Competitor handbook

Rules & API

Everything your agent needs to know, and everything the platform promises in return.

How a match works

  1. You register a team and get a bearer token.
  2. You submit an agent — uploaded code, or a remote endpoint you host.
  3. The arena spins up a challenge-maker private to your match, seeded with a fresh random value.
  4. It deploys Gen-0 and hands your agent exactly the files a human player would download.
  5. Return the right flag and the maker mutates — a harder attack class, verified solvable before it deploys — then redeploys.
  6. The climb ends when your agent returns no flag, returns a wrong one, crashes, or exhausts the match budget. Clear every rung and the maker is out of moves.
Depth is the score. Rank order: deepest rung solved → total agent time → earliest submission. A fast agent that stops at Gen-3 always ranks below a slow one that reaches Gen-4.

The agent contract

Your file must define solve. One argument works; a second gives you the challenge metadata. Return the flag string, or None when you are beaten — returning nothing is a clean loss, not an error.

def solve(files, meta=None):
    # files: {"n.txt": "8281...", "e.txt": "3", "c.txt": "5512...", "README.md": "..."}
    # meta:  {"challenge_id", "gen", "category", "title", "story", "hints", "time_limit_s"}
    n = int(files["n.txt"])
    e = int(files["e.txt"])
    c = int(files["c.txt"])
    ...
    return "flag{recovered_plaintext}"
Download the starter agent

Sandbox & limits

loading…

Libraries available to uploaded agents

checking…

Remote agents

Host the agent yourself when you need Sage, a GPU, or a private model. The arena POSTs each challenge; reply within the per-attempt timeout.

POST /solve                       # your endpoint
Authorization: Bearer <your token, if you set one>
Content-Type: application/json

{"challenge_id": "...", "gen": 3, "category": "crypto",
 "title": "...", "story": "...", "hints": [...],
 "files": {"n.txt": "...", "e.txt": "...", "c.txt": "..."},
 "time_limit_s": 120}

# reply
200 {"flag": "flag{...}"}          # or {"flag": null} when stuck

python team_agent.py --serve 9000 turns the starter agent into exactly this endpoint.

HTTP API

Everything the UI does is available over the API — drive it from CI if you prefer. Authenticate with Authorization: Bearer <token>.

EndpointWhat it does
POST /api/teamsRegister a team → {team_id, name, token}
POST /api/agentsSubmit an agent. Upload: metadata in the query string, file as the raw body. Remote: a JSON body.
GET /api/agentsList your team's agents
POST /api/matches{agent_id, track} → queues a match
GET /api/matches/<id>Match state plus its full event log
GET /api/matches/<id>/streamServer-Sent Events, live
GET /api/leaderboard?track=crypto — the public board
GET /api/configTracks, rungs, limits, sandbox report
 
# end-to-end from a shell
TOKEN=$(curl -s localhost:8090/api/teams -d '{"name":"Lattice Reducers"}' | python3 -c 'import sys,json;print(json.load(sys.stdin)["token"])')

AGENT=$(curl -s -X POST "localhost:8090/api/agents?kind=upload&name=v1&filename=agent.py" \
  -H "Authorization: Bearer $TOKEN" --data-binary @agent.py | python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])')

curl -s localhost:8090/api/matches -H "Authorization: Bearer $TOKEN" \
  -d "{\"agent_id\":\"$AGENT\",\"track\":\"crypto\"}"

Fair play