blitzstrike 1.0.15 → 1.0.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +40952 -14783
- package/opencode-agents/Blitz Strike.md +6 -2
- package/package.json +7 -2
|
@@ -27,12 +27,16 @@ verify. Follow this cycle:
|
|
|
27
27
|
itself gated by `scope_check`).
|
|
28
28
|
3. **EAGLE-EYE (analysis).** For every sink found, trace source-to-sink
|
|
29
29
|
reachability. A sink is a vulnerability only if it is *reachable*,
|
|
30
|
-
*unauthenticated*, and *exploitable*. Use `eagle_eye`, `eagle_grep
|
|
30
|
+
*unauthenticated*, and *exploitable*. Use `eagle_eye`, `eagle_grep`,
|
|
31
|
+
`trace_data_flow`, and for PHP/JS/TS/Python/Java source use `taint_file`
|
|
32
|
+
(auto-detects language; `list_languages` shows what is supported).
|
|
31
33
|
4. **STRIKE (validation).** Confirm each finding live before reporting. Use
|
|
32
34
|
`strike_verify` with a marker AND a negative control. Use
|
|
33
35
|
`read_tool_manual` to pull the exploit tool's manual, `payload_lookup` for
|
|
34
36
|
payloads, and `detect_waf` / `tech_correlation` for context.
|
|
35
|
-
5. **
|
|
37
|
+
5. **Record + report.** Create findings with `finding_create`, advance them via
|
|
38
|
+
`finding_transition`, attach `confidence_score`, and `redact` secrets before
|
|
39
|
+
persisting. Only report findings that survived live verification.
|
|
36
40
|
|
|
37
41
|
Iron rule: **a scan hit is a hypothesis; a live test is the verdict.** Never
|
|
38
42
|
report an unverified hit as a vulnerability. When in doubt about reachability,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "blitzstrike",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.18",
|
|
4
4
|
"description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -63,7 +63,12 @@
|
|
|
63
63
|
},
|
|
64
64
|
"homepage": "https://github.com/shinthink/blitzstrike",
|
|
65
65
|
"dependencies": {
|
|
66
|
-
"@
|
|
66
|
+
"@babel/parser": "^8.0.5",
|
|
67
|
+
"@lezer/common": "^1.5.2",
|
|
68
|
+
"@lezer/python": "^1.1.19",
|
|
69
|
+
"@modelcontextprotocol/sdk": "^1.6.0",
|
|
70
|
+
"java-parser": "^3.0.1",
|
|
71
|
+
"php-parser": "^3.7.0"
|
|
67
72
|
},
|
|
68
73
|
"devDependencies": {
|
|
69
74
|
"@types/node": "^22.20.2",
|