Blitz Strike is a self-hosted MCP penetration-testing toolbelt that packages a three-tier methodology — recon, source analysis, live validation — as server-side tools, backed by a 130-tool catalog, 334 manual/playbook files, 57 escalation chains, and a substantial intelligence layer, plus a benchmark and coverage matrix (the README reports detection rate 1.0, false-positive rate 0, and 56/60 coverage pairs). Its defining stance is that a scan hit is a hypothesis and only a live test is a verdict, using marker reflection plus a negative control to suppress false positives. It is MIT-licensed and community-maintained rather than official, aimed at authorized security researchers. Users should note that live testing sends real requests and requires correct scope configuration, that ensure_tool modifies the local machine, that some datasets must be synced on demand, and that credentials are provided through environment variables.
Strongest · Documentation 13/20 Weakest · Security and permissions 4/20
Static review · not runListed 2026-09-18
Read the FMRS scoring method →Runtime：Bun 1.4+ · Node.js
FOFA_KEY
FOFA API key from your FOFA account settings; only needed for fofa_search.
FOFA_EMAIL
FOFA account email, used together with FOFA_KEY for fofa_search asset queries.
H1_USERNAME
Optional HackerOne username; when set, outbound testing requests carry the X-HackerOne-Research header for responsible-disclosure identification.
BLITZSTRIKE_HOME
Optional override for the home directory (default ~/.blitzstrike).
BLITZSTRIKE_DATA
Optional override for the data-cache directory (default ~/.blitzstrike/data).
npx -y blitzstrike doctor to verify the environment (bun/node runtime, tool catalog, FOFA credentials, data layers); every issue comes with a fix: line.npx -y blitzstrike install. It detects installed agent CLIs (Claude Code, Cursor, OpenCode, Codex, Hermes, Gemini, Windsurf, Copilot, Cline) and merges the Blitz Strike entry into each config in its native format without overwriting existing MCP servers; add --dry-run to preview.run_engagement.git clone https://github.com/shinthink/blitzstrike.git && cd blitzstrike && bun install && bun run src/index.ts serve --mcp.blitzstrike and args to ["serve", "--mcp"]{
"mcpServers": {
"blitzstrike": {
"command": "blitzstrike",
"args": ["serve", "--mcp"]
}
}
}
Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.
{
"servers": {
"blitzstrike": {
"command": "blitzstrike",
"args": [
"serve",
"--mcp"
]
}
}
}
Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).
claude mcp add blitzstrike -- blitzstrike serve --mcp
Run it in a terminal; replace any <…> placeholders with your own values first.
Run npx -y blitzstrike doctor to confirm the runtime and 130-tool catalog are OK, then check that the blitzstrike server appears in your MCP client's tool list and that run_engagement or list_chains returns results.
Once connected, you can ask your AI assistant things like:
No matching tools
Listed from the project's documentation, not tested by this site.
Blitz Strike is a structured penetration-testing methodology delivered as a universal MCP server (TypeScript / Bun), mapping reconnaissance, source analysis, and live validation onto three callable tool tiers that run server-side. Tier 1, BLITZ, maps the attack surface: it enumerates unauthenticated entry points and dangerous sinks at scale with file:line references. Tier 2, EAGLE-EYE, performs static analysis and data-flow tracing, matching source-to-sink reachability against an escalation-chain graph. Tier 3, STRIKE, performs live validation via marker reflection plus a negative control, and enforces scope. A single run_engagement call drives scope gating, triage, chain enrichment, and findings, with the LLM automatically classifying the target (URL → live pipeline, filesystem path → source pipeline). Beyond the three tiers it ships a 130-tool catalog, 317 deep tool manuals, 17 engagement playbooks, an intelligence layer (139 WAF signatures, 89 technologies, 53 CVEs, 103 ports, 66 payload categories, ~11.9k nuclei templates, 34 attack-vector categories / 588 vectors), CVSS v3.1 scoring, dedup, reproducible reports, and a self-growing memory layer. It is intended for security researchers and teams performing authorized assessments.
Upstash's official server providing up-to-date third-party library docs for AI coding assistants
AI-powered NPM package analysis MCP server
An independent control layer that gives AI coding agents budgets, brakes, and receipts
GitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language
Source revision ce0b30b106a4 Data synced 2026-11-02 Read the FMRS scoring method