[venkatas]

Summary

• Port three HexStrike ideas only. HexStrike is not forked, vendored, imported, or launched. No 150-tool MCP server and no cloud LLM loop.
• MCP facade (mcp/vik-mcp/server.py) is opt-in stdlib JSON-RPC so Cursor can list/load skills, read session status, look up a cached tool result, dry-run scope, or read coverage notes. There is no shell or run-command tool.
• Session tool cache (session_tool_cache.py) fits hunt.py run_cmd / run_cmd_args. Key is target + tool + args. Disk is under the session dir. Secrets are not stored. Scope is respected. Off unless VIK_SESSION_TOOL_CACHE=1, so the default scan path does not run or skip tools.
• Optional cloud/CTF notes are skill stubs and a short list, not an install wall. ALLOW_STATE_CHANGES and aggression defaults are unchanged.

Docs: docs/hexstrike-patterns.md

Test plan

• .venv/bin/python -m pytest tests/test_session_tool_cache.py tests/test_vik_mcp.py tests/test_hunt_session_tool_cache.py tests/test_skill_loader.py (23 passed)
• Confirm no HexStrike source is vendored and setup.sh only prints a pointer
• Point Cursor MCP at python3 mcp/vik-mcp/server.py and call vik_list_skills / vik_scope_check (no traffic)
• Optional: VIK_SESSION_TOOL_CACHE=1 and confirm a second identical httpx argv in the same session is a cache hit