ModelsAtlas
Explore
Atlas / MCP servers / foxibu / CTF Solver

CTF SolverBLOCK

mcp/foxibu/ctf-solver
MCP server by foxibu · Audited 2026-10-08
⚑ Report / re-scanSource ↗
Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
52 43r · 9w · 0d
Transport
stdio · streamable-http
License
NOASSERTION
Stars
64
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

AI-Powered Offensive Security Toolkit

Bridge your AI assistant to 55+ Kali Linux security tools via Model Context Protocol

[](https://opensource.org/licenses/MIT) [](https://www.python.org/downloads/) [](#-docker-deployment) [](KALITOOLSINSTALLATION.md) [](#-ctf-categories-supported) [](https://smithery.ai/server/@atimevil/mcp-kali-server)

Features • Quick Start • Documentation • Architecture • Legal

Language: English | 한국어

📖 Overview

MCP Kali Server transforms your AI assistant into a powerful offensive security companion by providing seamless access to professional penetration testing and CTF-solving tools from Kali Linux.

Built on the Model Context Protocol (MCP), this server enables AI assistants like Claude, ChatGPT, and others to orchestrate complex security workflows, automate CTF challenge solving, and perform intelligent penetration testing through natural language.

🎯 What Can It Do?

You: "I found an RSA challenge with n=12345..., e=65537. Can you decrypt it?"

AI: *Automatically queries FactorDB → runs RsaCtfTool → decrypts ciphertext → extracts flag*
"Flag found: CTF{...}"
You: "Scan this web app for vulnerabilities: http://target.com"

AI: *Runs nmap → gobuster → nikto → sqlmap → provides comprehensive security report*

✨ Features

🎓 7 Major CTF Categories Supported

Read from source at commit c2357235cc61OBSERVED · 2026-10-08
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add my_server -- uvx my_server
claude-desktop
{
  "mcpServers": {
    "my_server": {
      "command": "uvx",
      "args": [
        "my_server"
      ]
    }
  }
}
03

Exposed tools (52)

43 read · 9 write · 0 destructive.

ToolRiskDescription
analyze_with_radare2read
auto_detect_vulnerabilitiesread
auto_disk_analysisread
auto_malware_huntread
auto_memory_analysisread
aws_enumerateread
binwalk_analyzeread
checksec_binaryread
close_shellread
cloud_metadata_queryread
create_analysis_sessionwrite
dirb_scanread
disassemble_binaryread
enum4linux_scanread
execute_commandwrite
exiftool_analyzeread
extract_stringsread
factordb_queryread
find_rop_gadgetsread
foremost_carveread
gobuster_scanread
hashcat_crackread
hydra_attackread
john_crackread
list_session_filesread
load_analysis_resultsread
metasploit_runwrite
mythril_analyzeread
nikto_scanread
nmap_scanread
openssl_operationread
pacu_aws_exploitread
read_shell_outputread
rsa_attackread
run_pwntools_exploitwrite
s3_bucket_scanread
sage_executewrite
save_analysis_resultwrite
send_to_shellwrite
server_healthread
slither_analyzeread
solidity_compileread
sqlmap_scanread
start_interactive_shellwrite
steghide_extractread
tesseract_ocrread
trace_library_callsread
trace_syscallsread
upload_binarywrite
volatility_analyzeread
web3_interactread
wpscan_analyzeread
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (4 observation(s))
Network
declared (9 observation(s))
Shell
declared (1 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (12)

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
kali_server.py:1921
base_url = "http://169.254.169.254/latest/meta-data/"
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
kali_server.py:1923
base_url = "http://metadata.google.internal/computeMetadata/v1/"
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
kali_server.py:1925
base_url = "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CLAUDE.md:143
# Server runs on http://0.0.0.0:5000
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CLAUDE.md:447
nikto_scan(target="http://192.168.1.10")
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CLAUDE.md:451
url="http://192.168.1.10",
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CLAUDE.md:459
url="http://192.168.1.10",
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CLAUDE.md:465
url="http://192.168.1.10/login.php",
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
kali_server.py:763
content = base64.b64decode(content_base64)
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
CTF_ENHANCEMENT.md:107
@app.route("/api/session/create", methods=["POST"])
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
CTF_ENHANCEMENT.md:113
@app.route("/api/session/<session_id>/context", methods=["GET", "POST"])
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
KALI_TOOLS_INSTALLATION.md:420
curl -L https://foundry.paradigm.xyz | bash

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha c2357235cc61full audit observations/trust-audit/mcp-server/foxibu__ctf-solver.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-08c2357235cc61BLOCKD69first audit
06

Questions

What tools does CTF Solver expose?

52 in total: 43 read-only, 9 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is CTF Solver safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does CTF Solver need?

No credential environment variables were found in its source, so it appears to need none.

How does CTF Solver run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as my_server.

How current is this page?

The grade is for one exact copy of the source (c2357235cc61), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement