blitzstrike 2.4.7 → 2.4.9

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.9] — 2026-09-14
+
+### Added — evidence-first enforcement (findings are never born empty)
+
+- `makeFinding` + `finding_create` now accept `evidence` at creation — a finding
+  can carry its observed artifact (headers/URL/response) the moment it is
+  created, instead of relying on a separate attach call that gets skipped.
+- `finding_create` warns when a finding is created with no evidence.
+- `reportMarkdown` now flags evidence-less findings with an explicit
+  "Evidence-first violation" block (ids listed) — detection without proof is
+  surfaced instead of silently shipped.
+
+## [2.4.8] — 2026-09-14
+
+### Added — MCP integration health checks
+
+- New `checkMcpServers` (`src/mcp-status.ts`): verifies external MCP
+  integrations are actually present/connected — chrome-devtools-mcp (stdio:
+  binary or npx auto-install) and burp-suite-mcp (SSE: alive only when Burp is
+  running with the extension loaded).
+- `blitzstrike doctor` now reports both MCP servers with availability + fix hints.
+- New MCP tool `check_mcp` to probe MCP integration status on demand.
+
 ## [2.4.7] — 2026-09-14
 
 ### Added — deterministic arbitrary-file-read verification (no bare hypotheses)

package/dist/index.js

@@ -7667,6 +7667,95 @@ var init_catalog = __esm(() => {
   ROOT2 = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
 });
 
+// src/burp-mcp.ts
+async function fetchTimeout(url, init = {}, timeoutMs = 8000) {
+  const ctrl = new AbortController;
+  const t = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...init, signal: ctrl.signal });
+  } finally {
+    clearTimeout(t);
+  }
+}
+function sseMessage(text) {
+  const m = text.match(/event:\s*message[\s\S]*?data:\s*([^\n]+)/);
+  return m ? m[1].trim() : null;
+}
+async function driveBurpMCP(baseUrl = DEFAULT_BURP_URL, timeoutMs = 1e4) {
+  const base = baseUrl.replace(/\/+$/, "");
+  let sseRes;
+  try {
+    sseRes = await fetchTimeout(`${base}/sse`, { headers: { Accept: "text/event-stream" } }, timeoutMs);
+  } catch (e) {
+    return { ok: false, alive: false, base_url: base, error: `Burp MCP not reachable at ${base}/sse (${String(e)}) — start Burp + load the MCP extension` };
+  }
+  if (!sseRes.ok) {
+    return {
+      ok: false,
+      alive: false,
+      base_url: base,
+      error: `Burp MCP SSE endpoint returned HTTP ${sseRes.status} — is the extension enabled in Burp → MCP?`
+    };
+  }
+  let endpoint = null;
+  let serverInfo = "";
+  let toolsRaw = "";
+  try {
+    const reader = sseRes.body.getReader();
+    const decoder = new TextDecoder;
+    let buf = "";
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      const { value, done } = await reader.read();
+      if (done)
+        break;
+      buf += decoder.decode(value, { stream: true });
+      if (!endpoint) {
+        const em = buf.match(/event:\s*endpoint[\s\S]*?data:\s*([^\n]+)/);
+        if (em)
+          endpoint = em[1].trim();
+      }
+      if (endpoint)
+        break;
+    }
+    if (endpoint) {
+      const postUrl = new URL(endpoint, base).toString();
+      const initRes = await fetchTimeout(postUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 1,
+          method: "initialize",
+          params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "blitzstrike", version: "2" } }
+        })
+      }, timeoutMs);
+      const initText = await initRes.text();
+      const initMsg = sseMessage(initText) ?? (initText.includes("result") ? initText : "");
+      serverInfo = initMsg.slice(0, 600);
+      const toolsRes = await fetchTimeout(postUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} })
+      }, timeoutMs);
+      const toolsText = await toolsRes.text();
+      toolsRaw = (sseMessage(toolsText) ?? toolsText).slice(0, 3000);
+    }
+  } catch (e) {
+    return { ok: true, alive: true, base_url: base, endpoint, error: `SSE stream opened but handshake failed: ${String(e)}` };
+  }
+  if (!endpoint) {
+    return {
+      ok: true,
+      alive: true,
+      base_url: base,
+      error: "SSE stream open but no endpoint event received — Burp MCP extension may not be fully enabled"
+    };
+  }
+  return { ok: true, alive: true, base_url: base, endpoint, server: serverInfo, tools: toolsRaw };
+}
+var DEFAULT_BURP_URL = "http://127.0.0.1:9876";
+
 // node_modules/php-parser/src/lexer/attribute.js
 var require_attribute = __commonJS(function(exports, module) {
