blitzstrike 1.0.23 → 1.0.25

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { createRequire } from "node:module";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
@@ -44,7 +43,6 @@ var __esm = (fn, res, err) => () => {
     throw err[0];
   return res;
 };
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS(function(exports) {
@@ -14822,10 +14820,10 @@ var require_src = __commonJS(function(exports, module) {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
-import { join as join8 } from "node:path";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync2 } from "node:fs";
+import { join as join9 } from "node:path";
 import { homedir as homedir4 } from "node:os";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function dirExists(p) {
   try {
@@ -14838,9 +14836,9 @@ function countFiles(dir) {
   try {
     let n = 0;
     const walk = (d) => {
-      for (const e of readdirSync4(d, { withFileTypes: true })) {
+      for (const e of readdirSync5(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join8(d, e.name));
+          walk(join9(d, e.name));
         else
           n++;
       }
@@ -14854,8 +14852,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync3(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join8(DATA_ROOT2, "payloads");
-  const templatesPath = join8(DATA_ROOT2, "templates");
+  const payloadsPath = join9(DATA_ROOT2, "payloads");
+  const templatesPath = join9(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -14865,8 +14863,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join8(ROOT5, "payloads");
-  const localTemplates = join8(ROOT5, "templates");
+  const localPayloads = join9(ROOT6, "payloads");
+  const localTemplates = join9(ROOT6, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -14879,23 +14877,23 @@ function syncData() {
   }
   const gitOk = spawnSync3("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join8(DATA_ROOT2, ".tmp-clone");
+    const tmp = join9(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
-      rmSync(tmp, { recursive: true, force: true });
+      rmSync2(tmp, { recursive: true, force: true });
     const r = spawnSync3("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
     if (r.status === 0) {
       const sparse = spawnSync3("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join8(tmp, "payloads"), payloadsPath);
+          copyDir(join9(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join8(tmp, "templates"), templatesPath);
+          copyDir(join9(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
-      rmSync(tmp, { recursive: true, force: true });
+      rmSync2(tmp, { recursive: true, force: true });
     }
   }
   return {
@@ -14912,19 +14910,19 @@ function copyDir(src, dst) {
 }
 function manualCopy(src, dst) {
   mkdirSync3(dst, { recursive: true });
-  for (const e of readdirSync4(src, { withFileTypes: true })) {
-    const s = join8(src, e.name);
-    const d = join8(dst, e.name);
+  for (const e of readdirSync5(src, { withFileTypes: true })) {
+    const s = join9(src, e.name);
+    const d = join9(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync2(d, readFileSync10(s));
+      writeFileSync4(d, readFileSync11(s));
   }
 }
-var ROOT5, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
+var ROOT6, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT5 = join8(fileURLToPath6(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join8(homedir4(), ".blitzstrike", "data");
+  ROOT6 = join9(fileURLToPath7(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join9(homedir4(), ".blitzstrike", "data");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -29649,7 +29647,7 @@ import { join as join4 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/memory.ts
-import { readFileSync as readFileSync2, appendFileSync, mkdirSync, existsSync } from "node:fs";
+import { readFileSync as readFileSync2, appendFileSync, mkdirSync, existsSync, writeFileSync } from "node:fs";
 import { join as join2 } from "node:path";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
@@ -29762,7 +29760,6 @@ function listMemory() {
   };
 }
 function forget(id) {
-  const { writeFileSync } = __require("node:fs");
   const entries = loadMemory();
   const kept = entries.filter((e) => e.id !== id);
   if (kept.length === entries.length) {
@@ -50392,6 +50389,423 @@ function resolveFinding(finding, verdict) {
   }
 }
 
+// src/cvss.ts
+var AV_WEIGHT = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
+var AC_WEIGHT = { L: 0.77, H: 0.44 };
+var PR_WEIGHT = {
+  U: { N: 0.85, L: 0.62, H: 0.27 },
+  C: { N: 0.85, L: 0.68, H: 0.5 }
+};
+var UI_WEIGHT = { N: 0.85, R: 0.62 };
+var CIA_WEIGHT = { H: 0.56, L: 0.22, N: 0 };
+function roundup(value) {
+  return Math.ceil(value * 10) / 10;
+}
+function cvssBaseScore(input) {
+  const AV = input.AV ?? "N";
+  const AC = input.AC ?? "L";
+  const PR = input.PR ?? "N";
+  const UI = input.UI ?? "N";
+  const S = input.S ?? "U";
+  const C = input.C ?? "N";
+  const I = input.I ?? "N";
+  const A = input.A ?? "N";
+  const iscBase = 1 - (1 - CIA_WEIGHT[C]) * (1 - CIA_WEIGHT[I]) * (1 - CIA_WEIGHT[A]);
+  let impact;
+  if (S === "U") {
+    impact = 6.42 * iscBase;
+  } else {
+    impact = 7.52 * (iscBase - 0.029) - 3.25 * Math.pow(iscBase - 0.02, 15);
+  }
+  const exploitability = 8.22 * AV_WEIGHT[AV] * AC_WEIGHT[AC] * PR_WEIGHT[S][PR] * UI_WEIGHT[UI];
+  if (impact <= 0)
+    return 0;
+  if (S === "U") {
+    return roundup(Math.min(impact + exploitability, 10));
+  }
+  return roundup(Math.min(1.08 * (impact + exploitability), 10));
+}
+function cvssVector(input) {
+  const order = [
+    ["AV", input.AV ?? "N"],
+    ["AC", input.AC ?? "L"],
+    ["PR", input.PR ?? "N"],
+    ["UI", input.UI ?? "N"],
+    ["S", input.S ?? "U"],
+    ["C", input.C ?? "N"],
+    ["I", input.I ?? "N"],
+    ["A", input.A ?? "N"]
+  ];
+  return "CVSS:3.1/" + order.map(([k, v]) => `${k}:${v}`).join("/");
+}
+function cvssSeverity(score) {
+  if (score === 0)
+    return "none";
+  if (score < 4)
+    return "low";
+  if (score < 7)
+    return "medium";
+  if (score < 9)
+    return "high";
+  return "critical";
+}
+function cvssAssess(input) {
+  const score = cvssBaseScore(input);
+  return { score, vector: cvssVector(input), severity: cvssSeverity(score) };
+}
+
+// src/dedup.ts
+function rootCauseSignature(finding) {
+  const sinkType = (finding.sink?.type ?? "unknown").toLowerCase();
+  const sourceType = (finding.source?.type ?? "unknown").toLowerCase();
+  const cwe = (finding.classification?.cwe ?? "").toUpperCase();
+  return [sinkType, sourceType, cwe].filter(Boolean).join("|");
+}
+function dedupFindings(findings) {
+  const groups = new Map;
+  for (const f of findings) {
+    const sig = rootCauseSignature(f);
+    const existing = groups.get(sig);
+    if (existing) {
+      existing.count += 1;
+      existing.findings.push(f);
+    } else {
+      groups.set(sig, { signature: sig, count: 1, representative: f, findings: [f] });
+    }
+  }
+  return [...groups.values()];
+}
+function uniqueFindings(findings) {
+  return dedupFindings(findings).map((g) => g.representative);
+}
+
+// src/report.ts
+function summarize(findings) {
+  const byStatus = {};
+  const bySeverity = {};
+  let evidenceArtifacts = 0;
+  for (const f of findings) {
+    byStatus[f.status] = (byStatus[f.status] ?? 0) + 1;
+    const sev = f.classification?.severity ?? "informational";
+    bySeverity[sev] = (bySeverity[sev] ?? 0) + 1;
+    evidenceArtifacts += f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
+  }
+  const groups = dedupFindings(findings);
+  return {
+    total_findings: findings.length,
+    unique_root_causes: groups.length,
+    by_status: byStatus,
+    by_severity: bySeverity,
+    confirmed: byStatus["confirmed"] ?? 0,
+    false_positives: byStatus["false_positive"] ?? 0,
+    evidence_artifacts: evidenceArtifacts
+  };
+}
+function severityLabel(sev) {
+  const s = sev.toUpperCase();
+  if (s === "CRITICAL")
+    return "\uD83D\uDD34 CRITICAL";
+  if (s === "HIGH")
+    return "\uD83D\uDFE0 HIGH";
+  if (s === "MEDIUM")
+    return "\uD83D\uDFE1 MEDIUM";
+  if (s === "LOW")
+    return "\uD83D\uDD35 LOW";
+  return "⚪ INFORMATIONAL";
+}
+function reportMarkdown(findings, opts = {}) {
+  const summary = summarize(findings);
+  const lines = [];
+  lines.push(`# ${opts.title ?? "Blitz Strike — Security Assessment Report"}`);
+  lines.push("");
+  lines.push(`- Scope: ${opts.scope ?? "(unset)"}`);
+  lines.push(`- Blitz Strike version: ${opts.version ?? "unknown"}`);
+  if (opts.include_timestamp)
+    lines.push(`- Generated: ${new Date().toISOString()}`);
+  lines.push("");
+  lines.push("## Summary");
+  lines.push("");
+  lines.push(`| Metric | Value |`);
+  lines.push(`|--------|-------|`);
+  lines.push(`| Total findings | ${summary.total_findings} |`);
+  lines.push(`| Unique root causes | ${summary.unique_root_causes} |`);
+  lines.push(`| Confirmed | ${summary.confirmed} |`);
+  lines.push(`| False positives | ${summary.false_positives} |`);
+  lines.push(`| Evidence artifacts | ${summary.evidence_artifacts} |`);
+  lines.push("");
+  lines.push("### By status");
+  lines.push("");
+  for (const [status, n] of Object.entries(summary.by_status).sort()) {
+    lines.push(`- ${status}: ${n}`);
+  }
+  lines.push("");
+  lines.push("### By severity");
+  lines.push("");
+  for (const [sev, n] of Object.entries(summary.by_severity).sort()) {
+    lines.push(`- ${sev}: ${n}`);
+  }
+  lines.push("");
+  lines.push("## Findings");
+  lines.push("");
+  if (findings.length === 0) {
+    lines.push("_No findings._");
+    return lines.join(`
+`) + `
+`;
+  }
+  for (const f of findings) {
+    lines.push(`### ${f.id} — ${f.title} [${severityLabel(f.classification?.severity ?? "informational")}]`);
+    lines.push("");
+    lines.push(`- **Status**: \`${f.status}\``);
+    lines.push(`- **Confidence**: ${f.confidence} (${f.confidence_level})`);
+    if (f.classification?.cwe)
+      lines.push(`- **CWE**: ${f.classification.cwe}`);
+    if (f.classification?.cvss_score != null)
+      lines.push(`- **CVSS**: ${f.classification.cvss_score} (${f.classification.cvss_vector ?? ""}) — ${cvssSeverity(f.classification.cvss_score)}`);
+    lines.push(`- **Source**: ${f.source?.type} \`${f.source?.name ?? ""}\``);
+    lines.push(`- **Sink**: ${f.sink?.type}${f.sink?.symbol ? ` \`${f.sink.symbol}\`` : ""}`);
+    if (f.target?.host || f.target?.endpoint)
+      lines.push(`- **Target**: ${[f.target.host, f.target.endpoint].filter(Boolean).join("")}`);
+    lines.push(`- **Evidence**: ${f.evidence?.length ?? 0} record(s)`);
+    if (f.remediation && Object.keys(f.remediation).length) {
+      lines.push(`- **Note**: ${JSON.stringify(f.remediation)}`);
+    }
+    lines.push("");
+  }
+  return lines.join(`
+`) + `
+`;
+}
+function reportJson(findings, opts = {}) {
+  const summary = summarize(findings);
+  const payload = {
+    title: opts.title ?? "Blitz Strike — Security Assessment Report",
+    scope: opts.scope ?? null,
+    version: opts.version ?? null,
+    summary,
+    findings,
+    integrity: sha256(JSON.stringify({ summary, findings }))
+  };
+  return JSON.stringify(payload, null, 2);
+}
+
+// src/benchmark.ts
+import { readFileSync as readFileSync9, readdirSync as readdirSync4, writeFileSync as writeFileSync2, rmSync } from "node:fs";
+import { join as join7 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+var ROOT4 = join7(fileURLToPath5(new URL(".", import.meta.url)), "..");
+var CORPUS = join7(ROOT4, "bench", "corpus");
+function parseCorpusFile(path) {
+  let text;
+  try {
+    text = readFileSync9(path, "utf8");
+  } catch {
+    return null;
+  }
+  const lines = text.split(`
+`);
+  let id = "";
+  let language = "php";
+  let vulnerable = true;
+  let sinkType;
+  let code = "";
+  let inCode = false;
+  let codeLang = "";
+  for (const line of lines) {
+    const m = line.match(/^\s*-\s*(id|language|vulnerable|sink_type)\s*:\s*(.+)$/i);
+    if (!inCode && m) {
+      const key = m[1].toLowerCase();
+      const val = m[2].trim();
+      if (key === "id")
+        id = val;
+      else if (key === "language")
+        language = val.toLowerCase();
+      else if (key === "vulnerable")
+        vulnerable = val === "true";
+      else if (key === "sink_type")
+        sinkType = val;
+      continue;
+    }
+    const start = line.match(/^```(\w*)/);
