Picking up where I left off
In my midterm update, I introduced the two main parts I was working on for OWASP BLT: BLT-MCP, which connects AI models with the BLT API, and BLT-CLI, a Rust-based terminal interface for working with BLT.
At that point, most of the foundation was there, but some of the features were still being worked on. The triage workflow was still coming together, and the screenshot analysis feature was only an early experiment. Since then, both have come together quite a bit, so here is where the project is now.
What BLT-CLI can do now
The CLI has grown quite a bit since the midterm version. You can browse vulnerabilities, search and filter reports, view bounty hunts, check contributor rankings, inspect individual vulnerabilities, submit new reports, and use the AI features for analysis and screenshots.
There are also logs and health information available from the interface. Guest mode is available as well, so you can explore the application without having to configure everything first.
Here is a small demo of BLT-CLI running in guest mode -
How it works
There are currently two ways to use the CLI. In the basic mode, it talks directly to the BLT API.
When AI features are needed, it can use BLT-MCP, which sits between the CLI, the BLT API, and the AI models. This keeps the terminal interface focused on the actual user experience while the MCP server handles the connection between the different services.
AI-assisted triage
One of the main things I wanted to experiment with was using AI to help with triage. When looking at a vulnerability, the AI can analyze the available information and provide suggestions around severity, attack vectors, potential impact, duplicate risk, and other things worth considering.
The AI does not automatically change the vulnerability. It gives you an analysis that you can review and decide what to do with. I think this is an important distinction. AI can save time when doing repetitive analysis, but I did not want it making changes behind the scenes.
Submitting reports from the terminal
The report submission workflow is also now part of the CLI. You can fill in the usual information such as the title, URL, severity, bug type, description, and proof of concept.
The form can be filled out entirely from the terminal and submitted directly to BLT. So the workflow can now go from looking at a vulnerability, analyzing it, writing the report, and submitting it without having to constantly move between different applications.
From a screenshot to a report
This was probably the feature I was most interested in when I started working on the project. At the time of the midterm update, the vision part was still very experimental. Now it works as part of the normal workflow.
You can provide a screenshot and the vision model can analyze it and help fill in parts of a vulnerability report, including the title and reproduction steps.
What comes next
There is still plenty to improve. Some of them are better AI analysis, more reliable MCP tools, smoother TUI workflows, better error handling, and more functionality in the CLI.
I also want to keep experimenting with how AI can fit into security workflows without turning everything into an automatic black box. The current version is really just a starting point.
Wrapping up
This also concludes my summer term project. It was genuinely fun to spend the term building and testing new things, especially getting to work with Rust, MCP, AI models, and the terminal UI together.
Not everything worked on the first try, and there were plenty of things I had to rethink along the way, but that was probably one of the best parts of the project. I got to experiment with different ideas and see what actually made sense once everything was put together.
There is still a lot that can be improved, but I am happy with where the project ended up compared to where it started.
Try it out
The project is still evolving, so there are definitely some rough edges.
BLT-CLI and BLT-MCP will be published soon, and once they are available, you will be able to try them out yourself. If you find something that does not work or have an idea for improving the workflow, feel free to open an issue or merge request.
The project is still being built, and feedback from people actually using it is probably the most useful thing it can get.
Thank you for reading and following along!!