   module.exports = {
@@ -15295,12 +15384,39 @@ var require_src = __commonJS(function(exports, module) {
   module.exports.default = Engine;
 });
 
+// src/mcp-status.ts
+import { existsSync as existsSync8 } from "node:fs";
+import { spawnSync as spawnSync3 } from "node:child_process";
+async function checkMcpServers() {
+  const out = [];
+  const bin = ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"].find((p) => existsSync8(p));
+  const npxOk = spawnSync3("npx", ["--version"], { timeout: 8000 }).error === undefined;
+  const devtoolsOk = Boolean(bin) || npxOk;
+  out.push({
+    name: "chrome-devtools-mcp",
+    available: devtoolsOk,
+    kind: "stdio",
+    detail: bin ? `installed at ${bin}` : npxOk ? "not installed — will auto-install via npx on first use" : "not installed (no npx either)",
+    fix: devtoolsOk ? undefined : "install Node/npm, then `npm i -g chrome-devtools-mcp`"
+  });
+  const burp = await driveBurpMCP("http://127.0.0.1:9876", 4000);
+  out.push({
+    name: "burp-suite-mcp",
+    available: burp.alive,
+    kind: "sse",
+    detail: burp.alive ? `alive at ${burp.base_url}${burp.endpoint ? ` (endpoint ${burp.endpoint})` : ""}` : burp.error ?? "not reachable",
+    fix: burp.alive ? undefined : "build PortSwigger/mcp-server (`./gradlew embedProxyJar`) + load the JAR in Burp → Extensions, then enable the MCP extension"
+  });
+  return out;
+}
+var init_mcp_status = () => {};
+
 // src/sync.ts
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync6, readFileSync as readFileSync18, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
 import { join as join16 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
   try {
     return statSync4(p).isDirectory();
@@ -15351,14 +15467,14 @@ function syncData() {
     copyDir(localTemplates, templatesPath);
     templatesSynced = true;
   }
-  const gitOk = spawnSync3("git", ["--version"]).status === 0;
+  const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
     const tmp = join16(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync4(tmp, { recursive: true, force: true });
-    const r = spawnSync3("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
+    const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
     if (r.status === 0) {
-      const sparse = spawnSync3("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
+      const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
           copyDir(join16(tmp, "payloads"), payloadsPath);
@@ -15379,7 +15495,7 @@ function syncData() {
   };
 }
 function copyDir(src, dst) {
-  const r = spawnSync3("cp", ["-r", src, dst], { timeout: 120000 });
+  const r = spawnSync4("cp", ["-r", src, dst], { timeout: 120000 });
   if (r.status !== 0) {
     manualCopy(src, dst);
   }
@@ -15443,7 +15559,7 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync20, existsSync as existsSync9 } from "node:fs";
+import { readFileSync as readFileSync20, existsSync as existsSync10 } from "node:fs";
 import { join as join17 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { execSync as execSync4 } from "node:child_process";
@@ -15483,7 +15599,7 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync9(join17(ROOT8, "package-lock.json")) || existsSync9(join17(ROOT8, "bun.lock")) || existsSync9(join17(ROOT8, "bun.lockb"));
+  return existsSync10(join17(ROOT8, "package-lock.json")) || existsSync10(join17(ROOT8, "bun.lock")) || existsSync10(join17(ROOT8, "bun.lockb"));
 }
 var ROOT8;
 var init_release = __esm(() => {
@@ -15525,20 +15641,20 @@ var init_dependency = __esm(() => {
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync22, existsSync as existsSync10, writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "node:fs";
+import { readFileSync as readFileSync22, existsSync as existsSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "node:fs";
 import { join as join19, dirname as dirname2 } from "node:path";
 import { homedir as homedir6 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
-  return spawnSync4(`command -v ${cmd}`, { shell: true }).status === 0;
+  return spawnSync5(`command -v ${cmd}`, { shell: true }).status === 0;
 }
 function installedCount() {
   const tools = loadTools();
   const installed = tools.filter((t) => which(t.name)).map((t) => t.name);
   return { total: tools.length, installed, missing: tools.map((t) => t.name).filter((n) => !installed.includes(n)) };
 }
-function runDoctor() {
+async function runDoctor() {
   console.log(`BlitzStrike doctor — environment health check
 `);
   const issues = [];
@@ -15571,7 +15687,7 @@ function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync10(join19(ROOT10, "chains.json")) && existsSync10(join19(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync11(join19(ROOT10, "chains.json")) && existsSync11(join19(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -15592,6 +15708,15 @@ function runDoctor() {
     detail: deps.safe ? `${deps.total_dependencies} deps, no install scripts` : `${deps.install_scripts.length} install script(s) + ${deps.git_dependencies.length} git dep(s)`,
     fix: deps.safe ? undefined : "remove install-time scripts and git dependencies"
   });
+  const mcps = await checkMcpServers();
+  for (const m of mcps) {
+    issues.push({
+      name: `MCP: ${m.name}`,
+      status: m.available ? "ok" : "warn",
+      detail: m.detail,
+      fix: m.fix
+    });
+  }
   const symbol = { ok: "OK  ", warn: "WARN", fail: "FAIL" };
   for (const i of issues) {
     console.log(`${symbol[i.status]}  ${i.name}  ${i.detail}`);
@@ -15614,14 +15739,14 @@ function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
   const src = join19(ROOT10, "src", "index.ts");
-  if (which("bun") && existsSync10(src))
+  if (which("bun") && existsSync11(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
   const dist = join19(ROOT10, "dist", "index.js");
-  if (existsSync10(dist))
+  if (existsSync11(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
@@ -15635,7 +15760,7 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync10(dir))
+    if (!existsSync11(dir))
       mkdirSync5(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
@@ -15648,7 +15773,7 @@ function jsonMcpServersWrite(p) {
 function opencodeWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync10(dir))
+    if (!existsSync11(dir))
       mkdirSync5(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
@@ -15662,14 +15787,14 @@ function opencodeWrite(p) {
 function copyOpenCodeAgents() {
   const srcDir = join19(ROOT10, "opencode-agents");
   const dstDir = join19(homedir6(), ".config", "opencode", "agents");
-  if (!existsSync10(srcDir))
+  if (!existsSync11(srcDir))
     return;
-  if (!existsSync10(dstDir))
+  if (!existsSync11(dstDir))
     mkdirSync5(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
     const src = join19(srcDir, f);
     const dst = join19(dstDir, f);
-    if (existsSync10(src)) {
+    if (existsSync11(src)) {
       writeFileSync7(dst, readFileSync22(src, "utf8"));
     }
   }
@@ -15677,9 +15802,9 @@ function copyOpenCodeAgents() {
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync10(dir))
+    if (!existsSync11(dir))
       mkdirSync5(dir, { recursive: true });
-    let existing = existsSync10(p) ? readFileSync22(p, "utf8") : "";
+    let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -15696,9 +15821,9 @@ args = ${JSON.stringify(args)}
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync10(dir))
+    if (!existsSync11(dir))
       mkdirSync5(dir, { recursive: true });
-    let existing = existsSync10(p) ? readFileSync22(p, "utf8") : "";
+    let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -15729,70 +15854,70 @@ function detectAgents() {
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync10(claudeJson) || which("claude"),
+    installed: () => existsSync11(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
   const claudeDesktop = join19(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync10(claudeDesktop),
+    installed: () => existsSync11(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
   const cursor = join19(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync10(join19(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync11(join19(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
   const opencode = join19(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync10(join19(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync11(join19(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
   const codex = join19(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync10(join19(home, ".codex")) || which("codex"),
+    installed: () => existsSync11(join19(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
   const hermes = join19(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync10(join19(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync11(join19(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
   const gemini = join19(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync10(join19(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync11(join19(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
   const windsurf = join19(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync10(join19(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync11(join19(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
   const copilot = join19(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync10(join19(home, ".copilot")),
+    installed: () => existsSync11(join19(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
   const cline = join19(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync10(join19(home, ".cline")),
+    installed: () => existsSync11(join19(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -15874,6 +15999,7 @@ var init_cli = __esm(() => {
   init_catalog();
   init_release();
   init_dependency();
+  init_mcp_status();
   ROOT10 = join19(fileURLToPath12(new URL(".", import.meta.url)), "..");
 });
 
@@ -30938,7 +31064,7 @@ function makeFinding(input) {
   const status = input.status ?? "detected";
   const factors = confidenceFactorsFor(input);
   const confidence = computeConfidence(factors);
-  const finding = {
+  let finding = {
     id: nextFindingId(),
     status,
     title: input.title,
@@ -30961,6 +31087,16 @@ function makeFinding(input) {
     remediation: {},
     timestamps: { created: now, updated: now }
   };
+  if (input.evidence?.length) {
+    for (const e of input.evidence) {
+      const ev = makeEvidence({
+        type: e.type,
+        description: e.description,
+        artifacts: e.content ? [{ name: "artifact", kind: "evidence", content: e.content }] : []
+      });
+      finding = attachEvidence(finding, ev);
+    }
+  }
   recordAudit("finding_created", { tool: "eagle-eye", target: input.target.host ?? input.target.endpoint, result: status, correlationId: finding.id });
   return finding;
 }
@@ -31781,95 +31917,6 @@ async function driveChromeDevtools(target, timeoutMs = 25000) {
   }
 }
 
-// src/burp-mcp.ts
-var DEFAULT_BURP_URL = "http://127.0.0.1:9876";
-async function fetchTimeout(url, init = {}, timeoutMs = 8000) {
-  const ctrl = new AbortController;
-  const t = setTimeout(() => ctrl.abort(), timeoutMs);
-  try {
-    return await fetch(url, { ...init, signal: ctrl.signal });
-  } finally {
-    clearTimeout(t);
-  }
-}
-function sseMessage(text) {
-  const m = text.match(/event:\s*message[\s\S]*?data:\s*([^\n]+)/);
-  return m ? m[1].trim() : null;
-}
-async function driveBurpMCP(baseUrl = DEFAULT_BURP_URL, timeoutMs = 1e4) {
-  const base = baseUrl.replace(/\/+$/, "");
-  let sseRes;
-  try {
-    sseRes = await fetchTimeout(`${base}/sse`, { headers: { Accept: "text/event-stream" } }, timeoutMs);
-  } catch (e) {
-    return { ok: false, alive: false, base_url: base, error: `Burp MCP not reachable at ${base}/sse (${String(e)}) — start Burp + load the MCP extension` };
-  }
-  if (!sseRes.ok) {
-    return {
-      ok: false,
-      alive: false,
-      base_url: base,
-      error: `Burp MCP SSE endpoint returned HTTP ${sseRes.status} — is the extension enabled in Burp → MCP?`
-    };
-  }
-  let endpoint = null;
-  let serverInfo = "";
-  let toolsRaw = "";
-  try {
-    const reader = sseRes.body.getReader();
-    const decoder = new TextDecoder;
-    let buf = "";
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      const { value, done } = await reader.read();
-      if (done)
-        break;
-      buf += decoder.decode(value, { stream: true });
-      if (!endpoint) {
-        const em = buf.match(/event:\s*endpoint[\s\S]*?data:\s*([^\n]+)/);
-        if (em)
-          endpoint = em[1].trim();
-      }
-      if (endpoint)
-        break;
-    }
-    if (endpoint) {
-      const postUrl = new URL(endpoint, base).toString();
-      const initRes = await fetchTimeout(postUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
-        body: JSON.stringify({
-          jsonrpc: "2.0",
-          id: 1,
-          method: "initialize",
-          params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "blitzstrike", version: "2" } }
-        })
-      }, timeoutMs);
-      const initText = await initRes.text();
-      const initMsg = sseMessage(initText) ?? (initText.includes("result") ? initText : "");
-      serverInfo = initMsg.slice(0, 600);
-      const toolsRes = await fetchTimeout(postUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
-        body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list", params: {} })
-      }, timeoutMs);
-      const toolsText = await toolsRes.text();
-      toolsRaw = (sseMessage(toolsText) ?? toolsText).slice(0, 3000);
-    }
-  } catch (e) {
-    return { ok: true, alive: true, base_url: base, endpoint, error: `SSE stream opened but handshake failed: ${String(e)}` };
-  }
-  if (!endpoint) {
-    return {
-      ok: true,
-      alive: true,
-      base_url: base,
-      error: "SSE stream open but no endpoint event received — Burp MCP extension may not be fully enabled"
-    };
-  }
-  return { ok: true, alive: true, base_url: base, endpoint, server: serverInfo, tools: toolsRaw };
-}
-
 // src/chain-executor.ts
 var BLITZ_FINDING_TOOLS = {
   strike_verify: verifyFinding,
@@ -32972,11 +33019,15 @@ function summarize(findings) {
   const byStatus = {};
   const bySeverity = {};
   let evidenceArtifacts = 0;
+  let evidenceLess = 0;
   for (const f of findings) {
     byStatus[f.status ?? "detected"] = (byStatus[f.status ?? "detected"] ?? 0) + 1;
     const sev = f.classification?.severity ?? "informational";
     bySeverity[sev] = (bySeverity[sev] ?? 0) + 1;
-    evidenceArtifacts += f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
+    const arts = f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
+    evidenceArtifacts += arts;
+    if ((f.evidence ?? []).length === 0)
+      evidenceLess += 1;
   }
   const groups = dedupFindings(findings);
   return {
@@ -32986,7 +33037,8 @@ function summarize(findings) {
     by_severity: bySeverity,
     confirmed: byStatus["confirmed"] ?? 0,
     false_positives: byStatus["false_positive"] ?? 0,
-    evidence_artifacts: evidenceArtifacts
+    evidence_artifacts: evidenceArtifacts,
+    evidence_less_findings: evidenceLess
   };
 }
 function reportMarkdown(findings, opts = {}) {
@@ -33010,6 +33062,11 @@ function reportMarkdown(findings, opts = {}) {
   }
   lines.push(`Detailed findings, reproduction steps, impact, and remediation follow in section 5.`);
   lines.push("");
+  if (summary.evidence_less_findings > 0) {
+    const evLess = findings.filter((f) => (f.evidence ?? []).length === 0).map((f) => f.id).join(", ");
+    lines.push(`> ⚠️ **Evidence-first violation:** **${summary.evidence_less_findings}** finding(s) carry NO evidence artifacts (${evLess}). ` + `Detection is not proof — every finding must carry the observed artifact (headers, URL, response body). Attach evidence via finding_attach_evidence before finalizing.`);
+    lines.push("");
+  }
   lines.push("## 2. Scope");
   lines.push("");
   lines.push(`- **Target(s):** ${scope}`);
@@ -55414,6 +55471,9 @@ function browserDiagnostics() {
   return { console_errors: [...consoleErrors], page_errors: [...pageErrors] };
 }
 
+// src/server.ts
+init_mcp_status();
+
 // src/route-confusion.ts
 var SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
 function lines(code) {
@@ -55988,7 +56048,7 @@ function runBenchmark() {
 }
 
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync8, readFileSync as readFileSync17, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync17, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join15, resolve } from "node:path";
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
@@ -56048,7 +56108,7 @@ function detectFixture(dir) {
 function runEnterpriseBenchmark() {
   const fixtures = [];
   for (const fx of ENTERPRISE_FIXTURES) {
-    if (!existsSync8(fx.dir)) {
+    if (!existsSync9(fx.dir)) {
       fixtures.push({ id: fx.id, available: false, detected: 0, expected: fx.expected_vulns, recall: 0 });
       continue;
     }
@@ -56680,6 +56740,14 @@ ${statusLine}` : statusLine },
   }, async ({ target }) => {
     return { content: [{ type: "text", text: JSON.stringify(await driveChromeDevtools(target)) }] };
   });
+  server.registerTool("check_mcp", {
+    title: "Check external MCP integrations (chrome-devtools-mcp + burp-suite-mcp)",
+    description: "Verify every external MCP integration is actually present/connected: chrome-devtools-mcp (stdio — installed or npx auto-install) and burp-suite-mcp (SSE — only alive when Burp is running with the extension loaded). Returns availability + fix hints, so you know before you need them.",
+    inputSchema: {}
+  }, async () => {
+    const status = await checkMcpServers();
+    return { content: [{ type: "text", text: JSON.stringify({ mcp_servers: status }) }] };
+  });
   server.registerTool("install_all_tools", {
     title: "Install every catalog tool at once",
     description: "CATALOG: install every non-MCP-server catalog tool in parallel (bounded concurrency), skipping MCP servers (they are connected, not installed). Returns a summary (installed / already_installed / failed) + per-tool result. Optionally filter by category (recon, web, api, cloud, system, ...). Use this to mass-provision the toolbelt instead of ensure_tool one-by-one.",
@@ -57122,7 +57190,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("finding_create", {
     title: "Create a canonical finding",
-    description: "FINDINGS: create a canonical, evidence-first finding. Severity describes impact; confidence (deterministic) describes certainty. Default status=detected (hypothesis-pending).",
+    description: "FINDINGS: create a canonical, evidence-first finding. Severity describes impact; confidence (deterministic) describes certainty. Default status=detected (hypothesis-pending). Pass `evidence` (JSON array of {type, description, content}) to attach observed artifacts AT CREATION — a finding must never be born empty when you already hold the artifact (headers, URL, response body).",
     inputSchema: {
       title: string2().describe("Finding title"),
       target_type: string2().optional().describe("Target type (web/api/source/mobile/network/other)"),
@@ -57134,9 +57202,18 @@ ${statusLine}` : statusLine },
       source_name: string2().describe("Source name"),
       sink_type: string2().describe("Sink type (e.g. sql_execution, command_execution, file_operations)"),
       sink_symbol: string2().optional().describe("Sink symbol (e.g. '->query(')"),
-      chain_id: string2().optional().describe("Escalation chain id")
+      chain_id: string2().optional().describe("Escalation chain id"),
+      evidence: string2().optional().describe("JSON array of evidence entries: [{type, description, content?}] — attached at creation (redacted + SHA-256 tagged)")
+    }
+  }, async ({ title, target_type, host, endpoint, severity, cwe, source_type, source_name, sink_type, sink_symbol, chain_id, evidence }) => {
+    let evs = [];
+    if (evidence) {
+      try {
+        evs = JSON.parse(evidence);
+      } catch {
+        return { content: [{ type: "text", text: JSON.stringify({ error: "invalid evidence JSON" }) }] };
+      }
     }
-  }, async ({ title, target_type, host, endpoint, severity, cwe, source_type, source_name, sink_type, sink_symbol, chain_id }) => {
     const f = makeFinding({
       title,
       target: { type: target_type ?? "web", host, endpoint },
@@ -57145,9 +57222,19 @@ ${statusLine}` : statusLine },
       source: { type: source_type, name: source_name },
       sink: { type: sink_type, symbol: sink_symbol },
       chainId: chain_id ?? null,
-      status: "detected"
+      status: "detected",
+      evidence: evs
     });
-    return { content: [{ type: "text", text: JSON.stringify(f) }] };
+    const empty = (f.evidence ?? []).length === 0;
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          ...f,
+          _warning: empty ? "finding created with NO evidence — if you hold the observed artifact (headers/URL/body), attach it now via `evidence` or finding_attach_evidence" : undefined
+        })
+      }]
+    };
   });
   server.registerTool("finding_transition", {
     title: "Advance a finding lifecycle",
@@ -57623,14 +57710,14 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync23, existsSync as existsSync11 } from "node:fs";
+import { readFileSync as readFileSync23, existsSync as existsSync12 } from "node:fs";
 import { join as join20 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 var ROOT11 = join20(fileURLToPath13(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
     const p = join20(ROOT11, "package.json");
-    if (existsSync11(p))
+    if (existsSync12(p))
       return JSON.parse(readFileSync23(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
@@ -57662,7 +57749,7 @@ async function main() {
     return;
   }
   if (args[0] === "doctor") {
-    runDoctor();
+    await runDoctor();
     return;
   }
   if (args[0] === "install") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.7",
+  "version": "2.4.9",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {