blitzstrike 2.4.8 → 2.4.10

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.10] — 2026-09-14
+
+### Added — auto-install external MCP servers to every agent
+
+- chrome-devtools-mcp is now flagged `installable` in the catalog: `install-tools`
+  / `install_all_tools` provision it (npm i -g) instead of skipping all MCP
+  servers. burp-suite-mcp stays skipped (GUI/daemon — build + run manually).
+- `blitzstrike install` (register to every agent) now also auto-installs
+  chrome-devtools-mcp so all agents can drive a real browser immediately.
+
+### Fixed — doctor git stderr leak
+
+- `validateRelease` suppresses git/npm stderr, so `blitzstrike doctor` no longer
+  prints a stray `fatal: not a git repository` / `No tags can describe` line when
+  run outside a git checkout.
+
+## [2.4.9] — 2026-09-14
+
+### Added — evidence-first enforcement (findings are never born empty)
+
+- `makeFinding` + `finding_create` now accept `evidence` at creation — a finding
+  can carry its observed artifact (headers/URL/response) the moment it is
+  created, instead of relying on a separate attach call that gets skipped.
+- `finding_create` warns when a finding is created with no evidence.
+- `reportMarkdown` now flags evidence-less findings with an explicit
+  "Evidence-first violation" block (ids listed) — detection without proof is
+  surfaced instead of silently shipped.
+
 ## [2.4.8] — 2026-09-14
 
