blitzstrike 2.4.6 → 2.4.8

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.8] — 2026-09-14
+
+### Added — MCP integration health checks
+
+- New `checkMcpServers` (`src/mcp-status.ts`): verifies external MCP
+  integrations are actually present/connected — chrome-devtools-mcp (stdio:
+  binary or npx auto-install) and burp-suite-mcp (SSE: alive only when Burp is
+  running with the extension loaded).
+- `blitzstrike doctor` now reports both MCP servers with availability + fix hints.
+- New MCP tool `check_mcp` to probe MCP integration status on demand.
+
+## [2.4.7] — 2026-09-14
+
+### Added — deterministic arbitrary-file-read verification (no bare hypotheses)
+
+- New `verifyFileRead` (STRIKE): verifies a CWE-22 / path-traversal / LFI
+  hypothesis by reading a marker file (`/etc/passwd`) vs a non-existent
+  negative-control path, then comparing. Confirmed only when the marker returns
+  file content and the control does not — never from reasoning alone.
+- Supports raw POST body (`bodyRaw`) and named query/body param injection.
+- New MCP tool `verify_file_read` + chain hints `verify_file_read` /
+  `path_traversal` / `lfi` / `file_read` route to it; `strike_verify` now
+  auto-routes file-read findings to the file-read verifier.
+- A gated endpoint (e.g. identical 500 auth wall) now returns an explicit
+  `unconfirmed` verdict with reason instead of leaving a bare hypothesis.
+
 ## [2.4.6] — 2026-09-14
 
 ### Added — chrome-devtools-mcp auto-install (npx zero-install fallback)

package/dist/index.js

@@ -7667,6 +7667,95 @@ var init_catalog = __esm(() => {
   ROOT2 = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
 });
 
+// src/burp-mcp.ts
+async function fetchTimeout(url, init = {}, timeoutMs = 8000) {
+  const ctrl = new AbortController;
+  const t = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...init, signal: ctrl.signal });
+  } finally {
+    clearTimeout(t);
+  }
+}
+function sseMessage(text) {
+  const m = text.match(/event:\s*message[\s\S]*?data:\s*([^\n]+)/);
+  return m ? m[1].trim() : null;
+}
+async function driveBurpMCP(baseUrl = DEFAULT_BURP_URL, timeoutMs = 1e4) {
+  const base = baseUrl.replace(/\/+$/, "");
+  let sseRes;
+  try {
+    sseRes = await fetchTimeout(`${base}/sse`, { headers: { Accept: "text/event-stream" } }, timeoutMs);
+  } catch (e) {
+    return { ok: false, alive: false, base_url: base, error: `Burp MCP not reachable at ${base}/sse (${String(e)}) — start Burp + load the MCP extension` };
+  }
+  if (!sseRes.ok) {
+    return {
+      ok: false,
+      alive: false,
+      base_url: base,
+      error: `Burp MCP SSE endpoint returned HTTP ${sseRes.status} — is the extension enabled in Burp → MCP?`
+    };
+  }
+  let endpoint = null;
+  let serverInfo = "";
+  let toolsRaw = "";
+  try {
+    const reader = sseRes.body.getReader();
+    const decoder = new TextDecoder;
+    let buf = "";
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      const { value, done } = await reader.read();
+      if (done)
+        break;
+      buf += decoder.decode(value, { stream: true });
+      if (!endpoint) {
+        const em = buf.match(/event:\s*endpoint[\s\S]*?data:\s*([^\n]+)/);
+        if (em)
+          endpoint = em[1].trim();
+      }
+      if (endpoint)
+        break;
+    }
+    if (endpoint) {
+      const postUrl = new URL(endpoint, base).toString();
+      const initRes = await fetchTimeout(postUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 1,
+          method: "initialize",
+          params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "blitzstrike", version: "2" } }
+        })
+      }, timeoutMs);
+      const initText = await initRes.text();
+      const initMsg = sseMessage(initText) ?? (initText.includes("result") ? initText : "");
+      serverInfo = initMsg.slice(0, 600);
+      const toolsRes = await fetchTimeout(postUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} })
+      }, timeoutMs);
+      const toolsText = await toolsRes.text();
+      toolsRaw = (sseMessage(toolsText) ?? toolsText).slice(0, 3000);
+    }
+  } catch (e) {
+    return { ok: true, alive: true, base_url: base, endpoint, error: `SSE stream opened but handshake failed: ${String(e)}` };
+  }
+  if (!endpoint) {
+    return {
+      ok: true,
+      alive: true,
+      base_url: base,
+      error: "SSE stream open but no endpoint event received — Burp MCP extension may not be fully enabled"
+    };
+  }
+  return { ok: true, alive: true, base_url: base, endpoint, server: serverInfo, tools: toolsRaw };
+}
+var DEFAULT_BURP_URL = "http://127.0.0.1:9876";
+
 // node_modules/php-parser/src/lexer/attribute.js
 var require_attribute = __commonJS(function(exports, module) {
   module.exports = {
@@ -15295,12 +15384,39 @@ var require_src = __commonJS(function(exports, module) {
   module.exports.default = Engine;
 });
 
+// src/mcp-status.ts
+import { existsSync as existsSync8 } from "node:fs";
+import { spawnSync as spawnSync3 } from "node:child_process";
+async function checkMcpServers() {
+  const out = [];
+  const bin = ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"].find((p) => existsSync8(p));
+  const npxOk = spawnSync3("npx", ["--version"], { timeout: 8000 }).error === undefined;
+  const devtoolsOk = Boolean(bin) || npxOk;
+  out.push({
+    name: "chrome-devtools-mcp",
+    available: devtoolsOk,
+    kind: "stdio",
+    detail: bin ? `installed at ${bin}` : npxOk ? "not installed — will auto-install via npx on first use" : "not installed (no npx either)",
+    fix: devtoolsOk ? undefined : "install Node/npm, then `npm i -g chrome-devtools-mcp`"
+  });
+  const burp = await driveBurpMCP("http://127.0.0.1:9876", 4000);
+  out.push({
+    name: "burp-suite-mcp",
+    available: burp.alive,
+    kind: "sse",
+    detail: burp.alive ? `alive at ${burp.base_url}${burp.endpoint ? ` (endpoint ${burp.endpoint})` : ""}` : burp.error ?? "not reachable",
+    fix: burp.alive ? undefined : "build PortSwigger/mcp-server (`./gradlew embedProxyJar`) + load the JAR in Burp → Extensions, then enable the MCP extension"
+  });
+  return out;
+}
+var init_mcp_status = () => {};
+
 // src/sync.ts
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync6, readFileSync as readFileSync18, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
 import { join as join16 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
   try {
     return statSync4(p).isDirectory();
@@ -15351,14 +15467,14 @@ function syncData() {
     copyDir(localTemplates, templatesPath);
     templatesSynced = true;
   }
-  const gitOk = spawnSync3("git", ["--version"]).status === 0;
+  const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
     const tmp = join16(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync4(tmp, { recursive: true, force: true });
-    const r = spawnSync3("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
+    const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
     if (r.status === 0) {
-      const sparse = spawnSync3("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
+      const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
           copyDir(join16(tmp, "payloads"), payloadsPath);
@@ -15379,7 +15495,7 @@ function syncData() {
   };
 }
 function copyDir(src, dst) {
-  const r = spawnSync3("cp", ["-r", src, dst], { timeout: 120000 });
+  const r = spawnSync4("cp", ["-r", src, dst], { timeout: 120000 });
   if (r.status !== 0) {
     manualCopy(src, dst);
   }
@@ -15443,7 +15559,7 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync20, existsSync as existsSync9 } from "node:fs";
+import { readFileSync as readFileSync20, existsSync as existsSync10 } from "node:fs";
 import { join as join17 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { execSync as execSync4 } from "node:child_process";
@@ -15483,7 +15599,7 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync9(join17(ROOT8, "package-lock.json")) || existsSync9(join17(ROOT8, "bun.lock")) || existsSync9(join17(ROOT8, "bun.lockb"));
+  return existsSync10(join17(ROOT8, "package-lock.json")) || existsSync10(join17(ROOT8, "bun.lock")) || existsSync10(join17(ROOT8, "bun.lockb"));
 }
 var ROOT8;
 var init_release = __esm(() => {
@@ -15525,20 +15641,20 @@ var init_dependency = __esm(() => {
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync22, existsSync as existsSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "node:fs";
+import { readFileSync as readFileSync22, existsSync as existsSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "node:fs";
 import { join as join19, dirname as dirname2 } from "node:path";
 import { homedir as homedir6 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
-  return spawnSync4(`command -v ${cmd}`, { shell: true }).status === 0;
+  return spawnSync5(`command -v ${cmd}`, { shell: true }).status === 0;
 }
 function installedCount() {
   const tools = loadTools();
   const installed = tools.filter((t) => which(t.name)).map((t) => t.name);
   return { total: tools.length, installed, missing: tools.map((t) => t.name).filter((n) => !installed.includes(n)) };
 }
-function runDoctor() {
+async function runDoctor() {
   console.log(`BlitzStrike doctor — environment health check
 `);
   const issues = [];
@@ -15571,7 +15687,7 @@ function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync10(join19(ROOT10, "chains.json")) && existsSync10(join19(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync11(join19(ROOT10, "chains.json")) && existsSync11(join19(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -15592,6 +15708,15 @@ function runDoctor() {
     detail: deps.safe ? `${deps.total_dependencies} deps, no install scripts` : `${deps.install_scripts.length} install script(s) + ${deps.git_dependencies.length} git dep(s)`,
     fix: deps.safe ? undefined : "remove install-time scripts and git dependencies"
   });
+  const mcps = await checkMcpServers();
+  for (const m of mcps) {
+    issues.push({
+      name: `MCP: ${m.name}`,
+      status: m.available ? "ok" : "warn",
+      detail: m.detail,
+      fix: m.fix
+    });
+  }
   const symbol = { ok: "OK  ", warn: "WARN", fail: "FAIL" };
   for (const i of issues) {
     console.log(`${symbol[i.status]}  ${i.name}  ${i.detail}`);
@@ -15614,14 +15739,14 @@ function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
   const src = join19(ROOT10, "src", "index.ts");
-  if (which("bun") && existsSync10(src))
+  if (which("bun") && existsSync11(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
   const dist = join19(ROOT10, "dist", "index.js");
-  if (existsSync10(dist))
+  if (existsSync11(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
@@ -15635,7 +15760,7 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync10(dir))
+    if (!existsSync11(dir))
       mkdirSync5(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
@@ -15648,7 +15773,7 @@ function jsonMcpServersWrite(p) {
 function opencodeWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync10(dir))
+    if (!existsSync11(dir))
       mkdirSync5(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
@@ -15662,14 +15787,14 @@ function opencodeWrite(p) {
 function copyOpenCodeAgents() {
   const srcDir = join19(ROOT10, "opencode-agents");
   const dstDir = join19(homedir6(), ".config", "opencode", "agents");
-  if (!existsSync10(srcDir))
+  if (!existsSync11(srcDir))
     return;
-  if (!existsSync10(dstDir))
+  if (!existsSync11(dstDir))
     mkdirSync5(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
     const src = join19(srcDir, f);
     const dst = join19(dstDir, f);
-    if (existsSync10(src)) {
+    if (existsSync11(src)) {
       writeFileSync7(dst, readFileSync22(src, "utf8"));
     }
   }
@@ -15677,9 +15802,9 @@ function copyOpenCodeAgents() {
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync10(dir))
+    if (!existsSync11(dir))
       mkdirSync5(dir, { recursive: true });
-    let existing = existsSync10(p) ? readFileSync22(p, "utf8") : "";
+    let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -15696,9 +15821,9 @@ args = ${JSON.stringify(args)}
