# STRIATUM-CTF uses typed tool calls to make autonomous CTF solving less brittle [Canonical reading](https://escapemeridian.com/readings/striatum-ctf-uses-typed-tool-calls-to-make-autonomous-ctf-557e1ce0) The authors of STRIATUM-CTF argue that agents solving Capture-the-Flag (CTF) challenges need more than a language model sending commands to a shell: malformed commands, invented options and lost findings can derail long tasks. Their framework mediates between model reasoning and tool execution with the Model Context Protocol (MCP). Offensive-security tools are exposed as strictly typed, schema-validated functions; invalid calls are rejected before execution, and the agent receives structured observations it can use to self-correct. Across 180 runs on 15 challenges, the system succeeded on 77.8–86.7% of attempts, with no significant difference between documentation conditions. In one live CTF, it placed first among more than 30 registered teams. The authors call that event a demonstration of feasibility, not superiority over human experts. Because every controlled-study condition used the same tool layer, the study tests documentation volume, not the protocol layer itself; the authors present schema-mediated grounding as a design principle with qualitative support rather than a measured effect. How would a controlled comparison that varies the tool layer test whether schema-mediated grounding itself contributes to CTF-solving performance? Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Mar 23, 2026 (2026-03-23). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-10T19:03:29.313Z. First observed: 2026-11-02T05:04:05.804Z. Retrieved: 2026-11-03T05:17:09.682Z. - [STRIATUM-CTF: A Protocol-Driven Agentic Framework for Autonomous CTF Solving](https://arxiv.org/abs/2603.22577) ## Limits The controlled study uses the same tool layer in all four conditions, so it does not measure the protocol layer's effect. The live CTF result comes from one non-replicated event and, as the authors note, does not establish superiority over human experts. The supplied evidence is the arXiv abstract and page text, not the full paper; details beyond that evidence are not assessed. ## Open question How would a controlled comparison that varies the tool layer test whether schema-mediated grounding itself contributes to CTF-solving performance? ## Source-stated The authors present STRIATUM-CTF as a framework that uses the Model Context Protocol (MCP) to mediate between LLM reasoning and tool execution. > We present STRIATUM-CTF, a modular agentic framework for Capture-the-Flag (CTF) solving that mediates between LLM reasoning and tool execution using the Model Context Protocol (MCP). - [Supporting source](https://arxiv.org/abs/2603.22577) ## Source-stated The framework exposes offensive-security tools as schema-validated functions, rejects calls that do not fit the schema, and returns structured observations for agent self-correction. > the protocol layer rejects out-of-schema tool calls before execution and returns structured observations that the agent uses to self-correct. - [Supporting source](https://arxiv.org/abs/2603.22577) ## Source-stated In a controlled study of 180 runs across 15 CTF challenges, success ranged from 77.8% to 86.7% across documentation conditions, with no significant differences between conditions. > In a controlled study of 180 runs across 15 CTF challenges under four levels of attached procedural documentation, the system succeeds on 77.8-86.7% of attempts; notably, a schema-only configuration with no procedural documentation already reaches 77.8%, and no condition differs significantly from a - [Supporting source](https://arxiv.org/abs/2603.22577) ## Source-stated The authors report that the system placed first at one live CTF, but characterize this single event as feasibility evidence rather than evidence of superiority over human experts. > In a single live, multi-team CTF at Florida State University, the system placed first against a field of more than 30 registered teams -- a single, non-replicated event decided by a 10-point margin over the runner-up, and therefore a demonstration of feasibility rather than of superiority over human - [Supporting source](https://arxiv.org/abs/2603.22577) ## Source-stated The authors say the controlled study isolates documentation volume, not the effect of the protocol layer, and describe schema-mediated grounding as a design principle with qualitative support. > Because all four ablation conditions share the same tool layer, our controlled study isolates documentation volume rather than the protocol layer itself; we accordingly present schema-mediated grounding as a design principle with qualitative support rather than as a measured effect. - [Supporting source](https://arxiv.org/abs/2603.22577) ## Source and contributor context Hugglestone, James, Chacko, Samuel Jacob, Stoller, Dawson, Schmidt, Ryan, Liu, Xiuwen · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 946bacbd-9f2a-4bea-85db-eeed07ddf99e. Prepared by server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna); grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T19:03:29.313Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: a777d082b64a680dc864a60681bc3f0f8cc0476eaea123d427802d1c39f83148. Source text hash: 5c9933300285d98880518351668245293910fca794f059042ae7979df4bdbbfb. ## Revision and source-check history ### Version 1 — 2026-11-10T19:03:29.313Z The authors of STRIATUM-CTF argue that agents solving Capture-the-Flag (CTF) challenges need more than a language model sending commands to a shell: malformed commands, invented options and lost findings can derail long tasks. Their framework mediates between model reasoning and tool execution with the Model Context Protocol (MCP). Offensive-security tools are exposed as strictly typed, schema-validated functions; invalid calls are rejected before execution, and the agent receives structured observations it can use to self-correct. Across 180 runs on 15 challenges, the system succeeded on 77.8–86.7% of attempts, with no significant difference between documentation conditions. In one live CTF, it placed first among more than 30 registered teams. The authors call that event a demonstration of feasibility, not superiority over human experts. Because every controlled-study condition used the same tool layer, the study tests documentation volume, not the protocol layer itself; the authors present schema-mediated grounding as a design principle with qualitative support rather than a measured effect. How would a controlled comparison that varies the tool layer test whether schema-mediated grounding itself contributes to CTF-solving performance? ## Original source arXiv cs.AI · Article Original source date: Mar 23, 2026 (2026-03-23). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-10T19:03:29.313Z. First observed: 2026-11-02T05:04:05.804Z. Retrieved: 2026-11-03T05:17:09.682Z. - [STRIATUM-CTF: A Protocol-Driven Agentic Framework for Autonomous CTF Solving](https://arxiv.org/abs/2603.22577) ## Limits The controlled study uses the same tool layer in all four conditions, so it does not measure the protocol layer's effect. The live CTF result comes from one non-replicated event and, as the authors note, does not establish superiority over human experts. The supplied evidence is the arXiv abstract and page text, not the full paper; details beyond that evidence are not assessed. ## Open question How would a controlled comparison that varies the tool layer test whether schema-mediated grounding itself contributes to CTF-solving performance? ## Source-stated The authors present STRIATUM-CTF as a framework that uses the Model Context Protocol (MCP) to mediate between LLM reasoning and tool execution. > We present STRIATUM-CTF, a modular agentic framework for Capture-the-Flag (CTF) solving that mediates between LLM reasoning and tool execution using the Model Context Protocol (MCP). - [Supporting source](https://arxiv.org/abs/2603.22577) ## Source-stated The framework exposes offensive-security tools as schema-validated functions, rejects calls that do not fit the schema, and returns structured observations for agent self-correction. > the protocol layer rejects out-of-schema tool calls before execution and returns structured observations that the agent uses to self-correct. - [Supporting source](https://arxiv.org/abs/2603.22577) ## Source-stated In a controlled study of 180 runs across 15 CTF challenges, success ranged from 77.8% to 86.7% across documentation conditions, with no significant differences between conditions. > In a controlled study of 180 runs across 15 CTF challenges under four levels of attached procedural documentation, the system succeeds on 77.8-86.7% of attempts; notably, a schema-only configuration with no procedural documentation already reaches 77.8%, and no condition differs significantly from a - [Supporting source](https://arxiv.org/abs/2603.22577) ## Source-stated The authors report that the system placed first at one live CTF, but characterize this single event as feasibility evidence rather than evidence of superiority over human experts. > In a single live, multi-team CTF at Florida State University, the system placed first against a field of more than 30 registered teams -- a single, non-replicated event decided by a 10-point margin over the runner-up, and therefore a demonstration of feasibility rather than of superiority over human - [Supporting source](https://arxiv.org/abs/2603.22577) ## Source-stated The authors say the controlled study isolates documentation volume, not the effect of the protocol layer, and describe schema-mediated grounding as a design principle with qualitative support. > Because all four ablation conditions share the same tool layer, our controlled study isolates documentation volume rather than the protocol layer itself; we accordingly present schema-mediated grounding as a design principle with qualitative support rather than as a measured effect. - [Supporting source](https://arxiv.org/abs/2603.22577) ## Source and contributor context Hugglestone, James, Chacko, Samuel Jacob, Stoller, Dawson, Schmidt, Ryan, Liu, Xiuwen · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 946bacbd-9f2a-4bea-85db-eeed07ddf99e. Prepared by server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna); grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T19:03:29.313Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: a777d082b64a680dc864a60681bc3f0f8cc0476eaea123d427802d1c39f83148. Source text hash: 5c9933300285d98880518351668245293910fca794f059042ae7979df4bdbbfb. ### uncertain — 2026-11-10T19:03:29.313Z — anthropic/claude-opus-5.5 Publication: 946bacbd-9f2a-4bea-85db-eeed07ddf99e attribution — pass: The draft consistently attributes the framework, results and caveats to the paper's authors. It does not present their claims as established fact or as Escape Meridian's view. > Authors:James Hugglestone, Samuel Jacob Chacko, Dawson Stoller, Ryan Schmidt, Xiuwen Liu summary — uncertain: The summary is faithful and keeps the authors' own hedges. But a non-specialist is never told that Capture-the-Flag is a cybersecurity hacking competition, or that the work concerns autonomous cyber operations. That framing is central to why the work matters. Smallest repair: add a plain-language gloss, e.g. CTF as competitive security challenges where teams break into deliberately vulnerable systems, and note the source's autonomous cyber operations framing. MCP and schema-validated should also get tooltips or a short gloss. > Autonomous cyber operations increasingly depend on agents that can chain reconnaissance, exploitation, and analysis across many tools while maintaining state over long task horizons. date — pass: originalPublished 2026-03-23 matches the v1 submission date. It is not the later v2 revision date or the November feed date. > \[Submitted on 23 Mar 2026 (v1), last revised 29 Oct 2026 (this version, v2)\] support — pass: Each claim matches the abstract. The draft accurately reports the 77.8–86.7% range, the absence of significant differences, the first-place finish as a feasibility demonstration only, and the authors' admission that the protocol layer was not isolated. The question follows from that stated gap and asserts no unsupported benefit. > we accordingly present schema-mediated grounding as a design principle with qualitative support rather than as a measured effect. media — pass: The selected media is the verified direct arXiv abstract page for this paper. It is the most direct access to the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/557e1ce08a5a698fa5c691d3e40bc3611a2ce3cdc5220073721ed16b07d0799f/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/striatum-ctf-uses-typed-tool-calls-to-make-autonomous-ctf-557e1ce0.json)