blitzstrike 2.4.9 → 2.4.10

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.10] — 2026-09-14
+
+### Added — auto-install external MCP servers to every agent
+
+- chrome-devtools-mcp is now flagged `installable` in the catalog: `install-tools`
+  / `install_all_tools` provision it (npm i -g) instead of skipping all MCP
+  servers. burp-suite-mcp stays skipped (GUI/daemon — build + run manually).
+- `blitzstrike install` (register to every agent) now also auto-installs
+  chrome-devtools-mcp so all agents can drive a real browser immediately.
+
+### Fixed — doctor git stderr leak
+
+- `validateRelease` suppresses git/npm stderr, so `blitzstrike doctor` no longer
+  prints a stray `fatal: not a git repository` / `No tags can describe` line when
+  run outside a git checkout.
+
 ## [2.4.9] — 2026-09-14
 
 ### Added — evidence-first enforcement (findings are never born empty)

package/dist/index.js

@@ -7633,9 +7633,9 @@ function ensureToolAsync(name, timeoutMs = 120000) {
 }
 async function installAllTools(opts = {}) {
   const tools = loadTools();
-  const mcp = tools.filter((t) => t.category === "mcp-server").map((t) => t.name);
+  const skippedMcp = tools.filter((t) => t.category === "mcp-server" && t.installable !== true).map((t) => t.name);
   const cat = opts.category?.toLowerCase();
-  const targets = tools.filter((t) => t.category !== "mcp-server" && (!cat || t.category === cat));
+  const targets = tools.filter((t) => (t.category !== "mcp-server" || t.installable === true) && (!cat || t.category === cat));
   const concurrency = Math.max(1, opts.concurrency ?? 4);
   const results = [];
   let idx = 0;
@@ -7657,7 +7657,7 @@ async function installAllTools(opts = {}) {
     installed,
     already_installed: already,
     failed,
-    skipped_mcp_servers: mcp,
+    skipped_mcp_servers: skippedMcp,
     results
   };
 }
@@ -15579,13 +15579,13 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8" }).trim();
+    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
-    checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git)", soft: true });
+    checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
   }
   try {
-    const published = execSync4("npm view blitzstrike version", { encoding: "utf8", timeout: 8000 }).trim();
+    const published = execSync4("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
   } catch {
     checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
@@ -15958,6 +15958,11 @@ Agent-specific formats: see docs/installation.md`);
   console.log(`
 Registered with ${ok}/${installed.length} agent(s).`);
   console.log("Restart your agent, then call `run_engagement` or any `blitzstrike` tool.");
+  console.log(`
+External MCP servers:`);
+  const devtools = ensureTool("chrome-devtools-mcp");
+  console.log(`  ${devtools.installed ? "OK  " : "FAIL"} chrome-devtools-mcp  ${devtools.installed ? "installed (browser MCP ready for all agents)" : devtools.command ?? "install failed"}`);
+  console.log(`  SKIP burp-suite-mcp  GUI/daemon — build manually (PortSwigger/mcp-server) + load in Burp (connect, not install)`);
 }
 async function runInstallTools(args) {
   const getArg = (flag) => {
@@ -15975,9 +15980,9 @@ async function runInstallTools(args) {
   await Promise.resolve().then(() => init_catalog());
   if (dryRun) {
     const tools = loadTools();
-    const mcp = tools.filter((t) => t.category === "mcp-server");
-    const targets = tools.filter((t) => t.category !== "mcp-server" && (!category || t.category === category.toLowerCase()));
-    console.log(`Dry run — would attempt ${targets.length} tool(s); ${mcp.length} MCP server(s) skipped (connect, not install):`);
+    const mcp = tools.filter((t) => t.category === "mcp-server" && t.installable !== true);
+    const targets = tools.filter((t) => (t.category !== "mcp-server" || t.installable === true) && (!category || t.category === category.toLowerCase()));
+    console.log(`Dry run — would attempt ${targets.length} tool(s); ${mcp.length} MCP server(s) skipped (GUI/daemon — connect, not install):`);
     for (const t of targets)
       console.log(`  ${t.category.padEnd(11)} ${t.name}`);
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.9",
+  "version": "2.4.10",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {