DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to triage a source tree for reachable, unauthenticated sinks with Blitzstrike

Let an agent scan your code and report sinks that are reachable without auth, with file and line references.

  • Top pick
  • Security and science
  • Intermediate
  • 15 minutes
  • From the README
  • Claude Code
  • Cursor
  • Codex
  • Gemini CLI

Authorization notice. Blitzstrike is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Who it is forA developer or reviewer preparing a codebase for release who needs a shorter list than a plain pattern scanner gives.

The problemPattern matching alone flags many lines that are never reachable from an outside request, which wastes review time.

The outcomeA list of findings with file:line references, traced from source to sink and enriched with escalation chains where a match exists.

What you need first

  • Node.js (for npx) or Bun, plus an MCP-compatible agent such as Claude Code, Cursor, Codex, or Gemini CLI
  • For source audits: a local source tree you are allowed to scan
  • For live tests: written authorization for the target and a defined scope
  • Optional: FOFA_EMAIL and FOFA_KEY if you want FOFA asset search

Steps

  1. Run npx -y blitzstrike doctor to verify the runtime and the tool catalog.
  2. Run npx -y blitzstrike install to register Blitz Strike with the agent CLIs it detects.
  3. Restart your agent and ask it to "audit ./src" or point it at your source tree path.
  4. Read each returned finding and open the referenced file and line to confirm the sink is reachable.
  5. Keep only the findings you can explain, and note which ones still need a live test.

Prompt for your agent

Using the blitzstrike MCP server, call run_engagement with target <path to source tree> and max_files <number>. Return the findings grouped by chain, each with file and line references. Verify that every finding names a source and a sink that the tool traced, not only a matched pattern.

Caveat. Blitz Strike findings are hypotheses from static analysis and should be confirmed by reading the code and, where relevant, a live test.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page