+    if (start && !inCode) {
+      inCode = true;
+      codeLang = start[1] || "php";
+      continue;
+    }
+    if (inCode && line.trim() === "```")
+      break;
+    if (inCode)
+      code += line + `
+`;
+  }
+  if (!id)
+    id = path.split("/").pop().replace(/\.md$/, "");
+  return { id, language: language || codeLang || "php", vulnerable, sink_type: sinkType, code: code.trim() };
+}
+function loadCorpus() {
+  let entries = [];
+  try {
+    for (const f of readdirSync4(CORPUS)) {
+      if (!f.endsWith(".md"))
+        continue;
+      const e = parseCorpusFile(join7(CORPUS, f));
+      if (e)
+        entries.push(e);
+    }
+  } catch {
+    entries = [];
+  }
+  return entries;
+}
+function detect(entry) {
+  const lang = entry.language;
+  if (lang === "php") {
+    const tmp = join7(ROOT4, "bench", ".tmp.php");
+    writeFileSync2(tmp, entry.code);
+    const r = analyzeTaint(tmp);
+    rmSync(tmp, { force: true });
+    if (r.findings.length > 0)
+      return { detected: true, sinkKind: r.findings[0].sink };
+    return { detected: false };
+  }
+  const ext = { javascript: ".js", typescript: ".ts", python: ".py", java: ".java" }[lang] ?? ".php";
+  const r = analyzeTaintUniversal(entry.code, "bench." + ext);
+  if (r.findings.length > 0)
+    return { detected: true, sinkKind: r.findings[0].sink };
+  return { detected: false };
+}
+function runBenchmark() {
+  const entries = loadCorpus();
+  const results = entries.map((entry) => {
+    const { detected, sinkKind } = detect(entry);
+    const outcome = entry.vulnerable ? detected ? "tp" : "fn" : detected ? "fp" : "tn";
+    return { entry, detected, sink_kind: sinkKind, outcome };
+  });
+  const tp = results.filter((r) => r.outcome === "tp").length;
+  const tn = results.filter((r) => r.outcome === "tn").length;
+  const fp = results.filter((r) => r.outcome === "fp").length;
+  const fn = results.filter((r) => r.outcome === "fn").length;
+  const total = results.length;
+  const detectionRate = tp + fn > 0 ? tp / (tp + fn) : 0;
+  const falsePositiveRate = fp + tn > 0 ? fp / (fp + tn) : 0;
+  const precision = tp + fp > 0 ? tp / (tp + fp) : 0;
+  return {
+    total_cases: total,
+    tp,
+    tn,
+    fp,
+    fn,
+    detection_rate: Number(detectionRate.toFixed(3)),
+    false_positive_rate: Number(falsePositiveRate.toFixed(3)),
+    precision: Number(precision.toFixed(3)),
+    results: results.map((r) => ({ id: r.entry.id, language: r.entry.language, outcome: r.outcome, sink: r.sink_kind }))
+  };
+}
+
+// src/coverage.ts
+var SINK_CLASSES = [
+  "sql_execution",
+  "code_execution",
+  "command_execution",
+  "file_operations",
+  "file_inclusion",
+  "deserialization",
+  "http_request",
+  "redirect",
+  "html_render",
+  "xml_processing",
+  "archive_extraction",
+  "path_traversal"
+];
+var PHP_SINKS2 = {
+  sql_execution: true,
+  code_execution: true,
+  command_execution: true,
+  file_operations: true,
+  file_inclusion: true,
+  deserialization: true,
+  http_request: true,
+  redirect: true,
+  html_render: true,
+  xml_processing: false,
+  archive_extraction: false,
+  path_traversal: true
+};
+var JS_SINKS2 = {
+  sql_execution: true,
+  code_execution: true,
+  command_execution: true,
+  file_operations: true,
+  file_inclusion: true,
+  deserialization: false,
+  http_request: true,
+  redirect: true,
+  html_render: true,
+  xml_processing: false,
+  archive_extraction: false,
+  path_traversal: true
+};
+var PY_SINKS2 = {
+  sql_execution: true,
+  code_execution: true,
+  command_execution: true,
+  file_operations: true,
+  file_inclusion: false,
+  deserialization: true,
+  http_request: false,
+  redirect: true,
+  html_render: true,
+  xml_processing: false,
+  archive_extraction: false,
+  path_traversal: true
+};
+var JAVA_SINKS2 = {
+  sql_execution: true,
+  code_execution: false,
+  command_execution: true,
+  file_operations: true,
+  file_inclusion: false,
+  deserialization: true,
+  http_request: true,
+  redirect: true,
+  html_render: true,
+  xml_processing: false,
+  archive_extraction: false,
+  path_traversal: true
+};
+var SINK_BY_LANG = {
+  php: PHP_SINKS2,
+  javascript: JS_SINKS2,
+  python: PY_SINKS2,
+  java: JAVA_SINKS2
+};
+function coverageMatrix() {
+  const langs = listLanguages();
+  const sinkCoverage = SINK_CLASSES.map((sink) => {
+    const covered = langs.map((l) => l.language).filter((lang) => SINK_BY_LANG[lang]?.[sink] === true);
+    return { sink, languages: covered };
+  });
+  let coveredPairs = 0;
+  for (const lang of langs) {
+    for (const sink of SINK_CLASSES) {
+      if (SINK_BY_LANG[lang.language]?.[sink])
+        coveredPairs += 1;
+    }
+  }
+  const totalPairs = langs.length * SINK_CLASSES.length;
+  return {
+    languages: langs,
+    sink_coverage: sinkCoverage,
+    counts: {
+      languages: langs.length,
+      sink_classes: SINK_CLASSES.length,
+      covered_pairs: coveredPairs,
+      total_pairs: totalPairs
+    },
+    coverage_ratio: Number((coveredPairs / totalPairs).toFixed(3))
+  };
+}
+
 // src/server.ts
 function createServer() {
   const server = new McpServer({
@@ -51084,6 +51498,73 @@ function createServer() {
     });
     return { content: [{ type: "text", text: JSON.stringify({ ...r, next_steps: guidance }) }] };
   });
+  server.registerTool("cvss_score", {
+    title: "Compute CVSS v3.1 base score",
+    description: "CVSS: compute a deterministic CVSS v3.1 base score + vector + severity from metric values (AV/AC/PR/UI/S/C/I/A). Self-computed, not read from NVD.",
+    inputSchema: {
+      AV: string2().optional().describe("Attack Vector: N/A/L/P"),
+      AC: string2().optional().describe("Attack Complexity: L/H"),
+      PR: string2().optional().describe("Privileges Required: N/L/H"),
+      UI: string2().optional().describe("User Interaction: N/R"),
+      S: string2().optional().describe("Scope: U/C"),
+      C: string2().optional().describe("Confidentiality: H/L/N"),
+      I: string2().optional().describe("Integrity: H/L/N"),
+      A: string2().optional().describe("Availability: H/L/N")
+    }
+  }, async (input) => {
+    return { content: [{ type: "text", text: JSON.stringify(cvssAssess(input)) }] };
+  });
+  server.registerTool("dedup_findings", {
+    title: "Deduplicate findings by root cause",
+    description: "FINDINGS: collapse a list of findings that share a root cause (sink type + source type + CWE) into one group per root cause.",
+    inputSchema: {
+      findings: string2().describe("JSON array of Finding objects")
+    }
+  }, async ({ findings }) => {
+    let list;
+    try {
+      list = JSON.parse(findings);
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid JSON" }) }] };
+    }
+    const groups = dedupFindings(list);
+    const unique = uniqueFindings(list);
+    return { content: [{ type: "text", text: JSON.stringify({ groups: groups.map((g) => ({ signature: g.signature, count: g.count, representative: g.representative.id })), unique_findings: unique.map((f) => f.id) }) }] };
+  });
+  server.registerTool("generate_report", {
+    title: "Generate a reproducible report",
+    description: "REPORT: emit a deterministic markdown (or JSON) report from canonical Findings, with summary + integrity hash. Reproducible: same findings -> byte-identical output.",
+    inputSchema: {
+      findings: string2().describe("JSON array of Finding objects"),
+      format: _enum(["markdown", "json"]).optional().describe("Report format"),
+      title: string2().optional().describe("Report title"),
+      scope: string2().optional().describe("Scope description")
+    }
+  }, async ({ findings, format, title, scope }) => {
+    let list;
+    try {
+      list = JSON.parse(findings);
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid JSON" }) }] };
+    }
+    const opts = { title, scope, version: "1.0.23" };
+    const out = (format ?? "markdown") === "json" ? reportJson(list, opts) : reportMarkdown(list, opts);
+    return { content: [{ type: "text", text: out }] };
+  });
+  server.registerTool("run_benchmark", {
+    title: "Run the benchmark suite",
+    description: "BENCHMARK: run the labelled corpus and report detection rate, false-positive rate, and precision. The quality metric, not the tool count.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(runBenchmark()) }] };
+  });
+  server.registerTool("coverage_matrix", {
+    title: "Report coverage matrix",
+    description: "BENCHMARK: enumerate language × sink-class coverage (which languages detect which sink types), plus the coverage ratio.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(coverageMatrix()) }] };
+  });
   return server;
 }
 async function serve() {
@@ -51093,12 +51574,12 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync9, existsSync as existsSync5, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join7, dirname } from "node:path";
+import { readFileSync as readFileSync10, existsSync as existsSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join8, dirname } from "node:path";
 import { homedir as homedir3 } from "node:os";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { spawnSync as spawnSync2 } from "node:child_process";
-var ROOT4 = join7(fileURLToPath5(new URL(".", import.meta.url)), "..");
+var ROOT5 = join8(fileURLToPath6(new URL(".", import.meta.url)), "..");
 function which(cmd) {
   return spawnSync2(`command -v ${cmd}`, { shell: true }).status === 0;
 }
@@ -51133,7 +51614,7 @@ function runDoctor() {
     detail: fofa ? "set" : "FOFA_EMAIL/FOFA_KEY not set",
     fix: fofa ? undefined : "export FOFA_EMAIL=... && export FOFA_KEY=... (enables fofa_search)"
   });
-  const dataOk = existsSync5(join7(ROOT4, "chains.json")) && existsSync5(join7(ROOT4, "tools-catalog.json"));
+  const dataOk = existsSync5(join8(ROOT5, "chains.json")) && existsSync5(join8(ROOT5, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -51161,21 +51642,21 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join7(ROOT4, "src", "index.ts");
+  const src = join8(ROOT5, "src", "index.ts");
   if (which("bun") && existsSync5(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join7(ROOT4, "dist", "index.js");
+  const dist = join8(ROOT5, "dist", "index.js");
   if (existsSync5(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync9(p, "utf8"));
+    return JSON.parse(readFileSync10(p, "utf8"));
   } catch {
     return null;
   }
@@ -51190,7 +51671,7 @@ function jsonMcpServersWrite(p) {
       ...existing.mcpServers ?? {},
       blitzstrike: { command, args }
     };
-    writeFileSync(p, JSON.stringify(existing, null, 2));
+    writeFileSync3(p, JSON.stringify(existing, null, 2));
   };
 }
 function opencodeWrite(p) {
@@ -51203,22 +51684,22 @@ function opencodeWrite(p) {
       ...existing.mcp ?? {},
       blitzstrike: { type: "local", command: ["npx", "-y", "blitzstrike", "serve", "--mcp"], enabled: true }
     };
-    writeFileSync(p, JSON.stringify(existing, null, 2));
+    writeFileSync3(p, JSON.stringify(existing, null, 2));
     copyOpenCodeAgents();
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join7(ROOT4, "opencode-agents");
-  const dstDir = join7(homedir3(), ".config", "opencode", "agents");
+  const srcDir = join8(ROOT5, "opencode-agents");
+  const dstDir = join8(homedir3(), ".config", "opencode", "agents");
   if (!existsSync5(srcDir))
     return;
   if (!existsSync5(dstDir))
     mkdirSync2(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join7(srcDir, f);
-    const dst = join7(dstDir, f);
+    const src = join8(srcDir, f);
+    const dst = join8(dstDir, f);
     if (existsSync5(src)) {
-      writeFileSync(dst, readFileSync9(src, "utf8"));
+      writeFileSync3(dst, readFileSync10(src, "utf8"));
     }
   }
 }
@@ -51227,7 +51708,7 @@ function codexWrite(p) {
     const dir = dirname(p);
     if (!existsSync5(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync5(p) ? readFileSync9(p, "utf8") : "";
+    let existing = existsSync5(p) ? readFileSync10(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -51238,7 +51719,7 @@ function codexWrite(p) {
 command = "${command}"
 args = ${JSON.stringify(args)}
 `;
-    writeFileSync(p, existing);
+    writeFileSync3(p, existing);
   };
 }
 function hermesWrite(p) {
@@ -51246,7 +51727,7 @@ function hermesWrite(p) {
     const dir = dirname(p);
     if (!existsSync5(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync5(p) ? readFileSync9(p, "utf8") : "";
+    let existing = existsSync5(p) ? readFileSync10(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -51267,80 +51748,80 @@ mcp_servers:
     args: ${JSON.stringify(args)}
 `;
     }
-    writeFileSync(p, existing);
+    writeFileSync3(p, existing);
   };
 }
 function detectAgents() {
   const home = homedir3();
   const agents = [];
-  const claudeJson = join7(home, ".claude.json");
+  const claudeJson = join8(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
     installed: () => existsSync5(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join7(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join8(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
     installed: () => existsSync5(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join7(home, ".cursor", "mcp.json");
+  const cursor = join8(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync5(join7(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync5(join8(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join7(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join8(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync5(join7(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync5(join8(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join7(home, ".codex", "config.toml");
+  const codex = join8(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync5(join7(home, ".codex")) || which("codex"),
+    installed: () => existsSync5(join8(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join7(home, ".hermes", "config.yaml");
+  const hermes = join8(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync5(join7(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync5(join8(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join7(home, ".gemini", "settings.json");
+  const gemini = join8(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync5(join7(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync5(join8(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join7(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join8(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync5(join7(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync5(join8(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join7(home, ".copilot", "mcp.json");
+  const copilot = join8(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync5(join7(home, ".copilot")),
+    installed: () => existsSync5(join8(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join7(home, ".cline", "mcp_settings.json");
+  const cline = join8(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync5(join7(home, ".cline")),
+    installed: () => existsSync5(join8(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -51384,15 +51865,15 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync11, existsSync as existsSync6 } from "node:fs";
-import { join as join9 } from "node:path";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
-var ROOT6 = join9(fileURLToPath7(new URL(".", import.meta.url)), "..");
+import { readFileSync as readFileSync12, existsSync as existsSync6 } from "node:fs";
+import { join as join10 } from "node:path";
+import { fileURLToPath as fileURLToPath8 } from "node:url";
+var ROOT7 = join10(fileURLToPath8(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join9(ROOT6, "package.json");
+    const p = join10(ROOT7, "package.json");
     if (existsSync6(p))
-      return JSON.parse(readFileSync11(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync12(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.23",
+  "version": "1.0.25",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {
@@ -29,8 +29,9 @@
     "serve": "bun run src/index.ts serve",
     "doctor": "bun run src/index.ts doctor",
     "compile": "bun build src/index.ts --compile --outfile dist/blitzstrike",
-    "test": "bun test",
-    "prepublishOnly": "bun run typecheck && bun run build"
+    "test": "bun run test/verify.ts",
+    "prepublishOnly": "bun run typecheck && bun run build",
+    "bench": "bun run test/verify.ts"
   },
   "keywords": [
     "mcp",