I built a Windows security check-up that tells you what it couldn't check

Toma Damoyi — Fri, 30 Oct 2026 20:20:33 +0000

Most security apps show a green tick even when they never actually looked. A disabled service, a probe that timed out, a scan that died halfway: all of these tend to come back as "protected".

I built Blanktick around the opposite rule: "not checked" is a first-class result. If a check fails or a scan doesn't finish, the app says so, with a reason, and you get no score at all instead of a made-up one.

It's free, open source (AGPL), runs offline, and is now on the Microsoft Store. Source: github.com/opemaid/blanktick.

What it checks

Every file on every drive. Version 0.1.2 adds a whole-PC scan that drives the Microsoft Defender engine already on Windows, drive by drive, in report-only mode. Nothing is moved or deleted; you get the list and decide.
70 Windows settings attackers change: firewall, Defender state, updates, BitLocker, remote access, risky startup items, extra root certificates and more.
The AI layer: local model servers listening on the network, plaintext AI API keys on disk, MCP tools you've installed, and agents that outside content can steer (prompt injection).

A fun gotcha: MpCmdRun's exit codes

MpCmdRun.exe -Scan -ScanType 3 -File D:\ -DisableRemediation exits 0 when clean and 2 when it finds threats. It also exits 2 when it couldn't scan at all, printing something like:

CmdTool: Failed with hr = 0x80070002

If you only look at the exit code, a failed scan reads as a detection (or, in a lazier implementation, a non-zero you ignore reads as clean). Blanktick checks for the failure HRESULT first, so a drive that couldn't be read is listed as not scanned, never as clean and never as infected.

Your AI agent, read-only

Blanktick ships a stdio MCP server with 8 read-only tools (scan, facts, coverage, history, search...). Connect Claude or another agent and it can explain what's exposed on your PC. It cannot change anything: there are no fix tools by design, and a test enforces that. The agent explains; you act.

How "offline" is enforced

A desktop JVM has no permission model, so "we don't send data" is just a promise. Blanktick makes it a build failure instead:

assertNoNetworkBytecode scans the compiled classes for any reference to java.net.Socket, HttpURLConnection, SocketChannel and friends.
auditDependencyNetworkSurface pins every runtime jar and fails if the set changes or one starts containing networking code.
The gate is positive-controlled: a self-test flag must make it fail, otherwise its silence means nothing.

Try it

Microsoft Store (signed by Microsoft, no SmartScreen warning): https://apps.microsoft.com/detail/9MW3G5H3RF3M
Or winget install 9MW3G5H3RF3M -s msstore
Site and direct downloads: https://blanktick.org