for safe testing.

get_terminal_history

Retrieve command execution history by ID from the persistent container.