CyberStrikeAI

CyberStrikeAI

[中文](README_CN.md) | [English](README.md)

Community: Join us on Discord

WeChat group (click to reveal QR code)

Sponsorship (click to expand)

If CyberStrikeAI helps you, you can support the project via WeChat Pay or Alipay:

CyberStrikeAI is an AI-native security testing platform built in Go. It integrates 100+ security tools, an intelligent orchestration engine, role-based testing with predefined security roles, a skills system with specialized testing skills, comprehensive lifecycle management capabilities, and a built-in lightweight C2 (Command & Control) framework for authorized engagements (listeners, encrypted implants, sessions, tasks, real-time events, REST and MCP). Through native MCP protocol and AI agents, it enables end-to-end automation from conversational commands to vulnerability discovery, attack-chain analysis, knowledge retrieval, and result visualization—delivering an auditable, traceable, and collaborative testing environment for security teams.

Interface & Integration Preview

System Dashboard Overview

The dashboard provides a comprehensive overview of system runtime status, security vulnerabilities, tool usage, and knowledge base, helping users quickly understand the platform's core features and current state.

Core Features Overview

Web Console

Task Management

Vulnerability Management

WebShell Management

MCP Management

Knowledge Base

Skills Management

Agent Management

Role Management

System Settings

MCP stdio Mode

Burp Suite Plugin

Highlights

• 🤖 AI decision engine with OpenAI-compatible models (GPT, Claude, DeepSeek, etc.)
• 🔌 Native MCP implementation with HTTP/stdio/SSE transports and external MCP federation
• 🧰 100+ prebuilt tool recipes + YAML-based extension system
• 📄 Large-result pagination, compression, and searchable archives
• 🔗 Attack-chain graph, risk scoring, and step-by-step replay
• 🔒 Password-protected web UI, audit logs, and SQLite persistence
• 📚 Knowledge base (RAG) with embedding-based vector retrieval (cosine similarity), optional Eino Compose indexing pipeline, and configurable post-retrieval budgets / reranking hooks
• 📁 Conversation grouping with pinning, rename, and batch management
• 📂 Project management: shared facts (blackboard) across sessions, upsert_project_fact + links to chain paths; attack-chain and project fact graph views
• 🛡️ Vulnerability management with CRUD operations, severity tracking, status workflow, and statistics
• 📋 Batch task management: create task queues, add multiple tasks, and execute them sequentially
• 🎭 Role-based testing: predefined security testing roles (Penetration Testing, CTF, Web App Scanning, etc.) with custom prompts and tool restrictions
• 🧩 Agent orchestration (CloudWeGo Eino): single-agent via /api/eino-agent/stream (Eino ADK ChatModelAgent); multi-agent via /api/multi-agent/stream with deep (coordinator + task sub-agents), plan_execute, or supervisor (orchestration in the request body). ADK summarization compresses long contexts; pre-compaction transcripts land at data/conversation_artifacts//summarization/transcript.txt (full user/assistant/tool turns; static system omitted). Markdown under agents/: orchestrator.md, orchestrator-plan-execute.md, orchestrator-supervisor.md, plus sub-agent *.md (see [Multi-agent doc](docs/MULTIAGENTEINO.md))
• 🖼️ Vision analysis (analyze_image): separate VL model (e.g. qwen-vl-max) via MCP for local screenshots, captchas, and UI; image bytes stay out of agent history (text summaries only). Configure vision in config.yaml; see [docs/VISION.md](docs/VISION.md)
• 🎯 Skills (refactored for Eino): packs under skills_dir follow Agent Skills layout (SKILL.md + optional files); multi-agent sessions use the official Eino ADK skill tool for progressive disclosure (load by name), with optional host filesystem / shell via multi_agent.eino_skills; optional eino_middleware adds patchtoolcalls, tool_search, plantask (TaskCreate / TaskList boards under skills_dir/.eino/plantask/), reduction, file checkpoints (checkpoint_dir), ChatModel retries, session output key, and Deep tuning—20+ sample domains (SQLi, XSS, API security, …) ship under skills/
• 📱 Chatbot: DingTalk and Lark (Feishu) long-lived connections so you can talk to CyberStrikeAI from mobile (see [Robot / Chatbot guide](docs/robot_en.md) for setup and commands)
• 🧑‍⚖️ Human-in-the-loop (HITL): Chat sidebar to set approval mode and tool allowlists (listed tools skip approval); global list in config.yaml under hitl.tool_whitelist; Apply can merge new tools into the file and update the running server without restart; dedicated HITL page for pending approvals
• 🐚 WebShell management: Add and manage WebShell connections (e.g. IceSword/AntSword compatible), use a virtual terminal for command execution, a built-in file manager for file operations, and an AI assistant tab that orchestrates tests and keeps per-connection conversation history; supports PHP, ASP, ASPX, JSP and custom shell types with configurable request method and command parameter.
• 📡 Built-in C2: AI-oriented lightweight command-and-control—listeners (TCP reverse, HTTP/HTTPS beacon, WebSocket), encrypted beacon channel, session and task queues with persistence, payload helpers (one-liner / build / download), SSE live events, REST under /api/c2/*, plus unified MCP tools (c2_listener, c2_session, c2_task, c2_task_manage, c2_payload, c2_event, c2_profile, c2_file); optional HITL approval for sensitive operations and OPSEC-style controls (e.g. command deny rules). Authorized testing only.

Plugins

CyberStrikeAI includes optional integrations under plugins/.

• Burp Suite extension: plugins/burp-suite/cyberstrikeai-burp-extension/

Build output: plugins/burp-suite/cyberstrikeai-burp-extension/dist/cyberstrikeai-burp-extension.jar Docs: plugins/burp-suite/cyberstrikeai-burp-extension/README.md

Tool Overview

CyberStrikeAI ships with 100+ curated tools covering the whole kill chain:

• Network Scanners – nmap, masscan, rustscan, arp-scan, nbtscan
• Web & App Scanners – sqlmap, nikto, dirb, gobuster, feroxbuster, ffuf, httpx
• Vulnerability Scanners – nuclei, wpscan, wafw00f, dalfox, xsser
• Subdomain Enumeration – subfinder, amass, findomain, dnsenum, fierce
• Network Space Search Engines – fofasearch, zoomeyesearch
• API Security – graphql-scanner, arjun, api-fuzzer, api-schema-analyzer
• Container Security – trivy, clair, docker-bench-security, kube-bench, kube-hunter
• Cloud Security – prowler, scout-suite, cloudmapper, pacu, terrascan, checkov
• Binary Analysis – gdb, radare2, ghidra, objdump, strings, binwalk
• Exploitation – metasploit, msfvenom, pwntools, ropper, ropgadget
• Password Cracking – hashcat, john, hashpump
• Forensics – volatility, volatility3, foremost, steghide, exiftool
• Post-Exploitation – linpeas, winpeas, mimikatz, bloodhound, impacket, responder
• CTF Utilities – stegsolve, zsteg, hash-identifier, fcrackzip, pdfcrack, cyberchef
• System Helpers – exec, create-file, delete-file, list-files, modify-file

Basic Usage

Quick Start (One-Command Deployment)

Prerequisites:

• Go 1.21+ (Install)
• Python 3.10+ (Install)

One-Command Deployment:

git clone https://github.com/Ed1s0nZ/CyberStrikeAI.git
cd CyberStrikeAI
chmod +x run.sh && ./run.sh

The run.sh script will automatically:

• ✅ Check and validate Go & Python environments
• ✅ Create Python virtual environment
• ✅ Install Python dependencies
• ✅ Download Go dependencies
• ✅ Build the project
• ✅ Start the server

Networking defaults: run.sh starts the server with --https and the repo config.yaml (local self-signed TLS; better for many concurrent streams). Use ./run.sh --http for plain HTTP. In production, set server.tls_cert_path / server.tls_key_path in config.yaml (see comments there). For manual runs, add --https or CYBERSTRIKE_HTTPS=1; if -config is wrong, the binary prints a short usage hint on stderr.

First-Time Configuration:

1. Configure OpenAI-compatible API (required before first use)

• After launch, open https://127.0.0.1:8080/ (or https://localhost:8080/; replace 8080 with server.port in config.yaml) and accept the self-signed certificate warning once. If you used ./run.sh --http, use http:// instead.
• Go to Settings → Fill in your API credentials:

``yaml openai: api_key: "sk-your-key" base_url: "https://api.openai.com/v1" # or https://api.deepseek.com/v1 model: "gpt-4o" # or deepseek-chat, claude-3-opus, etc. ``

• Or edit config.yaml directly before launching

1. Login - Use the auto-generated password shown in the console (or set auth.password in config.yaml)
2. Install security tools (optional) - Install tools from tools/ as needed; missing tools are skipped or substituted at runtime. Common examples:

macOS (Homebrew): ``bash brew install nmap masscan sqlmap nikto gobuster ffuf hydra hashcat nuclei subfinder ``

Linux (Kali / Debian / Ubuntu): ``bash sudo apt update sudo apt install -y nmap masscan sqlmap nikto gobuster hydra hashcat john binwalk # On some distros, install ffuf/nuclei/subfinder via go install or upstream docs ``

See the tools/ directory for the full list; refer to each tool's official docs for install details.

Alternative Launch Methods:

# Direct Go run (set up env yourself); add --https to match run.sh defaults
go run cmd/server/main.go --https

# Manual build
go build -o cyberstrike-ai cmd/server/main.go
./cyberstrike-ai --https

If server logs show client sent an HTTP request to an HTTPS server, a client is still using http:// on a TLS-only port—switch the URL to https://.

Note: The Python virtual environment (venv/) is automatically created and managed by run.sh. Tools that require Python (like api-fuzzer, http-framework-test, etc.) will automatically use this environment.

