↓Skip to main content

·1 min

MCP SERVER ARCHITECTURE #

MCP overview diagram for the post

POSSIBLE MCP ATTACKS #

  1. Tool poisoning attack

  2. Sleeper / RUGPULL attack

  3. Tool shadowing attacks

  4. Command Injection

You can combine a tool poisoning attack with a tool shadowing attack.

When tool commnets are processed by the model as model

curl -i https://ctf.arkx.ninja/level/7/mcp -H “Accept: text/event-stream” -H “Cookie: idToken=eyJraWQiOiJ2SEJzRXBRUjdpS0llOGU4TEpMbkRiZWFzalBwTUpYcG03M1VveXZQMHZzPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI5NDc4MTRjOC01MDQxLTcwMDgtNGRjNC0zZmRiN2JmMzVmNjAiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiaXNzIjoiaHR0cHM6Ly9jb2duaXRvLWlkcC51cy1lYXN0LTEuYW1hem9uYXdzLmNvbS91cy1lYXN0LTFfVXlieTJYd0pRIiwiY29nbml0bzp1c2VybmFtZSI6Ijk0NzgxNGM4LTUwNDEtNzAwOC00ZGM0LTNmZGI3YmYzNWY2MCIsImN1c3RvbTpzdGF0ZSI6Ikx1eGVtYm91cmciLCJjdXN0b206b3B0X291dCI6InRydWUiLCJjdXN0b206bmlja25hbWUiOiJuamVyaSIsImN1c3RvbTpjb21wYW55IjoiVW5pdmVyc2l0eSBvZiBMdXhlbWJvdXJnIiwib3JpZ2luX2p0aSI6ImI1YWYxNzEyLTliMGMtNDAzYi05MzJkLTc1OWRiOTJhM2IyYyIsImN1c3RvbTpmdWxsX25hbWUiOiJGbG9yZW5jZSBOamVyaSIsImF1ZCI6IjVyODF2dWc1aDRsOWZrcW00OGJsaGN0dDByIiwiZXZlbnRfaWQiOiI3YWZiY2Y4Ni1jOWZiLTQ5NWYtODgxOS04MzE1ZDBiN2UzNDIiLCJ0b2tlbl91c2UiOiJpZCIsImF1dGhfdGltZSI6MTc4MjAxODM3OSwiZXhwIjoxNzgyMTA0Nzc5LCJpYXQiOjE3ODIwMTgzNzksImp0aSI6ImM0ZDhkYjE1LTgzMzUtNGZjOC05NjU4LWZkOGJkMjg4ZmM3ZiIsImVtYWlsIjoiZmxvcmVuY2VsbmplcmlAZ21haWwuY29tIn0.QlWdy0j8q7MgZlWCf8zOTzMs81bb1ctJxoFiwEYNtj3pHivUzR55dOfKBj86pG2B9NOzMtTeR35VpqT-oe1HcyGGHYvP7wHAqagWmt04x5Ro18DJIQCJcADLnVzsXrjDZkmc1bhkP9MV0iymYCTdA_61Dus7i7ZmPx_UfmVmEMlkBSRpdTLZc6E0XbaOllupLE-tJ-EBxHlhiypys30b0crUspWb7Ce4eUUTbdAkUnH4UHGa8VwDALFkZcEzuGbJZowgOao5aNAdBx6AjIlNPfpbxOO1mM03eHDWSwd1DQyskMUwEGWjDpjWv_jDTAw0M3QvRjZ9xmbyDB1stWgo2w; accessToken=eyJraWQiOiI5S2wvUXFFbUtTSjJ6S25SV3FCUmtDQzlITUVjanZobnJ5Z08yazV4UXk4PSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI5NDc4MTRjOC01MDQxLTcwMDgtNGRjNC0zZmRiN2JmMzVmNjAiLCJpc3MiOiJodHRwczovL2NvZ25pdG8taWRwLnVzLWVhc3QtMS5hbWF6b25hd3MuY29tL3VzLWVhc3QtMV9VeWJ5Mlh3SlEiLCJjbGllbnRfaWQiOiI1cjgxdnVnNWg0bDlma3FtNDhibGhjdHQwciIsIm9yaWdpbl9qdGkiOiJiNWFmMTcxMi05YjBjLTQwM2ItOTMyZC03NTlkYjkyYTNiMmMiLCJldmVudF9pZCI6IjdhZmJjZjg2LWM5ZmItNDk1Zi04ODE5LTgzMTVkMGI3ZTM0MiIsInRva2VuX3VzZSI6ImFjY2VzcyIsInNjb3BlIjoiYXdzLmNvZ25pdG8uc2lnbmluLnVzZXIuYWRtaW4iLCJhdXRoX3RpbWUiOjE3ODIwMTgzNzksImV4cCI6MTc4MjEwNDc3OSwiaWF0IjoxNzgyMDE4Mzc5LCJqdGkiOiI0MzAzNzE4ZS04YmY1LTRlYzYtODU3ZC0zZjI0NzE0MjFiZmYiLCJ1c2VybmFtZSI6Ijk0NzgxNGM4LTUwNDEtNzAwOC00ZGM0LTNmZGI3YmYzNWY2MCJ9.KBJiIYJU27GVTNeO7Ez7nH7zfYIlZIZpOy-sw-f2b7TU1t-slzApELHojegM6Q_z02JbZ96enom-tmZxgEbVLWGapvskpPvhxDWHcO2v-jQZato7NfOjR-2IIXHl9dZqhhQZ-SmZITZiWCSUGYSXyjdFZA8-1rC3DeKveVRL1TKUDDEwLiB5VbU8ilyOsLgNr_DWxu1MVkCX72rAxYtgEukPAF_wWQEcS3zFUQBJi3ky0ZQtiReFMpwoTqkD0v25bt1zZDVNRBxJOUsjKJl-mt6ei9vGy4iCkU0upeJOZL3_i0hUis_fi84f0NvhC2_y7UvgUcpvDcPsxmQs9xHB9w; refreshToken=eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.JpJkmj350jaitEq10lS3yE3FTc6Uemppwf6aL3m6rcqgpraS9VRS592DKrCRPpW_tv9TYTFvmCGgpVvQcr-P5AK-V-pV2Zc8ByafD3FLL8Zuf3IrmH-Qtxyg5xeKATQs330sV3sI9BU0TSXgQFjYvPv-nsmsBHZPSueB8wvBhdmQAwBj4mmtl_uZ_rC_yFIA3yW5iU4JewtsSweTJJNo3oq1GIGQPFDlN9Tg9X-vUR9qjV0e3bcfSYcCF8dwQTdRRwxVG9Td_bGBmrI8ip2axVuoNqu2WOu9WaFWUF4gez3jX6OB81CoSxOGtoOJ_By-wc3Nzb_PPmvQs_moBRdCWQ.NDu2IcCHv1WZelnv.MEhGl5-OK6rxpxNlZSe6Ol_NyAymXL3hkS-iy064ptoDJx3YNvgg9iDXxtZ80-n_hdJRfV9qw4hnU8qDcN7FSjCZKUVhtaQcppT0HLov3QCcXRyFiMLN81v4tBkhXEj_ipJX-TL_4FumN0qnI1d40DjH8oANBNZx3DpBVvPGi5ouKW_yr0ACaG8ZGL-VzZGCn0dJL7fX9k1JSMxN5KPAa9wOgpa8sbxa9CH8recNQME9rv0GLMdJa2D3UtvR8OWTvUolxULTiROgX_rg-pQUm7x0jJo0D3Z9dCWY0lZW9PbydcpwoseCVUrWG_UXmRmXe-JOXseYMxVaTTTg27_5YqrIcT88v6ttFC4PxN6PKVdH5M2wM9wRMuyjlLDQwnch10gZ13btHdkleY70W0WASBEPrs_J20OxRWw55GJQPuqxGv-leTHoesnQlLFSAuKHHQ26mzt7tZQfA3wCYCqRvxCLtDIUYA0l6BN7xSBICB5fiJcOHfbk7cy87jKpOZ22U_pPC48wYC2UiHgtUwINCeS9g0iHTZo3UA_oeOKZ1Dgt1AxQBzfotb9Gg5AW6tJ1JynGrnOBqJ037x28-D6JFI8d-GdUL52fEjnmh-QV2J1seOpyG2PHtvUOOD_F75_K_vzJVjKCm2xFQvHDIhe3_ynGCqpBfcfoWczmPdXMTz2Odh8F0HC2ggVp-dfz6bTn5k0_q_qxOFPy_jdhjdfxi_hLxS9XT0-C8jHOW5UHBuJea3tVhxs9VSSkFENHAUEjSfGlpZxIuRkWr3jhMjKhOXA20SK12sPX79mbBvL2yiyZcD5gdQq-ID2brSYhR5ceI8_ZJ1iGkH_ig9gb2AhP_PaAiiPxeqNdf_mDs4n_BaSbG–vyVyRGKiiisdC1Rh3QQXK_iY-sh-Cb0nzJuOzR76i4uku4g1nWfCuN6am3Vm5dYjdaO2toeXVt-EoUwXyhxnlYt706HWjaO8L4sgXiOYEUPgucc4kf1DBb6gsppqpSj6T9JVlZ9n0XyRHHEDAjLG94MEhF3HFQOUIE2MnbvO1ExAs4lWYYGa_lwHkxKmHoNeS1LnEdmurq3CrFj6_8TKZdKxbyh72vnDO-G2QmRx2khM1IbzM7Tpn6F1rQD1Ssm8TPIAZbnOWlpmPaCimtJNU9f2jWbsLWH921m-a-XUbxMEfue3m7SgeHD10onKV098yhMKyVRM76FgpAIEcz_xgTNtOs8eJ2WOw6VJzsA4MiSv-V1-wMYA_TLbvCuigcpXvI6BcfPLWLkfqoLWHcx6BELejEHvUo7-9RZ_rpch_I3Z-mJ_46WMDjyCZlYpQnqImsHTc.2DyAhXmamFPEv5pLtm-eNg; sessionId=f516c66840e7”

