I built a Windows security check-up that tells you what it couldn't check

Most security apps show a green tick even when they never actually looked. A disabled service, a probe that timed out, a scan that died halfway: all of these tend to come back as "protected".

I built Blanktick around the opposite rule: "not checked" is a first-class result. If a check fails or a scan doesn't finish, the app says so, with a reason, and you get no score at all instead of a made-up one.

It's free, open source (AGPL), runs offline, and is now on the Microsoft Store. Source: github.com/opemaid/blanktick.

What it checks

• Every file on every drive. Version 0.1.2 adds a whole-PC scan that drives the Microsoft Defender engine already on Windows, drive by drive, in report-only mode. Nothing is moved or deleted; you get the list and decide.
• 70 Windows settings attackers change: firewall, Defender state, updates, BitLocker, remote access, risky startup items, extra root certificates and more.
• The AI layer: local model servers listening on the network, plaintext AI API keys on disk, MCP tools you've installed, and agents that outside content can steer (prompt injection).

A fun gotcha: MpCmdRun's exit codes

MpCmdRun.exe -Scan -ScanType 3 -File D:\ -DisableRemediation exits 0 when clean and 2 when it finds threats. It also exits 2 when it couldn't scan at all, printing something like:

CmdTool: Failed with hr = 0x80070002

If you only look at the exit code, a failed scan reads as a detection (or, in a lazier implementation, a non-zero you ignore reads as clean). Blanktick checks for the failure HRESULT first, so a drive that couldn't be read is listed as not scanned, never as clean and never as infected.

Your AI agent, read-only

Blanktick ships a stdio MCP server with 8 read-only tools (scan, facts, coverage, history, search...). Connect Claude or another agent and it can explain what's exposed on your PC. It cannot change anything: there are no fix tools by design, and a test enforces that. The agent explains; you act.

How "offline" is enforced

A desktop JVM has no permission model, so "we don't send data" is just a promise. Blanktick makes it a build failure instead:

• assertNoNetworkBytecode scans the compiled classes for any reference to java.net.Socket, HttpURLConnection, SocketChannel and friends.
• auditDependencyNetworkSurface pins every runtime jar and fails if the set changes or one starts containing networking code.
• The gate is positive-controlled: a self-test flag must make it fail, otherwise its silence means nothing.

Try it

• Microsoft Store (signed by Microsoft, no SmartScreen warning): https://apps.microsoft.com/detail/9MW3G5H3RF3M
• Or winget install 9MW3G5H3RF3M -s msstore
• Site and direct downloads: https://blanktick.org

I'd love feedback, especially on which checks are missing or which ones give you a false positive.