What you can do with Blitzstrike

4 use cases

• Triage a source tree for reachable, unauthenticated sinks

  Let an agent scan your code and report sinks that are reachable without auth, with file and line references.

  • Blitzstrike
  • Claude Code
  • Cursor
  • Codex
  • Gemini CLI
  • Security and science
  • Intermediate
  View prompt

  Using the blitzstrike MCP server, call run_engagement with target <path to source tree> and max_files <number>. Return the findings grouped by chain, each with file and line references. Verify that every finding names a source and a sink that the tool traced, not only a matched pattern.

  Share Save

• Verify live web findings with marker and control tests

  Check a scope, then let the agent confirm live findings with marker reflection and a negative control.

  • Blitzstrike
  • Claude Code
  • Cursor
  • Codex
  • Gemini CLI
  • Security and science
  • Advanced
  View prompt

  Using the blitzstrike MCP server, call scope_check for target <authorized URL> with scope <written scope>, then run_engagement on that target. For each candidate, call strike_verify and report only the findings with a live verdict. Verify that no request was sent to a host outside the scope.

  Share Save

• Score, dedupe, and report findings for a write-up

  Turn a raw findings list into a deduplicated, CVSS-scored report with an integrity hash.

  • Blitzstrike
  • Claude Code
  • Cursor
  • Codex
  • Gemini CLI
  • Security and science
  • Intermediate
  View prompt

  Using the blitzstrike MCP server, call dedup_findings on <findings list>, then cvss_score for each group, then generate_report in <markdown or json>. Return the report with a summary and the SHA-256 integrity hash. Verify that every group has a CVSS base score and severity.

  Share Save

• Look up CVEs and known issues for a tech stack

  Query NVD and the tech correlation data to see which known issues match a product or version you run.

  • Blitzstrike
  • Claude Code
  • Cursor
  • Codex
  • Gemini CLI
  • Security and science
  • Intermediate
  View prompt

  Using the blitzstrike MCP server, call nvd_lookup for <CVE ID> and tech_correlation for <technology name>. Return the matching CVEs with their severity and the related product. Verify that each listed CVE is confirmed against the version you run before you act on it.

  Share Save

How to use Blitzstrike

1. Check you have what it needs: Node.js (for npx) or Bun, plus an MCP-compatible agent such as Claude Code, Cursor, Codex, or Gemini CLI; For source audits: a local source tree you are allowed to scan; For live tests: written authorization for the target and a defined scope.
2. Open shinthink/blitzstrike on GitHub and read the README and license.
3. Run npx -y blitzstrike doctor to verify the runtime and the tool catalog.
4. Run npx -y blitzstrike install to register Blitz Strike with the agent CLIs it detects.
5. Restart your agent and ask it to "audit ./src" or point it at your source tree path.
6. Read each returned finding and open the referenced file and line to confirm the sink is reachable.

These steps come from our top use case, Triage a source tree for reachable, unauthenticated sinks, which also has a copy-paste agent prompt.

Blitzstrike alternatives · Best AI repos for Security and science

About this repo

• Who it is forDevelopers and security reviewers who run source or live security audits through an MCP-compatible AI agent.
• Why it is hot
• LanguageTypeScript
• Sourcegithub.com/shinthink/blitzstrike · Back to Hot repos

Requirements

• Node.js (for npx) or Bun, plus an MCP-compatible agent such as Claude Code, Cursor, Codex, or Gemini CLI
• For source audits: a local source tree you are allowed to scan
• For live tests: written authorization for the target and a defined scope
• Optional: FOFA_EMAIL and FOFA_KEY if you want FOFA asset search

Related repos

• Trended earlier Rea A plug-in that lets your AI agent take apart an app and explain how a feature works.
• Trended earlier Reverify Reverify is a Python toolkit and MCP server where deterministic tools verify every AI claim about a binary or code before it counts as fact.
• Trended earlier Ablation Ablation is a self-contained reverse engineering framework that, when used with Codex or Claude Code, works as an autonomous reverse engineering system.