shinthink/blitzstrike
⚡ Blitz Strike — a universal MCP penetration-testing toolbelt. Structured methodology: reconnaissance & attack-surface mapping, source-to-sink analysis, and live validation. 57 escalation chains, 130-tool catalog, intelligence data layer. One server, every agent.
Older snapshot: check the original source for current information.
From the publisher
README & documentation
Source previewRead the project’s overview, installation instructions and usage examples. The original README is the source of truth.
[](https://github.com/shinthink/blitzstrike/releases) [](https://github.com/shinthink/blitzstrike/stargazers) [](LICENSE) [](https://www.typescriptlang.org/) [](https://bun.sh) [](https://modelcontextprotocol.io) Reconnaissance at speed. Analysis in depth. Validation before report. Blitz Strike is a structured penetration-testing methodology — reconnaissance, source analysis, and validation — delivered as a universal MCP server. It enumerates the attack surface (BLITZ), traces source-to-sink reachability (EAGLE-EYE), and verifies each finding live before it is reported (STRIKE). One server, every agent: scope enforcement to submission-ready findings in a single runengagement call, with the relevant exploit-tool manual attached to every result. Blitz Strike is a Model Context Protocol (MCP) server (TypeScript / Bun) that packages a 3-tier security-audit methodology as callable tools — and runs the whole engagement server-side, so a single runengagement call works from Claude Code, Cursor, Hermes, OpenCode, Claude Desktop, Gemini, or any MCP client. Blitz Strike maps a structured penetration-testing methodology — reconnaissance, source analysis, and validation — into three tool tiers executed server-side. Reconnaissance → analysis → validation.…
Read the full README ↗ · Preview checked 2026-10-29T10:24:47.979Z
Inside the original README — Document outline
- Blitz Strike
- What it does
- The three tiers
- Autonomous, LLM-driven
- Why TypeScript / Bun
- Quickstart (30 seconds)
- Client Configuration (works in any MCP client)
- CLI
- What doctor checks
- What install does
- Tools
- BLITZ — attack-surface triage
Headings are captured from the source. Links open the publisher’s document, not a locally hosted copy.
Links from the README
References supplied by the publisher, not independently verified endorsements. Check the destination before downloading files or entering credentials.
Documentation belongs to its respective authors. Reported project/model license: MIT. A listing is not a grant of reuse or training rights. Confirm the document’s own terms at the source.
What this repository does
⚡ Blitz Strike — a universal MCP penetration-testing toolbelt. Structured methodology: reconnaissance & attack-surface mapping, source-to-sink analysis, and live validation. 57 escalation chains, 130-tool catalog, intelligence data layer. One server, every agent.
Repository facts
- Owner
- shinthink
- Primary language
- TypeScript
- Stars
- 636
- Forks
- 1
- Open issues + pull requests
- 0
- License
- MIT
- Archived
- No
- Default branch
- main
- Created
- 2026-09-12T12:13:09.000Z
- Last push
- 2026-09-18T11:46:32.000Z
Topics and intended use
Owner-supplied topics: active-directory, blue-team, bug-bounty, cve, defensive-security, exploit, mcp, mcp-server, nuclei, offensive-security, payloads, pentest, reconnaissance, red-team, reverse-engineering, security, security-tools, vulnerability-scanning, wordpress
Review the README for scope, installation, examples and limitations. We do not run repository code or certify it.
Evaluate before installing
Review licensing and dependencies, inspect recent commits and unresolved issues, and test in an isolated environment before production use. Stars and forks alone cannot answer these questions.
Source and freshness
Source: GitHub. Metadata observed 2026-09-19T06:40:10.448Z. Daily imports are snapshots, not real-time monitoring.
Popularity and source listings do not establish security, suitability, licensing rights or benchmark performance.