curl -i -N -s –max-time 10 https://ctf.arkx.ninja/level/7/mcp
-H “Accept: text/event-stream”
-H “Mcp-Session-Id: 144376bf890e43c6b466546f6cba5bef”
-H “Cookie: idToken=eyJraWQiOiJ2SEJzRXBRUjdpS0llOGU4TEpMbkRiZWFzalBwTUpYcG03M1VveXZQMHZzPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI5NDc4MTRjOC01MDQxLTcwMDgtNGRjNC0zZmRiN2JmMzVmNjAiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiaXNzIjoiaHR0cHM6Ly9jb2duaXRvLWlkcC51cy1lYXN0LTEuYW1hem9uYXdzLmNvbS91cy1lYXN0LTFfVXlieTJYd0pRIiwiY29nbml0bzp1c2VybmFtZSI6Ijk0NzgxNGM4LTUwNDEtNzAwOC00ZGM0LTNmZGI3YmYzNWY2MCIsImN1c3RvbTpzdGF0ZSI6Ikx1eGVtYm91cmciLCJjdXN0b206b3B0X291dCI6InRydWUiLCJjdXN0b206bmlja25hbWUiOiJuamVyaSIsImN1c3RvbTpjb21wYW55IjoiVW5pdmVyc2l0eSBvZiBMdXhlbWJvdXJnIiwib3JpZ2luX2p0aSI6ImI1YWYxNzEyLTliMGMtNDAzYi05MzJkLTc1OWRiOTJhM2IyYyIsImN1c3RvbTpmdWxsX25hbWUiOiJGbG9yZW5jZSBOamVyaSIsImF1ZCI6IjVyODF2dWc1aDRsOWZrcW00OGJsaGN0dDByIiwiZXZlbnRfaWQiOiI3YWZiY2Y4Ni1jOWZiLTQ5NWYtODgxOS04MzE1ZDBiN2UzNDIiLCJ0b2tlbl91c2UiOiJpZCIsImF1dGhfdGltZSI6MTc4MjAxODM3OSwiZXhwIjoxNzgyMTA0Nzc5LCJpYXQiOjE3ODIwMTgzNzksImp0aSI6ImM0ZDhkYjE1LTgzMzUtNGZjOC05NjU4LWZkOGJkMjg4ZmM3ZiIsImVtYWlsIjoiZmxvcmVuY2VsbmplcmlAZ21haWwuY29tIn0.QlWdy0j8q7MgZlWCf8zOTzMs81bb1ctJxoFiwEYNtj3pHivUzR55dOfKBj86pG2B9NOzMtTeR35VpqT-oe1HcyGGHYvP7wHAqagWmt04x5Ro18DJIQCJcADLnVzsXrjDZkmc1bhkP9MV0iymYCTdA_61Dus7i7ZmPx_UfmVmEMlkBSRpdTLZc6E0XbaOllupLE-tJ-EBxHlhiypys30b0crUspWb7Ce4eUUTbdAkUnH4UHGa8VwDALFkZcEzuGbJZowgOao5aNAdBx6AjIlNPfpbxOO1mM03eHDWSwd1DQyskMUwEGWjDpjWv_jDTAw0M3QvRjZ9xmbyDB1stWgo2w; accessToken=eyJraWQiOiI5S2wvUXFFbUtTSjJ6S25SV3FCUmtDQzlITUVjanZobnJ5Z08yazV4UXk4PSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI5NDc4MTRjOC01MDQxLTcwMDgtNGRjNC0zZmRiN2JmMzVmNjAiLCJpc3MiOiJodHRwczovL2NvZ25pdG8taWRwLnVzLWVhc3QtMS5hbWF6b25hd3MuY29tL3VzLWVhc3QtMV9VeWJ5Mlh3SlEiLCJjbGllbnRfaWQiOiI1cjgxdnVnNWg0bDlma3FtNDhibGhjdHQwciIsIm9yaWdpbl9qdGkiOiJiNWFmMTcxMi05YjBjLTQwM2ItOTMyZC03NTlkYjkyYTNiMmMiLCJldmVudF9pZCI6IjdhZmJjZjg2LWM5ZmItNDk1Zi04ODE5LTgzMTVkMGI3ZTM0MiIsInRva2VuX3VzZSI6ImFjY2VzcyIsInNjb3BlIjoiYXdzLmNvZ25pdG8uc2lnbmluLnVzZXIuYWRtaW4iLCJhdXRoX3RpbWUiOjE3ODIwMTgzNzksImV4cCI6MTc4MjEwNDc3OSwiaWF0IjoxNzgyMDE4Mzc5LCJqdGkiOiI0MzAzNzE4ZS04YmY1LTRlYzYtODU3ZC0zZjI0NzE0MjFiZmYiLCJ1c2VybmFtZSI6Ijk0NzgxNGM4LTUwNDEtNzAwOC00ZGM0LTNmZGI3YmYzNWY2MCJ9.KBJiIYJU27GVTNeO7Ez7nH7zfYIlZIZpOy-sw-f2b7TU1t-slzApELHojegM6Q_z02JbZ96enom-tmZxgEbVLWGapvskpPvhxDWHcO2v-jQZato7NfOjR-2IIXHl9dZqhhQZ-SmZITZiWCSUGYSXyjdFZA8-1rC3DeKveVRL1TKUDDEwLiB5VbU8ilyOsLgNr_DWxu1MVkCX72rAxYtgEukPAF_wWQEcS3zFUQBJi3ky0ZQtiReFMpwoTqkD0v25bt1zZDVNRBxJOUsjKJl-mt6ei9vGy4iCkU0upeJOZL3_i0hUis_fi84f0NvhC2_y7UvgUcpvDcPsxmQs9xHB9w; refreshToken=eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.JpJkmj350jaitEq10lS3yE3FTc6Uemppwf6aL3m6rcqgpraS9VRS592DKrCRPpW_tv9TYTFvmCGgpVvQcr-P5AK-V-pV2Zc8ByafD3FLL8Zuf3IrmH-Qtxyg5xeKATQs330sV3sI9BU0TSXgQFjYvPv-nsmsBHZPSueB8wvBhdmQAwBj4mmtl_uZ_rC_yFIA3yW5iU4JewtsSweTJJNo3oq1GIGQPFDlN9Tg9X-vUR9qjV0e3bcfSYcCF8dwQTdRRwxVG9Td_bGBmrI8ip2axVuoNqu2WOu9WaFWUF4gez3jX6OB81CoSxOGtoOJ_By-wc3Nzb_PPmvQs_moBRdCWQ.NDu2IcCHv1WZelnv.MEhGl5-OK6rxpxNlZSe6Ol_NyAymXL3hkS-iy064ptoDJx3YNvgg9iDXxtZ80-n_hdJRfV9qw4hnU8qDcN7FSjCZKUVhtaQcppT0HLov3QCcXRyFiMLN81v4tBkhXEj_ipJX-TL_4FumN0qnI1d40DjH8oANBNZx3DpBVvPGi5ouKW_yr0ACaG8ZGL-VzZGCn0dJL7fX9k1JSMxN5KPAa9wOgpa8sbxa9CH8recNQME9rv0GLMdJa2D3UtvR8OWTvUolxULTiROgX_rg-pQUm7x0jJo0D3Z9dCWY0lZW9PbydcpwoseCVUrWG_UXmRmXe-JOXseYMxVaTTTg27_5YqrIcT88v6ttFC4PxN6PKVdH5M2wM9wRMuyjlLDQwnch10gZ13btHdkleY70W0WASBEPrs_J20OxRWw55GJQPuqxGv-leTHoesnQlLFSAuKHHQ26mzt7tZQfA3wCYCqRvxCLtDIUYA0l6BN7xSBICB5fiJcOHfbk7cy87jKpOZ22U_pPC48wYC2UiHgtUwINCeS9g0iHTZo3UA_oeOKZ1Dgt1AxQBzfotb9Gg5AW6tJ1JynGrnOBqJ037x28-D6JFI8d-GdUL52fEjnmh-QV2J1seOpyG2PHtvUOOD_F75_K_vzJVjKCm2xFQvHDIhe3_ynGCqpBfcfoWczmPdXMTz2Odh8F0HC2ggVp-dfz6bTn5k0_q_qxOFPy_jdhjdfxi_hLxS9XT0-C8jHOW5UHBuJea3tVhxs9VSSkFENHAUEjSfGlpZxIuRkWr3jhMjKhOXA20SK12sPX79mbBvL2yiyZcD5gdQq-ID2brSYhR5ceI8_ZJ1iGkH_ig9gb2AhP_PaAiiPxeqNdf_mDs4n_BaSbG–vyVyRGKiiisdC1Rh3QQXK_iY-sh-Cb0nzJuOzR76i4uku4g1nWfCuN6am3Vm5dYjdaO2toeXVt-EoUwXyhxnlYt706HWjaO8L4sgXiOYEUPgucc4kf1DBb6gsppqpSj6T9JVlZ9n0XyRHHEDAjLG94MEhF3HFQOUIE2MnbvO1ExAs4lWYYGa_lwHkxKmHoNeS1LnEdmurq3CrFj6_8TKZdKxbyh72vnDO-G2QmRx2khM1IbzM7Tpn6F1rQD1Ssm8TPIAZbnOWlpmPaCimtJNU9f2jWbsLWH921m-a-XUbxMEfue3m7SgeHD10onKV098yhMKyVRM76FgpAIEcz_xgTNtOs8eJ2WOw6VJzsA4MiSv-V1-wMYA_TLbvCuigcpXvI6BcfPLWLkfqoLWHcx6BELejEHvUo7-9RZ_rpch_I3Z-mJ_46WMDjyCZlYpQnqImsHTc.2DyAhXmamFPEv5pLtm-eNg; sessionId=f516c66840e7”

Initialize the MCP server #

curl -i -s https://ctf.arkx.ninja/level/7/mcp
-H “Content-Type: application/json”
-H “Accept: application/json, text/event-stream”
-H “Mcp-Session-Id: 144376bf890e43c6b466546f6cba5bef”
-H “Cookie: idToken=eyJraWQiOiJ2SEJzRXBRUjdpS0llOGU4TEpMbkRiZWFzalBwTUpYcG03M1VveXZQMHZzPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI5NDc4MTRjOC01MDQxLTcwMDgtNGRjNC0zZmRiN2JmMzVmNjAiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiaXNzIjoiaHR0cHM6Ly9jb2duaXRvLWlkcC51cy1lYXN0LTEuYW1hem9uYXdzLmNvbS91cy1lYXN0LTFfVXlieTJYd0pRIiwiY29nbml0bzp1c2VybmFtZSI6Ijk0NzgxNGM4LTUwNDEtNzAwOC00ZGM0LTNmZGI3YmYzNWY2MCIsImN1c3RvbTpzdGF0ZSI6Ikx1eGVtYm91cmciLCJjdXN0b206b3B0X291dCI6InRydWUiLCJjdXN0b206bmlja25hbWUiOiJuamVyaSIsImN1c3RvbTpjb21wYW55IjoiVW5pdmVyc2l0eSBvZiBMdXhlbWJvdXJnIiwib3JpZ2luX2p0aSI6ImI1YWYxNzEyLTliMGMtNDAzYi05MzJkLTc1OWRiOTJhM2IyYyIsImN1c3RvbTpmdWxsX25hbWUiOiJGbG9yZW5jZSBOamVyaSIsImF1ZCI6IjVyODF2dWc1aDRsOWZrcW00OGJsaGN0dDByIiwiZXZlbnRfaWQiOiI3YWZiY2Y4Ni1jOWZiLTQ5NWYtODgxOS04MzE1ZDBiN2UzNDIiLCJ0b2tlbl91c2UiOiJpZCIsImF1dGhfdGltZSI6MTc4MjAxODM3OSwiZXhwIjoxNzgyMTA0Nzc5LCJpYXQiOjE3ODIwMTgzNzksImp0aSI6ImM0ZDhkYjE1LTgzMzUtNGZjOC05NjU4LWZkOGJkMjg4ZmM3ZiIsImVtYWlsIjoiZmxvcmVuY2VsbmplcmlAZ21haWwuY29tIn0.QlWdy0j8q7MgZlWCf8zOTzMs81bb1ctJxoFiwEYNtj3pHivUzR55dOfKBj86pG2B9NOzMtTeR35VpqT-oe1HcyGGHYvP7wHAqagWmt04x5Ro18DJIQCJcADLnVzsXrjDZkmc1bhkP9MV0iymYCTdA_61Dus7i7ZmPx_UfmVmEMlkBSRpdTLZc6E0XbaOllupLE-tJ-EBxHlhiypys30b0crUspWb7Ce4eUUTbdAkUnH4UHGa8VwDALFkZcEzuGbJZowgOao5aNAdBx6AjIlNPfpbxOO1mM03eHDWSwd1DQyskMUwEGWjDpjWv_jDTAw0M3QvRjZ9xmbyDB1stWgo2w; accessToken=eyJraWQiOiI5S2wvUXFFbUtTSjJ6S25SV3FCUmtDQzlITUVjanZobnJ5Z08yazV4UXk4PSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI5NDc4MTRjOC01MDQxLTcwMDgtNGRjNC0zZmRiN2JmMzVmNjAiLCJpc3MiOiJodHRwczovL2NvZ25pdG8taWRwLnVzLWVhc3QtMS5hbWF6b25hd3MuY29tL3VzLWVhc3QtMV9VeWJ5Mlh3SlEiLCJjbGllbnRfaWQiOiI1cjgxdnVnNWg0bDlma3FtNDhibGhjdHQwciIsIm9yaWdpbl9qdGkiOiJiNWFmMTcxMi05YjBjLTQwM2ItOTMyZC03NTlkYjkyYTNiMmMiLCJldmVudF9pZCI6IjdhZmJjZjg2LWM5ZmItNDk1Zi04ODE5LTgzMTVkMGI3ZTM0MiIsInRva2VuX3VzZSI6ImFjY2VzcyIsInNjb3BlIjoiYXdzLmNvZ25pdG8uc2lnbmluLnVzZXIuYWRtaW4iLCJhdXRoX3RpbWUiOjE3ODIwMTgzNzksImV4cCI6MTc4MjEwNDc3OSwiaWF0IjoxNzgyMDE4Mzc5LCJqdGkiOiI0MzAzNzE4ZS04YmY1LTRlYzYtODU3ZC0zZjI0NzE0MjFiZmYiLCJ1c2VybmFtZSI6Ijk0NzgxNGM4LTUwNDEtNzAwOC00ZGM0LTNmZGI3YmYzNWY2MCJ9.KBJiIYJU27GVTNeO7Ez7nH7zfYIlZIZpOy-sw-f2b7TU1t-slzApELHojegM6Q_z02JbZ96enom-tmZxgEbVLWGapvskpPvhxDWHcO2v-jQZato7NfOjR-2IIXHl9dZqhhQZ-SmZITZiWCSUGYSXyjdFZA8-1rC3DeKveVRL1TKUDDEwLiB5VbU8ilyOsLgNr_DWxu1MVkCX72rAxYtgEukPAF_wWQEcS3zFUQBJi3ky0ZQtiReFMpwoTqkD0v25bt1zZDVNRBxJOUsjKJl-mt6ei9vGy4iCkU0upeJOZL3_i0hUis_fi84f0NvhC2_y7UvgUcpvDcPsxmQs9xHB9w; refreshToken=eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.JpJkmj350jaitEq10lS3yE3FTc6Uemppwf6aL3m6rcqgpraS9VRS592DKrCRPpW_tv9TYTFvmCGgpVvQcr-P5AK-V-pV2Zc8ByafD3FLL8Zuf3IrmH-Qtxyg5xeKATQs330sV3sI9BU0TSXgQFjYvPv-nsmsBHZPSueB8wvBhdmQAwBj4mmtl_uZ_rC_yFIA3yW5iU4JewtsSweTJJNo3oq1GIGQPFDlN9Tg9X-vUR9qjV0e3bcfSYcCF8dwQTdRRwxVG9Td_bGBmrI8ip2axVuoNqu2WOu9WaFWUF4gez3jX6OB81CoSxOGtoOJ_By-wc3Nzb_PPmvQs_moBRdCWQ.NDu2IcCHv1WZelnv.MEhGl5-OK6rxpxNlZSe6Ol_NyAymXL3hkS-iy064ptoDJx3YNvgg9iDXxtZ80-n_hdJRfV9qw4hnU8qDcN7FSjCZKUVhtaQcppT0HLov3QCcXRyFiMLN81v4tBkhXEj_ipJX-TL_4FumN0qnI1d40DjH8oANBNZx3DpBVvPGi5ouKW_yr0ACaG8ZGL-VzZGCn0dJL7fX9k1JSMxN5KPAa9wOgpa8sbxa9CH8recNQME9rv0GLMdJa2D3UtvR8OWTvUolxULTiROgX_rg-pQUm7x0jJo0D3Z9dCWY0lZW9PbydcpwoseCVUrWG_UXmRmXe-JOXseYMxVaTTTg27_5YqrIcT88v6ttFC4PxN6PKVdH5M2wM9wRMuyjlLDQwnch10gZ13btHdkleY70W0WASBEPrs_J20OxRWw55GJQPuqxGv-leTHoesnQlLFSAuKHHQ26mzt7tZQfA3wCYCqRvxCLtDIUYA0l6BN7xSBICB5fiJcOHfbk7cy87jKpOZ22U_pPC48wYC2UiHgtUwINCeS9g0iHTZo3UA_oeOKZ1Dgt1AxQBzfotb9Gg5AW6tJ1JynGrnOBqJ037x28-D6JFI8d-GdUL52fEjnmh-QV2J1seOpyG2PHtvUOOD_F75_K_vzJVjKCm2xFQvHDIhe3_ynGCqpBfcfoWczmPdXMTz2Odh8F0HC2ggVp-dfz6bTn5k0_q_qxOFPy_jdhjdfxi_hLxS9XT0-C8jHOW5UHBuJea3tVhxs9VSSkFENHAUEjSfGlpZxIuRkWr3jhMjKhOXA20SK12sPX79mbBvL2yiyZcD5gdQq-ID2brSYhR5ceI8_ZJ1iGkH_ig9gb2AhP_PaAiiPxeqNdf_mDs4n_BaSbG–vyVyRGKiiisdC1Rh3QQXK_iY-sh-Cb0nzJuOzR76i4uku4g1nWfCuN6am3Vm5dYjdaO2toeXVt-EoUwXyhxnlYt706HWjaO8L4sgXiOYEUPgucc4kf1DBb6gsppqpSj6T9JVlZ9n0XyRHHEDAjLG94MEhF3HFQOUIE2MnbvO1ExAs4lWYYGa_lwHkxKmHoNeS1LnEdmurq3CrFj6_8TKZdKxbyh72vnDO-G2QmRx2khM1IbzM7Tpn6F1rQD1Ssm8TPIAZbnOWlpmPaCimtJNU9f2jWbsLWH921m-a-XUbxMEfue3m7SgeHD10onKV098yhMKyVRM76FgpAIEcz_xgTNtOs8eJ2WOw6VJzsA4MiSv-V1-wMYA_TLbvCuigcpXvI6BcfPLWLkfqoLWHcx6BELejEHvUo7-9RZ_rpch_I3Z-mJ_46WMDjyCZlYpQnqImsHTc.2DyAhXmamFPEv5pLtm-eNg; sessionId=f516c66840e7”
-d ‘{“jsonrpc”:“2.0”,“id”:1,“method”:“initialize”,“params”:{“protocolVersion”:“2025-06-18”,“capabilities”:{},“clientInfo”:{“name”:“curl-test”,“version”:“0.1”}}}’

