Blitz Strike is a self-hosted MCP penetration-testing toolbelt that packages a three-tier methodology — recon, source analysis, live validation — as server-side tools, backed by a 130-tool catalog, 334 manual/playbook files, 57 escalation chains, and a substantial intelligence layer, plus a benchmark and coverage matrix (the README reports detection rate 1.0, false-positive rate 0, and 56/60 coverage pairs). Its defining stance is that a scan hit is a hypothesis and only a live test is a verdict, using marker reflection plus a negative control to suppress false positives. It is MIT-licensed and community-maintained rather than official, aimed at authorized security researchers. Users should note that live testing sends real requests and requires correct scope configuration, that ensure_tool modifies the local machine, that some datasets must be synced on demand, and that credentials are provided through environment variables.
Blitz Strike is a structured penetration-testing methodology delivered as a universal MCP server (TypeScript / Bun), mapping reconnaissance, source analysis, and live validation onto three callable tool tiers that run server-side. Tier 1, BLITZ, maps the attack surface: it enumerates unauthenticated entry points and dangerous sinks at scale with file:line references. Tier 2, EAGLE-EYE, performs static analysis and data-flow tracing, matching source-to-sink reachability against an escalation-chain graph. Tier 3, STRIKE, performs live validation via marker reflection plus a negative control, and enforces scope. A single run_engagement call drives scope gating, triage, chain enrichment, and findings, with the LLM automatically classifying the target (URL → live pipeline, filesystem path → source pipeline). Beyond the three tiers it ships a 130-tool catalog, 317 deep tool manuals, 17 engagement playbooks, an intelligence layer (139 WAF signatures, 89 technologies, 53 CVEs, 103 ports, 66 payload categories, ~11.9k nuclei templates, 34 attack-vector categories / 588 vectors), CVSS v3.1 scoring, dedup, reproducible reports, and a self-growing memory layer. It is intended for security researchers and teams performing authorized assessments.
npx -y blitzstrike doctor to verify the environment (bun/node runtime, tool catalog, FOFA credentials, data layers); every issue comes with a fix: line.npx -y blitzstrike install. It detects installed agent CLIs (Claude Code, Cursor, OpenCode, Codex, Hermes, Gemini, Windsurf, Copilot, Cline) and merges the Blitz Strike entry into each config in its native format without overwriting existing MCP servers; add --dry-run to preview.run_engagement.git clone https://github.com/shinthink/blitzstrike.git && cd blitzstrike && bun install && bun run src/index.ts serve --mcp.blitzstrike and args to ["serve", "--mcp"]{
"mcpServers": {
"blitzstrike": {
"command": "blitzstrike",
"args": ["serve", "--mcp"]
}
}
}