MCP CTF Server

You run a local MCP server that exposes common CTF and cybersecurity tools as commands you can call from an MCP client. It lets you explore forensics, crypto, malware analysis, stego, reverse engineering, and more inside a safe lab by routing tool calls through a controlled interface.

How to use

You connect to the MCP server from an MCP client that supports stdio configuration. The server exposes its tools as named components you can invoke with a simple tool call and optional arguments. Start the server locally, then configure your client to launch the local process and communicate via standard input/output. The server runs with the permissions of the account that starts it, so you should operate it inside a lab or sandbox you control.

Practical usage patterns you can perform:

• Start the server locally and run a sequence of forensics, crypto, or malware-analysis tasks as separate calls to the corresponding tools.
• Point the client at the local process and route each tool call with its name, arguments, and an optional working directory.
• Use the Python sandbox for quick code execution snippets that leverage common CTF libraries without leaving the lab environment.

How to install

Prerequisites you need before installing:
- A Debian or Ubuntu style system with apt
- Internet access
- sudo access
- Node.js and npm will be installed automatically by the setup process if missing

Step by step install flow you should follow:

1. Clone the project repository to your workspace
2. Make the setup script executable
3. Run the setup script to install dependencies and build the server
4. Start the server using the provided command
5. Configure your MCP client to connect via stdio to the running server

# Step 1: clone the project
git clone https://github.com/your-user/mcp-ctf-server.git
cd mcp-ctf-server

# Step 2: make the setup script executable
chmod +x setup.sh

# Step 3: run setup to install dependencies (Node.js/npm will be installed if missing)
./setup.sh

# Step 4: start the MCP server
node dist/index.js
# or, if you prefer npm start
npm start

Client configuration example

To connect your MCP client via stdio, configure it to launch the local Node.js process and pass the path to the server entry point. The example shows a typical JSON-based config you might insert into your MCP client settings.

{
  "mcpServers": {
    "mcp_ctf_server": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-ctf-server/dist/index.js"],
      "env": {}
    }
  }
}

Available tools

crypto_tools

Group of crypto-related tools including gf-complete, pari-gp, rsactftool, and gmp-utils for cryptanalysis and crypto research.

disk_forensics_tools

Disk and file forensics tools such as bulk-extractor, sleuthkit, afflib-tools, scalpel, pdfid, poppler-utils, and binutils-multiarch for image and file analysis.

traffic_forensics_tools

Network capture and traffic forensics tools including wireshark, tshark, tcpflow, tcpreplay, ngrep, dsniff, bro, and suricata.

malware_analysis_tools

Malware analysis helpers like yara, yara-rules, clamav, upx, and radare2 for static and dynamic analysis.

stego_tools

Steganography utilities such as steghide, steghide-related tools, stegcracker, qpdf, sox, mediainfo, and gifshuffle.

reverse_engineering_tools

Reverse engineering helpers including python3-capstone, python3-keystone, python3-unicorn, frida-tools, and radare2.

pwn_tools

Pwn tooling like pwntools, one-gadget, ropgadget, and seccomp-tools for exploit development and testing.

osint_tools

OSINT utilities such as exifprobe and gdal-bin for metadata and geospatial analysis.

python_ctf_sandbox

A sandbox with short Python 3 snippets and common CTF libraries installed for safe code execution.