ClaudeMap

Blitz Strike

A penetration-testing methodology delivered as one MCP server: BLITZ maps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE live-verifies every finding before it is reported.

MCP Serversmcp-serversecuritypentestmethodologyvalidation
Visit projectshinthink/blitzstrike

Blitz Strike is a TypeScript/Bun MCP server (MCP TypeScript SDK) that packages a three-tier security-audit methodology as callable tools and runs the whole engagement server-side, so a single run_engagement call works from Claude Code, Claude Desktop, Cursor, Hermes, OpenCode, Gemini or any MCP client. The LLM is the brain — it plans, routes and judges — while Blitz Strike owns the workflow: BLITZ enumerates the exposed attack surface (unauthenticated entry points, dangerous sinks, authentication boundaries), EAGLE-EYE traces source-to-sink reachability against the escalation-chain graph so a sink is confirmed reachable, unauthenticated and exploitable rather than merely present, and STRIKE performs live verification with marker reflection plus a negative control, enforces scope, and orchestrates the report. Doctrine rides along as bundled instructions, skills and per-step next_steps, fanned out across the host platform's native sub-agents, and the relevant exploit-tool manual is attached to every result. Distribution is zero-install (npx/bunx) or a single static binary via bun build --compile; npx -y blitzstrike install auto-registers the server with every detected agent CLI — the README enumerates nine: Claude Code, Cursor, OpenCode, Codex, Hermes, Gemini, Windsurf, Copilot and Cline. MIT.

What it does

  • Three tiers in one run_engagement call: BLITZ recon and attack-surface mapping → EAGLE-EYE source-to-sink tracing → STRIKE live verification with scope enforcement
  • A scan hit is a hypothesis, a live test is the verdict: marker reflection plus a negative control before anything is reported
  • Server-side orchestration with doctrine (instructions, skills, per-step next_steps) fanned out across the host's native sub-agents
  • Zero-install MCP server: npx/bunx or one static binary per platform; auto-registers with nine detected agent CLIs

When to use it

Authorized security assessments and CTF-style work where false positives and unverified findings are the enemy — driven from Claude Code or any MCP client, against source trees or live targets.

Getting started

npx -y blitzstrike doctor      # verify the environment
npx -y blitzstrike install     # auto-register with every detected agent CLI
# restart the agent, then: "audit ./src" or "audit https://example.com"

# from source:
git clone https://github.com/shinthink/blitzstrike.git && cd blitzstrike
bun install && bun run src/index.ts serve --mcp

Things to know

MIT. The README is explicit: 'provided for educational and authorized security research only. Do not use against systems without explicit permission from the owner.' STRIKE performs live verification against targets, so keep engagements inside your authorized scope. The exploit-tool manual attached to every result is by design — treat findings and reports as sensitive. Runs the engagement server-side, so the host agent delegates heavily to its sub-agents.

Repository

shinthink/blitzstrike

Charted

Related on the map

  • Ripwire

    MCP Server

    Red Hat's "ripgrep for AI context" — a C++23 zero-dependency CLI that also speaks MCP.

    • mcp
    • code-context
    • cli
    • red-hat
    View

  • Deja Vu

    MCP Server

    One shared session memory for 25+ coding agents — Claude Code, Codex, and Cursor finally remember the same project.

    • mcp
    • memory
    • cross-agent
    • context
    View

  • Exa MCP

    MCP Server

    Exa's official MCP server — live web search, crawling, and deep research wired into Claude.

    • official
    • search
    • web
    • mcp
    View