List all the available resources #

curl -i -s https://ctf.arkx.ninja/level/7/mcp
-H “Content-Type: application/json”
-H “Accept: application/json, text/event-stream”
-H “Mcp-Session-Id: 144376bf890e43c6b466546f6cba5bef”
-H “Cookie: idToken=eyJraWQiOiJ2SEJzRXBRUjdpS0llOGU4TEpMbkRiZWFzalBwTUpYcG03M1VveXZQMHZzPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI5NDc4MTRjOC01MDQxLTcwMDgtNGRjNC0zZmRiN2JmMzVmNjAiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiaXNzIjoiaHR0cHM6Ly9jb2duaXRvLWlkcC51cy1lYXN0LTEuYW1hem9uYXdzLmNvbS91cy1lYXN0LTFfVXlieTJYd0pRIiwiY29nbml0bzp1c2VybmFtZSI6Ijk0NzgxNGM4LTUwNDEtNzAwOC00ZGM0LTNmZGI3YmYzNWY2MCIsImN1c3RvbTpzdGF0ZSI6Ikx1eGVtYm91cmciLCJjdXN0b206b3B0X291dCI6InRydWUiLCJjdXN0b206bmlja25hbWUiOiJuamVyaSIsImN1c3RvbTpjb21wYW55IjoiVW5pdmVyc2l0eSBvZiBMdXhlbWJvdXJnIiwib3JpZ2luX2p0aSI6ImI1YWYxNzEyLTliMGMtNDAzYi05MzJkLTc1OWRiOTJhM2IyYyIsImN1c3RvbTpmdWxsX25hbWUiOiJGbG9yZW5jZSBOamVyaSIsImF1ZCI6IjVyODF2dWc1aDRsOWZrcW00OGJsaGN0dDByIiwiZXZlbnRfaWQiOiI3YWZiY2Y4Ni1jOWZiLTQ5NWYtODgxOS04MzE1ZDBiN2UzNDIiLCJ0b2tlbl91c2UiOiJpZCIsImF1dGhfdGltZSI6MTc4MjAxODM3OSwiZXhwIjoxNzgyMTA0Nzc5LCJpYXQiOjE3ODIwMTgzNzksImp0aSI6ImM0ZDhkYjE1LTgzMzUtNGZjOC05NjU4LWZkOGJkMjg4ZmM3ZiIsImVtYWlsIjoiZmxvcmVuY2VsbmplcmlAZ21haWwuY29tIn0.QlWdy0j8q7MgZlWCf8zOTzMs81bb1ctJxoFiwEYNtj3pHivUzR55dOfKBj86pG2B9NOzMtTeR35VpqT-oe1HcyGGHYvP7wHAqagWmt04x5Ro18DJIQCJcADLnVzsXrjDZkmc1bhkP9MV0iymYCTdA_61Dus7i7ZmPx_UfmVmEMlkBSRpdTLZc6E0XbaOllupLE-tJ-EBxHlhiypys30b0crUspWb7Ce4eUUTbdAkUnH4UHGa8VwDALFkZcEzuGbJZowgOao5aNAdBx6AjIlNPfpbxOO1mM03eHDWSwd1DQyskMUwEGWjDpjWv_jDTAw0M3QvRjZ9xmbyDB1stWgo2w; accessToken=eyJraWQiOiI5S2wvUXFFbUtTSjJ6S25SV3FCUmtDQzlITUVjanZobnJ5Z08yazV4UXk4PSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI5NDc4MTRjOC01MDQxLTcwMDgtNGRjNC0zZmRiN2JmMzVmNjAiLCJpc3MiOiJodHRwczovL2NvZ25pdG8taWRwLnVzLWVhc3QtMS5hbWF6b25hd3MuY29tL3VzLWVhc3QtMV9VeWJ5Mlh3SlEiLCJjbGllbnRfaWQiOiI1cjgxdnVnNWg0bDlma3FtNDhibGhjdHQwciIsIm9yaWdpbl9qdGkiOiJiNWFmMTcxMi05YjBjLTQwM2ItOTMyZC03NTlkYjkyYTNiMmMiLCJldmVudF9pZCI6IjdhZmJjZjg2LWM5ZmItNDk1Zi04ODE5LTgzMTVkMGI3ZTM0MiIsInRva2VuX3VzZSI6ImFjY2VzcyIsInNjb3BlIjoiYXdzLmNvZ25pdG8uc2lnbmluLnVzZXIuYWRtaW4iLCJhdXRoX3RpbWUiOjE3ODIwMTgzNzksImV4cCI6MTc4MjEwNDc3OSwiaWF0IjoxNzgyMDE4Mzc5LCJqdGkiOiI0MzAzNzE4ZS04YmY1LTRlYzYtODU3ZC0zZjI0NzE0MjFiZmYiLCJ1c2VybmFtZSI6Ijk0NzgxNGM4LTUwNDEtNzAwOC00ZGM0LTNmZGI3YmYzNWY2MCJ9.KBJiIYJU27GVTNeO7Ez7nH7zfYIlZIZpOy-sw-f2b7TU1t-slzApELHojegM6Q_z02JbZ96enom-tmZxgEbVLWGapvskpPvhxDWHcO2v-jQZato7NfOjR-2IIXHl9dZqhhQZ-SmZITZiWCSUGYSXyjdFZA8-1rC3DeKveVRL1TKUDDEwLiB5VbU8ilyOsLgNr_DWxu1MVkCX72rAxYtgEukPAF_wWQEcS3zFUQBJi3ky0ZQtiReFMpwoTqkD0v25bt1zZDVNRBxJOUsjKJl-mt6ei9vGy4iCkU0upeJOZL3_i0hUis_fi84f0NvhC2_y7UvgUcpvDcPsxmQs9xHB9w; refreshToken=eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.JpJkmj350jaitEq10lS3yE3FTc6Uemppwf6aL3m6rcqgpraS9VRS592DKrCRPpW_tv9TYTFvmCGgpVvQcr-P5AK-V-pV2Zc8ByafD3FLL8Zuf3IrmH-Qtxyg5xeKATQs330sV3sI9BU0TSXgQFjYvPv-nsmsBHZPSueB8wvBhdmQAwBj4mmtl_uZ_rC_yFIA3yW5iU4JewtsSweTJJNo3oq1GIGQPFDlN9Tg9X-vUR9qjV0e3bcfSYcCF8dwQTdRRwxVG9Td_bGBmrI8ip2axVuoNqu2WOu9WaFWUF4gez3jX6OB81CoSxOGtoOJ_By-wc3Nzb_PPmvQs_moBRdCWQ.NDu2IcCHv1WZelnv.MEhGl5-OK6rxpxNlZSe6Ol_NyAymXL3hkS-iy064ptoDJx3YNvgg9iDXxtZ80-n_hdJRfV9qw4hnU8qDcN7FSjCZKUVhtaQcppT0HLov3QCcXRyFiMLN81v4tBkhXEj_ipJX-TL_4FumN0qnI1d40DjH8oANBNZx3DpBVvPGi5ouKW_yr0ACaG8ZGL-VzZGCn0dJL7fX9k1JSMxN5KPAa9wOgpa8sbxa9CH8recNQME9rv0GLMdJa2D3UtvR8OWTvUolxULTiROgX_rg-pQUm7x0jJo0D3Z9dCWY0lZW9PbydcpwoseCVUrWG_UXmRmXe-JOXseYMxVaTTTg27_5YqrIcT88v6ttFC4PxN6PKVdH5M2wM9wRMuyjlLDQwnch10gZ13btHdkleY70W0WASBEPrs_J20OxRWw55GJQPuqxGv-leTHoesnQlLFSAuKHHQ26mzt7tZQfA3wCYCqRvxCLtDIUYA0l6BN7xSBICB5fiJcOHfbk7cy87jKpOZ22U_pPC48wYC2UiHgtUwINCeS9g0iHTZo3UA_oeOKZ1Dgt1AxQBzfotb9Gg5AW6tJ1JynGrnOBqJ037x28-D6JFI8d-GdUL52fEjnmh-QV2J1seOpyG2PHtvUOOD_F75_K_vzJVjKCm2xFQvHDIhe3_ynGCqpBfcfoWczmPdXMTz2Odh8F0HC2ggVp-dfz6bTn5k0_q_qxOFPy_jdhjdfxi_hLxS9XT0-C8jHOW5UHBuJea3tVhxs9VSSkFENHAUEjSfGlpZxIuRkWr3jhMjKhOXA20SK12sPX79mbBvL2yiyZcD5gdQq-ID2brSYhR5ceI8_ZJ1iGkH_ig9gb2AhP_PaAiiPxeqNdf_mDs4n_BaSbG–vyVyRGKiiisdC1Rh3QQXK_iY-sh-Cb0nzJuOzR76i4uku4g1nWfCuN6am3Vm5dYjdaO2toeXVt-EoUwXyhxnlYt706HWjaO8L4sgXiOYEUPgucc4kf1DBb6gsppqpSj6T9JVlZ9n0XyRHHEDAjLG94MEhF3HFQOUIE2MnbvO1ExAs4lWYYGa_lwHkxKmHoNeS1LnEdmurq3CrFj6_8TKZdKxbyh72vnDO-G2QmRx2khM1IbzM7Tpn6F1rQD1Ssm8TPIAZbnOWlpmPaCimtJNU9f2jWbsLWH921m-a-XUbxMEfue3m7SgeHD10onKV098yhMKyVRM76FgpAIEcz_xgTNtOs8eJ2WOw6VJzsA4MiSv-V1-wMYA_TLbvCuigcpXvI6BcfPLWLkfqoLWHcx6BELejEHvUo7-9RZ_rpch_I3Z-mJ_46WMDjyCZlYpQnqImsHTc.2DyAhXmamFPEv5pLtm-eNg; sessionId=f516c66840e7”
-d ‘{“jsonrpc”:“2.0”,“id”:4,“method”:“tools/call”,“params”:{“name”:“unlock_flag”,“arguments”: {}}}’