shinthink/blitzstrike

What it solves

Blitz Strike is designed to eliminate false positives and unverified findings in automated security assessments. It replaces surface-level pattern matching with a structured, three-tier methodology that requires live verification before any vulnerability is reported.

How it works

It operates as a Model Context Protocol (MCP) server that provides a suite of tools for LLM-driven penetration testing. The process follows a strict pipeline:

1. BLITZ (Reconnaissance): Maps the attack surface by enumerating unauthenticated entry points and dangerous sinks.
2. EAGLE-EYE (Analysis): Performs static analysis and data-flow tracing to confirm if a sink is actually reachable and exploitable.
3. STRIKE (Validation): Executes live verification using marker reflection and negative controls to confirm the vulnerability exists in a real-world scenario.

The LLM acts as the "brain" for planning and judgment, while Blitz Strike provides the deterministic tools, guardrails, and a vast knowledge base of escalation chains, tool manuals, and attack vectors.

Who it’s for

Security researchers and penetration testers who use AI agents (such as Claude Code, Cursor, or Gemini) to automate the reconnaissance and auditing of source code or live URLs.

Highlights

• Universal MCP Server: Compatible with any MCP client, allowing a full engagement to be run via a single run_engagement call.
• Extensive Knowledge Base: Includes a catalog of 130 security tools, 317 tool manuals, 17 engagement playbooks, and 57 data-driven escalation chains.
• Live Verification: Uses a "hypothesis vs. verdict" approach where findings are only reported after live confirmation.
• Taint Analysis: Supports inter-procedural taint analysis and data-flow tracing across multiple languages (PHP, JS, TS, Python, Java).
• Built-in Benchmarking: Includes an enterprise benchmark suite to measure detection rates and precision.