Blitz Strike
A universal MCP security-audit server that runs a three-tier penetration-testing methodology, reconnaissance, source-to-sink analysis and live validation, so a finding is confirmed before it is ever reported.
Blitz Strike is a Model Context Protocol server that packages a structured penetration-testing methodology as callable tools, runnable from Claude Code, Cursor, Hermes, OpenCode, Claude Desktop, Gemini or any MCP client, with a single call able to run a whole engagement server-side. It works in three tiers: a reconnaissance tier that enumerates the exposed attack surface at scale, including unauthenticated entry points and dangerous sinks; a static-analysis tier that traces source-to-sink reachability and confirms whether a sink is reachable, unauthenticated and exploitable rather than merely present; and a validation tier that performs live verification, including marker reflection and negative controls, scope enforcement and orchestration, so nothing is reported until it has been confirmed.
Beyond the three tiers, it also includes a Web3 audit mode that combines deterministic Solidity analysis with an executable Foundry proof, a live logic-bug prober that combines sibling enumeration with differential insecure-direct-object-reference testing, a watchlist for known vulnerabilities tied to DNS sinkhole detection, and out-of-band proof for blind vulnerabilities.
It is written in TypeScript and runs on Bun.