Version Update (No Breaking Changes)

CyberStrikeAI one-click upgrade (recommended):

1. (First time) enable the script: chmod +x upgrade.sh
2. Upgrade with: ./upgrade.sh (optional flags: --tag vX.Y.Z, --no-venv, --yes). Local tools/, roles/, and skills/ are always preserved.
3. The script will back up your config.yaml and data/, upgrade the code from GitHub Release, update config.yaml's version, then restart the server.

Recommended one-liner: chmod +x upgrade.sh && ./upgrade.sh --yes

If something goes wrong, you can restore from .upgrade-backup/ (or manually copy /data and config.yaml back) and run ./run.sh again.

Requirements / tips:

• You need curl or wget for downloading Release packages.
• rsync is recommended/required for the safe code sync.
• If GitHub API rate-limits you, set export GITHUB_TOKEN="..." before running ./upgrade.sh.

⚠️ Note: This procedure only applies to version updates without compatibility or breaking changes. If a release includes compatibility changes, this method may not apply.

Examples: No breaking changes — e.g. v1.3.1 → v1.3.2; with breaking changes — e.g. v1.3.1 → v1.4.0. The project follows Semantic Versioning (SemVer): when only the patch version (third number) changes, this upgrade path is usually safe; when the minor or major version changes, config, data, or APIs may have changed — check the release notes before using this method.

Core Workflows

• Conversation testing – Natural-language prompts trigger toolchains with streaming SSE output.
• Single vs multi-agent – Chat UI switches between Eino single-agent (/api/eino-agent/stream) and multi-agent (/api/multi-agent/stream with orchestration: deep | plan_execute | supervisor). Multi mode requires multi_agent.enabled: true. MCP tools are bridged the same way for both paths.
• Role-based testing – Select from predefined security testing roles (Penetration Testing, CTF, Web App Scanning, API Security Testing, etc.) to customize AI behavior and tool availability. Each role applies custom system prompts and can restrict available tools for focused testing scenarios.
• Tool monitor – Inspect running jobs, execution logs, and large-result attachments.
• History & audit – Every conversation and tool invocation is stored in SQLite with replay.
• Conversation groups – Organize conversations into groups, pin important groups, rename or delete groups via context menu.
• Vulnerability management – Create, update, and track vulnerabilities discovered during testing. Filter by severity (critical/high/medium/low/info), status (open/confirmed/fixed/false_positive), and conversation. View statistics and export findings.
• Batch task management – Create task queues with multiple tasks, add or edit tasks before execution, and run them sequentially. Each task executes as a separate conversation, with status tracking (pending/running/completed/failed/cancelled) and full execution history.
• WebShell management – Add and manage WebShell connections (PHP/ASP/ASPX/JSP or custom). Use the virtual terminal to run commands, the file manager to list, read, edit, upload, and delete files, and the AI assistant tab to drive scripted tests with per-connection conversation history. Connections are stored in SQLite; supports GET/POST and configurable command parameter (e.g. IceSword/AntSword style).
• Built-in C2 – Create/start listeners, generate payloads, track sessions, enqueue tasks, and subscribe to events (SSE) from the Web UI or /api/c2/*. Agents and external clients use the C2 MCP tool family (including c2_task); when HITL is enabled, high-risk tasks can require human approval. Intended only for systems you are explicitly authorized to test.
• Settings – Tweak provider keys, MCP enablement, tool toggles, and agent iteration limits.
• Human-in-the-loop (HITL) – Sidebar sets mode and allowlisted tools (comma- or newline-separated); global list lives in config.yaml under hitl.tool_whitelist. Apply updates browser/server and can merge new tools into the file (no restart). New chat keeps sidebar choices; HITL nav shows pending approvals. Removing a tool in the sidebar does not remove it from the global list in config.yaml—edit the file if needed.

Built-in Safeguards

• Required-field validation prevents accidental blank API credentials.
• Auto-generated strong passwords when auth.password is empty.
• Unified auth middleware for every web/API call (Bearer token flow).
• Timeout and sandbox guards per tool, plus structured logging for triage.

Advanced Usage

Role-Based Testing

• Predefined roles – System includes 12+ predefined security testing roles (Penetration Testing, CTF, Web App Scanning, API Security Testing, Binary Analysis, Cloud Security Audit, etc.) in the roles/ directory.
• Custom prompts – Each role can define a user_prompt that prepends to user messages, guiding the AI to adopt specialized testing methodologies and focus areas.
• Tool restrictions – Roles can specify a tools list to limit available tools, ensuring focused testing workflows (e.g., CTF role restricts to CTF-specific utilities).
• Skills – Skill packs live under skills_dir and load via the Eino ADK skill tool (progressive disclosure) in both single- and multi-agent sessions when multi_agent.eino_skills is

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Ed1s0nZ
• Source: Ed1s0nZ/CyberStrikeAI
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.