 ### Added — MCP integration health checks

package/dist/index.js

@@ -7633,9 +7633,9 @@ function ensureToolAsync(name, timeoutMs = 120000) {
 }
 async function installAllTools(opts = {}) {
   const tools = loadTools();
-  const mcp = tools.filter((t) => t.category === "mcp-server").map((t) => t.name);
+  const skippedMcp = tools.filter((t) => t.category === "mcp-server" && t.installable !== true).map((t) => t.name);
   const cat = opts.category?.toLowerCase();
-  const targets = tools.filter((t) => t.category !== "mcp-server" && (!cat || t.category === cat));
+  const targets = tools.filter((t) => (t.category !== "mcp-server" || t.installable === true) && (!cat || t.category === cat));
   const concurrency = Math.max(1, opts.concurrency ?? 4);
   const results = [];
   let idx = 0;
@@ -7657,7 +7657,7 @@ async function installAllTools(opts = {}) {
     installed,
     already_installed: already,
     failed,
-    skipped_mcp_servers: mcp,
+    skipped_mcp_servers: skippedMcp,
     results
   };
 }
@@ -15579,13 +15579,13 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8" }).trim();
+    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
-    checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git)", soft: true });
+    checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
   }
   try {
-    const published = execSync4("npm view blitzstrike version", { encoding: "utf8", timeout: 8000 }).trim();
+    const published = execSync4("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
   } catch {
     checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
@@ -15958,6 +15958,11 @@ Agent-specific formats: see docs/installation.md`);
   console.log(`
 Registered with ${ok}/${installed.length} agent(s).`);
   console.log("Restart your agent, then call `run_engagement` or any `blitzstrike` tool.");
+  console.log(`
+External MCP servers:`);
+  const devtools = ensureTool("chrome-devtools-mcp");
+  console.log(`  ${devtools.installed ? "OK  " : "FAIL"} chrome-devtools-mcp  ${devtools.installed ? "installed (browser MCP ready for all agents)" : devtools.command ?? "install failed"}`);
+  console.log(`  SKIP burp-suite-mcp  GUI/daemon — build manually (PortSwigger/mcp-server) + load in Burp (connect, not install)`);
 }
 async function runInstallTools(args) {
   const getArg = (flag) => {
@@ -15975,9 +15980,9 @@ async function runInstallTools(args) {
   await Promise.resolve().then(() => init_catalog());
   if (dryRun) {
     const tools = loadTools();
-    const mcp = tools.filter((t) => t.category === "mcp-server");
-    const targets = tools.filter((t) => t.category !== "mcp-server" && (!category || t.category === category.toLowerCase()));
-    console.log(`Dry run — would attempt ${targets.length} tool(s); ${mcp.length} MCP server(s) skipped (connect, not install):`);
+    const mcp = tools.filter((t) => t.category === "mcp-server" && t.installable !== true);
+    const targets = tools.filter((t) => (t.category !== "mcp-server" || t.installable === true) && (!category || t.category === category.toLowerCase()));
+    console.log(`Dry run — would attempt ${targets.length} tool(s); ${mcp.length} MCP server(s) skipped (GUI/daemon — connect, not install):`);
     for (const t of targets)
       console.log(`  ${t.category.padEnd(11)} ${t.name}`);
     return;
@@ -31064,7 +31069,7 @@ function makeFinding(input) {
   const status = input.status ?? "detected";
   const factors = confidenceFactorsFor(input);
   const confidence = computeConfidence(factors);
-  const finding = {
+  let finding = {
     id: nextFindingId(),
     status,
     title: input.title,
@@ -31087,6 +31092,16 @@ function makeFinding(input) {
     remediation: {},
     timestamps: { created: now, updated: now }
   };
+  if (input.evidence?.length) {
+    for (const e of input.evidence) {
+      const ev = makeEvidence({
+        type: e.type,
+        description: e.description,
+        artifacts: e.content ? [{ name: "artifact", kind: "evidence", content: e.content }] : []
+      });
+      finding = attachEvidence(finding, ev);
+    }
+  }
   recordAudit("finding_created", { tool: "eagle-eye", target: input.target.host ?? input.target.endpoint, result: status, correlationId: finding.id });
   return finding;
 }
@@ -33009,11 +33024,15 @@ function summarize(findings) {
   const byStatus = {};
   const bySeverity = {};
   let evidenceArtifacts = 0;
+  let evidenceLess = 0;
   for (const f of findings) {
     byStatus[f.status ?? "detected"] = (byStatus[f.status ?? "detected"] ?? 0) + 1;
     const sev = f.classification?.severity ?? "informational";
     bySeverity[sev] = (bySeverity[sev] ?? 0) + 1;
-    evidenceArtifacts += f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
+    const arts = f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
+    evidenceArtifacts += arts;
+    if ((f.evidence ?? []).length === 0)
+      evidenceLess += 1;
   }
   const groups = dedupFindings(findings);
   return {
@@ -33023,7 +33042,8 @@ function summarize(findings) {
     by_severity: bySeverity,
     confirmed: byStatus["confirmed"] ?? 0,
     false_positives: byStatus["false_positive"] ?? 0,
-    evidence_artifacts: evidenceArtifacts
+    evidence_artifacts: evidenceArtifacts,
+    evidence_less_findings: evidenceLess
   };
 }
 function reportMarkdown(findings, opts = {}) {
@@ -33047,6 +33067,11 @@ function reportMarkdown(findings, opts = {}) {
   }
   lines.push(`Detailed findings, reproduction steps, impact, and remediation follow in section 5.`);
   lines.push("");
+  if (summary.evidence_less_findings > 0) {
+    const evLess = findings.filter((f) => (f.evidence ?? []).length === 0).map((f) => f.id).join(", ");
+    lines.push(`> ⚠️ **Evidence-first violation:** **${summary.evidence_less_findings}** finding(s) carry NO evidence artifacts (${evLess}). ` + `Detection is not proof — every finding must carry the observed artifact (headers, URL, response body). Attach evidence via finding_attach_evidence before finalizing.`);
+    lines.push("");
+  }
   lines.push("## 2. Scope");
   lines.push("");
   lines.push(`- **Target(s):** ${scope}`);
@@ -57170,7 +57195,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("finding_create", {
     title: "Create a canonical finding",
-    description: "FINDINGS: create a canonical, evidence-first finding. Severity describes impact; confidence (deterministic) describes certainty. Default status=detected (hypothesis-pending).",
+    description: "FINDINGS: create a canonical, evidence-first finding. Severity describes impact; confidence (deterministic) describes certainty. Default status=detected (hypothesis-pending). Pass `evidence` (JSON array of {type, description, content}) to attach observed artifacts AT CREATION — a finding must never be born empty when you already hold the artifact (headers, URL, response body).",
     inputSchema: {
       title: string2().describe("Finding title"),
       target_type: string2().optional().describe("Target type (web/api/source/mobile/network/other)"),
@@ -57182,9 +57207,18 @@ ${statusLine}` : statusLine },
       source_name: string2().describe("Source name"),
       sink_type: string2().describe("Sink type (e.g. sql_execution, command_execution, file_operations)"),
       sink_symbol: string2().optional().describe("Sink symbol (e.g. '->query(')"),
-      chain_id: string2().optional().describe("Escalation chain id")
+      chain_id: string2().optional().describe("Escalation chain id"),
+      evidence: string2().optional().describe("JSON array of evidence entries: [{type, description, content?}] — attached at creation (redacted + SHA-256 tagged)")
+    }
+  }, async ({ title, target_type, host, endpoint, severity, cwe, source_type, source_name, sink_type, sink_symbol, chain_id, evidence }) => {
+    let evs = [];
+    if (evidence) {
+      try {
+        evs = JSON.parse(evidence);
+      } catch {
+        return { content: [{ type: "text", text: JSON.stringify({ error: "invalid evidence JSON" }) }] };
+      }
     }
-  }, async ({ title, target_type, host, endpoint, severity, cwe, source_type, source_name, sink_type, sink_symbol, chain_id }) => {
     const f = makeFinding({
       title,
       target: { type: target_type ?? "web", host, endpoint },
@@ -57193,9 +57227,19 @@ ${statusLine}` : statusLine },
       source: { type: source_type, name: source_name },
       sink: { type: sink_type, symbol: sink_symbol },
       chainId: chain_id ?? null,
-      status: "detected"
+      status: "detected",
+      evidence: evs
     });
-    return { content: [{ type: "text", text: JSON.stringify(f) }] };
+    const empty = (f.evidence ?? []).length === 0;
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          ...f,
+          _warning: empty ? "finding created with NO evidence — if you hold the observed artifact (headers/URL/body), attach it now via `evidence` or finding_attach_evidence" : undefined
+        })
+      }]
+    };
   });
   server.registerTool("finding_transition", {
     title: "Advance a finding lifecycle",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.8",
+  "version": "2.4.10",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {