BBLA (Blind LLM Agents)

Tested npm bla-agents 3.2.4 (MIT; repo qybaihe/bla, 5,156 GitHub stars when checked, created 2026-10-25) through `bla-agents mcp`. Stdio, 31 tools for auditing, linting and hardening shipped JavaScript, WASM, Electron and Python artifacts, no account. Real calls on a one-file JavaScript test project: bla_discover listed the artifact, bla_audit returned an exposure report (score 81, UNPROTECTED) and bla_lint_plaintext_secrets found no cleartext secrets; bla_doctor (self-check) reported all engines ready. The tools that rewrite files (bla_harden, bla_protect, bla_encrypt_strings, bla_init and similar) were not called. The README has no MCP client config, so the Quick config below is the command we ran.
Tool-call test (2026-11-11, direct MCP stdio client, no LLM): pass. 3 of 3 read calls passed on a local test project, no key (plus 1 self-check). File-rewriting tools not called. Evidence: local test run, Nov 11, 2026.

Transport (tested 2026-11-11): stdio

Score 95/100 · Tools 31 · Token cost approx. 8,212 tokens · Compare · Last tested 2026-11-11 · Version tested 3.2.4 · Package bla-agents · Repo qybaihe/bla

Summary: BLA (Blind LLM Agents) completed an MCP handshake without credentials and exposed 31 tools.

Evidence summary

Handshake

pass

Tools listed

31

Context cost

approx. 8212 tokens, cl100k estimate (31 tools, measured 2026-11-11, version 3.2.4; an estimate) ranking · add up your servers' context cost

API key

No key needed for the tools we called

Tested

2026-11-11

Test results

Local-model readiness

Token cost (estimate): approx. 8212 tokens, cl100k estimate for 31 tools · about 100% of an 8k context. This is an estimate from our testing (counted with cl100k_base).

Small-model friendly (schema heuristic, not a model result): unknown.

What we tested and what we didn't

Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.

{
  "name": "bla-agents",
  "version": "3.2.4",
  "registry": "npm",
  "status": "working",
  "tested": "2026-11-11",
  "tools_count": 31,
  "deprecated": false,
  "archived": false,
  "tests": {
    "install": [
      "pass",
      20,
      "`npm install bla-agents` (Node 20, Linux) succeeded in 1s."
    ],
    "handshake": [
      "pass",
      30,
      "MCP `initialize` + `tools/list` over stdio succeeded with no credentials; 31 tools listed in 6.2s."
    ],
    "maintenance": [
      "pass",
      25,
      "Repo pushed 0 days before test; 5,156 GitHub stars."
    ],
    "docs": [
      "partial",
      10,
      "README over 3,000 chars; install instructions present. Check of the package's own README (README shipped in npm package)."
    ],
    "license": [
      "pass",
      10,
      "MIT (OSI-approved)."
    ]
  }
}

Install

npx -y bla-agents mcpCopy

Pin the version we tested

npx -y bla-agents@3.2.4 mcpCopy

tested 2026-11-11. Newer versions may differ and were not tested by us.

{
  "mcpServers": {
    "bla-blind-llm-agents": {
      "command": "npx",
      "args": [
        "-y",
        "bla-agents@3.2.4",
        "mcp"
      ]
    }
  }
}

Tools listed

bla_audit, bla_benchmark, bla_bind_scope, bla_defend, bla_discover, bla_doctor, bla_emit_headers, bla_encrypt_strings, bla_harden, bla_init, bla_inspect_release, bla_lint, bla_lint_bind_scope, bla_lint_integrity_coverage, bla_lint_js_aes_unwrap, bla_lint_js_wasm_hydrate_dump, bla_lint_lanes, bla_lint_panel_derive, bla_lint_plaintext_secrets, bla_lint_seal, bla_lint_wasm_params, bla_lint_wasm_seal_xor_known_plaintext, bla_lint_wasm_xor_mask_sidecar, bla_polymorph_report, bla_protect, bla_rea_drift, bla_redteam_report, bla_run_lookup, bla_verify, bla_verify_weave, bla_weave_plan

Tool history: captured Nov 11, 2026. All tool history.

Quick config

config from our testing; README has none

{
  "mcpServers": {
    "bla-blind-llm-agents": {
      "command": "npx",
      "args": [
        "-y",
        "bla-agents",
        "mcp"
      ]
    }
  }
}

Add to config Opens the config generator with this server selected.

{
  "mcpServers": {
    "bla-blind-llm-agents": {
      "command": "npx",
      "args": [
        "-y",
        "bla-agents",
        "mcp"
      ]
    }
  }
}

Related: Troubleshooting: Protocol version mismatch (HTTP 400)

FAQ

Is BLA (Blind LLM Agents) deprecated?

No. bla-agents was not deprecated or archived when we last tested it on 2026-11-11.

What replaces BLA (Blind LLM Agents)?

Nothing; BLA (Blind LLM Agents) is not deprecated as of 2026-11-11.

Does BLA (Blind LLM Agents) need an API key?

No. It completed an MCP handshake with no credentials and listed 31 tools.

Embed the badge

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Copy HTML

Copy Markdown Claim this listing · Report an issue