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync10(dir))
+    if (!existsSync11(dir))
       mkdirSync5(dir, { recursive: true });
-    let existing = existsSync10(p) ? readFileSync22(p, "utf8") : "";
+    let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -15729,70 +15854,70 @@ function detectAgents() {
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync10(claudeJson) || which("claude"),
+    installed: () => existsSync11(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
   const claudeDesktop = join19(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync10(claudeDesktop),
+    installed: () => existsSync11(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
   const cursor = join19(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync10(join19(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync11(join19(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
   const opencode = join19(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync10(join19(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync11(join19(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
   const codex = join19(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync10(join19(home, ".codex")) || which("codex"),
+    installed: () => existsSync11(join19(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
   const hermes = join19(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync10(join19(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync11(join19(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
   const gemini = join19(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync10(join19(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync11(join19(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
   const windsurf = join19(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync10(join19(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync11(join19(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
   const copilot = join19(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync10(join19(home, ".copilot")),
+    installed: () => existsSync11(join19(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
   const cline = join19(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync10(join19(home, ".cline")),
+    installed: () => existsSync11(join19(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -15874,6 +15999,7 @@ var init_cli = __esm(() => {
   init_catalog();
   init_release();
   init_dependency();
+  init_mcp_status();
   ROOT10 = join19(fileURLToPath12(new URL(".", import.meta.url)), "..");
 });
 
@@ -31291,6 +31417,53 @@ ${controlResp.body}` }]
     evidence
   };
 }
+function buildFileReadRequest(url, path, param, bodyRaw) {
+  if (bodyRaw)
+    return { url, data: path };
+  return { url: inject(url, path, param ?? "path") };
+}
+async function verifyFileRead(input) {
+  const method = input.method ?? "POST";
+  const markerPath = input.markerPath ?? "/etc/passwd";
+  const controlPath = `/bs-nonexistent-${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
+  const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const markerReq = buildFileReadRequest(input.url, markerPath, input.param, input.bodyRaw);
+  const controlReq = buildFileReadRequest(input.url, controlPath, input.param, input.bodyRaw);
+  const markerResp = await httpRequest(markerReq.url, method, markerReq.data, input.headers, timeoutMs);
+  const controlResp = await httpRequest(controlReq.url, method, controlReq.data, input.headers, timeoutMs);
+  const passwdRe = /(^|\n)root:[x*!][^:]*:0:0:/m;
+  const markerFile = passwdRe.test(markerResp.body);
+  const controlFile = passwdRe.test(controlResp.body);
+  let status;
+  let reason;
+  if (markerResp.status === 0 && controlResp.status === 0) {
+    status = "blocked";
+    reason = "both marker and control requests failed — target unreachable";
+  } else if (markerFile && !controlFile) {
+    status = "confirmed";
+    reason = "marker file (/etc/passwd) content returned while the non-existent negative control did not — arbitrary file read confirmed";
+  } else if (markerFile && controlFile) {
+    status = "unconfirmed";
+    reason = "marker and negative control both returned passwd-like content — indistinguishable from a fixed response";
+  } else if (markerResp.status === controlResp.status && markerResp.body === controlResp.body) {
+    status = "unconfirmed";
+    reason = `marker and control returned identical responses (HTTP ${markerResp.status}) — likely an auth/session gate; file read not reachable without credentials`;
+  } else {
+    status = "unconfirmed";
+    reason = "marker file content not returned — arbitrary file read could not be demonstrated live";
+  }
+  return {
+    status,
+    file_read: markerFile && !controlFile,
+    marker_file_content: markerFile,
+    control_file_content: controlFile,
+    marker_status: markerResp.status,
+    control_status: controlResp.status,
+    marker_preview: redactSecrets(markerResp.body.slice(0, 300)),
+    control_preview: redactSecrets(controlResp.body.slice(0, 300)),
+    reason
+  };
+}
 function resolveFinding(finding, verdict) {
   let f = finding;
   if (f.status === "hypothesis") {
@@ -31734,98 +31907,13 @@ async function driveChromeDevtools(target, timeoutMs = 25000) {
   }
 }
 
-// src/burp-mcp.ts
-var DEFAULT_BURP_URL = "http://127.0.0.1:9876";
-async function fetchTimeout(url, init = {}, timeoutMs = 8000) {
-  const ctrl = new AbortController;
-  const t = setTimeout(() => ctrl.abort(), timeoutMs);
-  try {
-    return await fetch(url, { ...init, signal: ctrl.signal });
-  } finally {
-    clearTimeout(t);
-  }
-}
-function sseMessage(text) {
-  const m = text.match(/event:\s*message[\s\S]*?data:\s*([^\n]+)/);
-  return m ? m[1].trim() : null;
-}
-async function driveBurpMCP(baseUrl = DEFAULT_BURP_URL, timeoutMs = 1e4) {
-  const base = baseUrl.replace(/\/+$/, "");
-  let sseRes;
-  try {
-    sseRes = await fetchTimeout(`${base}/sse`, { headers: { Accept: "text/event-stream" } }, timeoutMs);
-  } catch (e) {
-    return { ok: false, alive: false, base_url: base, error: `Burp MCP not reachable at ${base}/sse (${String(e)}) — start Burp + load the MCP extension` };
-  }
-  if (!sseRes.ok) {
-    return {
-      ok: false,
-      alive: false,
-      base_url: base,
-      error: `Burp MCP SSE endpoint returned HTTP ${sseRes.status} — is the extension enabled in Burp → MCP?`
-    };
-  }
-  let endpoint = null;
-  let serverInfo = "";
-  let toolsRaw = "";
-  try {
-    const reader = sseRes.body.getReader();
-    const decoder = new TextDecoder;
-    let buf = "";
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      const { value, done } = await reader.read();
-      if (done)
-        break;
-      buf += decoder.decode(value, { stream: true });
-      if (!endpoint) {
-        const em = buf.match(/event:\s*endpoint[\s\S]*?data:\s*([^\n]+)/);
-        if (em)
-          endpoint = em[1].trim();
-      }
-      if (endpoint)
-        break;
-    }
-    if (endpoint) {
-      const postUrl = new URL(endpoint, base).toString();
-      const initRes = await fetchTimeout(postUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
-        body: JSON.stringify({
-          jsonrpc: "2.0",
-          id: 1,
-          method: "initialize",
-          params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "blitzstrike", version: "2" } }
-        })
-      }, timeoutMs);
-      const initText = await initRes.text();
-      const initMsg = sseMessage(initText) ?? (initText.includes("result") ? initText : "");
-      serverInfo = initMsg.slice(0, 600);
-      const toolsRes = await fetchTimeout(postUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
-        body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} })
-      }, timeoutMs);
-      const toolsText = await toolsRes.text();
-      toolsRaw = (sseMessage(toolsText) ?? toolsText).slice(0, 3000);
-    }
-  } catch (e) {
-    return { ok: true, alive: true, base_url: base, endpoint, error: `SSE stream opened but handshake failed: ${String(e)}` };
-  }
-  if (!endpoint) {
-    return {
-      ok: true,
-      alive: true,
-      base_url: base,
-      error: "SSE stream open but no endpoint event received — Burp MCP extension may not be fully enabled"
-    };
-  }
-  return { ok: true, alive: true, base_url: base, endpoint, server: serverInfo, tools: toolsRaw };
-}
-
 // src/chain-executor.ts
 var BLITZ_FINDING_TOOLS = {
   strike_verify: verifyFinding,
+  verify_file_read: fileReadFinding,
+  path_traversal: fileReadFinding,
+  lfi: fileReadFinding,
+  file_read: fileReadFinding,
   crack_hash: crackFinding,
   hashcat: crackFinding,
   hashid: crackFinding,
@@ -31859,9 +31947,15 @@ function findingText(f) {
 function findingUrl(f) {
   return (f.target?.host ?? "") + (f.target?.endpoint ?? "");
 }
+function isFileReadFinding(f) {
+  const text = `${f.classification?.cwe ?? ""} ${f.classification?.cwe_name ?? ""} ${f.sink?.type ?? ""} ${f.chain?.id ?? ""} ${f.chain?.name ?? ""} ${f.title ?? ""}`.toLowerCase();
+  return /(cwe-?22|path.?traversal|arbitrary.?file|file.?read|directory.?traversal|lfi|\btraversal\b)/.test(text);
+}
 async function verifyFinding(f) {
   const url = findingUrl(f);
   const param = f.source?.name ?? "q";
+  if (isFileReadFinding(f))
+    return fileReadFinding(f);
   const v = await strikeVerify({ url, method: "GET", param });
   return {
     status: v.status,
@@ -31871,6 +31965,16 @@ async function verifyFinding(f) {
     leaked_sinks: v.leaked_sinks ?? []
   };
 }
+async function fileReadFinding(f) {
+  const url = findingUrl(f);
+  if (!url)
+    return { executed: false, note: "no target URL on finding" };
+  const srcType = (f.source?.type ?? "").toLowerCase();
+  const bodyRaw = /(body|post|raw)/.test(srcType);
+  const method = bodyRaw ? "POST" : "GET";
+  const verdict = await verifyFileRead({ url, method, bodyRaw, param: f.source?.name });
+  return { verify_kind: "file_read", ...verdict };
+}
 async function crackFinding(f) {
   const text = findingText(f);
   const hashRe = /(\$2[aby]\$\d+\$[./A-Za-z0-9]{53}|[a-f0-9]{32}|[a-f0-9]{40}|[a-f0-9]{64})/g;
@@ -55347,6 +55451,9 @@ function browserDiagnostics() {
   return { console_errors: [...consoleErrors], page_errors: [...pageErrors] };
 }
 
+// src/server.ts
+init_mcp_status();
+
 // src/route-confusion.ts
 var SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
 function lines(code) {
@@ -55921,7 +56028,7 @@ function runBenchmark() {
 }
 
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync8, readFileSync as readFileSync17, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync17, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join15, resolve } from "node:path";
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
@@ -55981,7 +56088,7 @@ function detectFixture(dir) {
 function runEnterpriseBenchmark() {
   const fixtures = [];
   for (const fx of ENTERPRISE_FIXTURES) {
-    if (!existsSync8(fx.dir)) {
+    if (!existsSync9(fx.dir)) {
       fixtures.push({ id: fx.id, available: false, detected: 0, expected: fx.expected_vulns, recall: 0 });
       continue;
     }
@@ -56279,6 +56386,45 @@ function createServer() {
       }]
     };
   });
+  server.registerTool("verify_file_read", {
+    title: "Verify arbitrary file read / path traversal (marker file vs negative control)",
+    description: "STRIKE: deterministic verification of an arbitrary-file-read / path-traversal hypothesis (CWE-22). Reads a marker file (/etc/passwd) vs a non-existent negative-control path and compares: confirmed (marker returns file content, control does not) / unconfirmed (indistinguishable or gated by auth) / blocked (unreachable). Supports raw POST body (bodyRaw=true) or a named query/body param. Never leaves a bare hypothesis — always returns a verdict + reason.",
+    inputSchema: {
+      url: string2().describe("Target URL (e.g. the file-read endpoint)"),
+      method: _enum(["GET", "POST"]).optional().describe("HTTP method (default POST)"),
+      param: string2().optional().describe("Query/body param name that carries the path (default 'path')"),
+      bodyRaw: boolean2().optional().describe("Treat the raw POST body as the filesystem path (default false)"),
+      headers: string2().optional().describe("JSON object of extra headers"),
+      markerPath: string2().optional().describe("Marker file to read (default /etc/passwd)"),
+      timeout: number2().int().optional().describe("Timeout seconds (default 15)")
+    }
+  }, async ({ url, method, param, bodyRaw, headers, markerPath, timeout }) => {
+    let hdrs = {};
+    try {
+      hdrs = headers ? JSON.parse(headers) : {};
+    } catch {}
+    const verdict = await verifyFileRead({
+      url,
+      method: method ?? "POST",
+      param,
+      bodyRaw: bodyRaw ?? false,
+      headers: hdrs,
+      markerPath,
+      timeoutMs: timeout ? timeout * 1000 : undefined
+    });
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          ...verdict,
+          next_steps: [
+            `Verdict: ${verdict.status} — ${verdict.reason}`,
+            verdict.status === "confirmed" ? "Confirmed arbitrary file read. Record with finding_create + attach the marker/control evidence." : verdict.status === "blocked" ? "Blocked. Target unreachable — retry or re-check scope." : "Unconfirmed. The response is gated (auth/session) or the file is not read — obtain a low-priv session and re-run with a valid session, or mark the finding unconfirmed with this evidence."
+          ]
+        })
+      }]
+    };
+  });
   server.registerTool("strike_resolve", {
     title: "Resolve a finding from a STRIKE verdict",
     description: "STRIKE+FINDINGS: take a canonical Finding and a STRIKE verdict, and advance the lifecycle end-to-end — hypothesis->validating->confirmed (marker reflected, control inert) or ->false_positive/blocked/unconfirmed. Returns the updated finding with evidence + recomputed confidence.",
@@ -56574,6 +56720,14 @@ ${statusLine}` : statusLine },
   }, async ({ target }) => {
     return { content: [{ type: "text", text: JSON.stringify(await driveChromeDevtools(target)) }] };
   });
+  server.registerTool("check_mcp", {
+    title: "Check external MCP integrations (chrome-devtools-mcp + burp-suite-mcp)",
+    description: "Verify every external MCP integration is actually present/connected: chrome-devtools-mcp (stdio — installed or npx auto-install) and burp-suite-mcp (SSE — only alive when Burp is running with the extension loaded). Returns availability + fix hints, so you know before you need them.",
+    inputSchema: {}
+  }, async () => {
+    const status = await checkMcpServers();
+    return { content: [{ type: "text", text: JSON.stringify({ mcp_servers: status }) }] };
+  });
   server.registerTool("install_all_tools", {
     title: "Install every catalog tool at once",
     description: "CATALOG: install every non-MCP-server catalog tool in parallel (bounded concurrency), skipping MCP servers (they are connected, not installed). Returns a summary (installed / already_installed / failed) + per-tool result. Optionally filter by category (recon, web, api, cloud, system, ...). Use this to mass-provision the toolbelt instead of ensure_tool one-by-one.",
@@ -57517,14 +57671,14 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync23, existsSync as existsSync11 } from "node:fs";
+import { readFileSync as readFileSync23, existsSync as existsSync12 } from "node:fs";
 import { join as join20 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 var ROOT11 = join20(fileURLToPath13(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
     const p = join20(ROOT11, "package.json");
-    if (existsSync11(p))
+    if (existsSync12(p))
       return JSON.parse(readFileSync23(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
@@ -57556,7 +57710,7 @@ async function main() {
     return;
   }
   if (args[0] === "doctor") {
-    runDoctor();
+    await runDoctor();
     return;
   }
   if (args[0] === "install") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.6",
+  "version": "2.4.8",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {