# CyberStrikeAI > CyberStrikeAI is an AI-native security testing platform built in Go. It integrates 100+ security tools, an intelligent orchestration engine, role-based testing with predefined security roles, a skills system with specialized testing skills, and comprehensive lifecycle management capabilities. - **Type:** MCP server - **Install:** `agentstack add mcp-ed1s0nz-cyberstrikeai` - **Verified:** Yes β€” security-reviewed for prompt injection and unsafe behavior - **Seller:** [Ed1s0nZ](https://agentstack.voostack.com/s/ed1s0nz) - **Installs:** 0 - **Category:** [Integrations](https://agentstack.voostack.com/c/integrations) - **Latest version:** 0.1.0 - **License:** Apache-2.0 - **Upstream author:** [Ed1s0nZ](https://github.com/Ed1s0nZ) - **Source:** https://github.com/Ed1s0nZ/CyberStrikeAI ## Install ```sh agentstack add mcp-ed1s0nz-cyberstrikeai ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # CyberStrikeAI [δΈ­ζ–‡](README_CN.md) | [English](README.md) **Community**: [Join us on Discord](https://discord.gg/8PjVCMu8Zw) WeChat group (click to reveal QR code) Sponsorship (click to expand) If CyberStrikeAI helps you, you can support the project via **WeChat Pay** or **Alipay**: CyberStrikeAI is an **AI-native security testing platform** built in Go. It integrates 100+ security tools, an intelligent orchestration engine, role-based testing with predefined security roles, a skills system with specialized testing skills, comprehensive lifecycle management capabilities, and a **built-in lightweight C2 (Command & Control) framework** for **authorized** engagements (listeners, encrypted implants, sessions, tasks, real-time events, REST and MCP). Through native MCP protocol and AI agents, it enables end-to-end automation from conversational commands to vulnerability discovery, attack-chain analysis, knowledge retrieval, and result visualizationβ€”delivering an auditable, traceable, and collaborative testing environment for security teams. ## Interface & Integration Preview ### System Dashboard Overview *The dashboard provides a comprehensive overview of system runtime status, security vulnerabilities, tool usage, and knowledge base, helping users quickly understand the platform's core features and current state.* ### Core Features Overview Web Console Task Management Vulnerability Management WebShell Management MCP Management Knowledge Base Skills Management Agent Management Role Management System Settings MCP stdio Mode Burp Suite Plugin ## Highlights - πŸ€– AI decision engine with OpenAI-compatible models (GPT, Claude, DeepSeek, etc.) - πŸ”Œ Native MCP implementation with HTTP/stdio/SSE transports and external MCP federation - 🧰 100+ prebuilt tool recipes + YAML-based extension system - πŸ“„ Large-result pagination, compression, and searchable archives - πŸ”— Attack-chain graph, risk scoring, and step-by-step replay - πŸ”’ Password-protected web UI, audit logs, and SQLite persistence - πŸ“š Knowledge base (RAG) with embedding-based vector retrieval (cosine similarity), optional **Eino Compose** indexing pipeline, and configurable post-retrieval budgets / reranking hooks - πŸ“ Conversation grouping with pinning, rename, and batch management - πŸ“‚ **Project management**: shared facts (blackboard) across sessions, `upsert_project_fact` + `links` to chain paths; attack-chain and project fact graph views - πŸ›‘οΈ Vulnerability management with CRUD operations, severity tracking, status workflow, and statistics - πŸ“‹ Batch task management: create task queues, add multiple tasks, and execute them sequentially - 🎭 Role-based testing: predefined security testing roles (Penetration Testing, CTF, Web App Scanning, etc.) with custom prompts and tool restrictions - 🧩 **Agent orchestration (CloudWeGo Eino)**: **single-agent** via **`/api/eino-agent/stream`** (Eino ADK `ChatModelAgent`); **multi-agent** via **`/api/multi-agent/stream`** with **`deep`** (coordinator + `task` sub-agents), **`plan_execute`**, or **`supervisor`** (`orchestration` in the request body). ADK **summarization** compresses long contexts; pre-compaction **transcripts** land at `data/conversation_artifacts//summarization/transcript.txt` (full user/assistant/tool turns; static system omitted). Markdown under `agents/`: `orchestrator.md`, `orchestrator-plan-execute.md`, `orchestrator-supervisor.md`, plus sub-agent `*.md` (see [Multi-agent doc](docs/MULTI_AGENT_EINO.md)) - πŸ–ΌοΈ **Vision analysis (`analyze_image`)**: separate VL model (e.g. `qwen-vl-max`) via MCP for local screenshots, captchas, and UI; image bytes stay out of agent history (text summaries only). Configure `vision` in `config.yaml`; see [docs/VISION.md](docs/VISION.md) - 🎯 **Skills (refactored for Eino)**: packs under `skills_dir` follow **Agent Skills** layout (`SKILL.md` + optional files); **multi-agent** sessions use the official Eino ADK **`skill`** tool for **progressive disclosure** (load by name), with optional **host filesystem / shell** via `multi_agent.eino_skills`; optional **`eino_middleware`** adds patchtoolcalls, tool_search, **plantask** (`TaskCreate` / `TaskList` boards under `skills_dir/.eino/plantask/`), reduction, file **checkpoints** (`checkpoint_dir`), ChatModel **retries**, session **output key**, and Deep tuningβ€”20+ sample domains (SQLi, XSS, API security, …) ship under `skills/` - πŸ“± **Chatbot**: DingTalk and Lark (Feishu) long-lived connections so you can talk to CyberStrikeAI from mobile (see [Robot / Chatbot guide](docs/robot_en.md) for setup and commands) - πŸ§‘β€βš–οΈ **Human-in-the-loop (HITL)**: Chat sidebar to set approval mode and tool allowlists (listed tools skip approval); global list in `config.yaml` under `hitl.tool_whitelist`; **Apply** can merge new tools into the file and update the running server without restart; dedicated **HITL** page for pending approvals - 🐚 **WebShell management**: Add and manage WebShell connections (e.g. IceSword/AntSword compatible), use a virtual terminal for command execution, a built-in file manager for file operations, and an AI assistant tab that orchestrates tests and keeps per-connection conversation history; supports PHP, ASP, ASPX, JSP and custom shell types with configurable request method and command parameter. - πŸ“‘ **Built-in C2**: AI-oriented lightweight command-and-controlβ€”**listeners** (TCP reverse, HTTP/HTTPS beacon, WebSocket), **encrypted** beacon channel, **session** and **task** queues with persistence, **payload** helpers (one-liner / build / download), **SSE** live events, REST under `/api/c2/*`, plus unified MCP tools (`c2_listener`, `c2_session`, **`c2_task`**, `c2_task_manage`, `c2_payload`, `c2_event`, `c2_profile`, `c2_file`); optional **HITL** approval for sensitive operations and OPSEC-style controls (e.g. command deny rules). **Authorized testing only.** ## Plugins CyberStrikeAI includes optional integrations under `plugins/`. - **Burp Suite extension**: `plugins/burp-suite/cyberstrikeai-burp-extension/` Build output: `plugins/burp-suite/cyberstrikeai-burp-extension/dist/cyberstrikeai-burp-extension.jar` Docs: `plugins/burp-suite/cyberstrikeai-burp-extension/README.md` ## Tool Overview CyberStrikeAI ships with 100+ curated tools covering the whole kill chain: - **Network Scanners** – nmap, masscan, rustscan, arp-scan, nbtscan - **Web & App Scanners** – sqlmap, nikto, dirb, gobuster, feroxbuster, ffuf, httpx - **Vulnerability Scanners** – nuclei, wpscan, wafw00f, dalfox, xsser - **Subdomain Enumeration** – subfinder, amass, findomain, dnsenum, fierce - **Network Space Search Engines** – fofa_search, zoomeye_search - **API Security** – graphql-scanner, arjun, api-fuzzer, api-schema-analyzer - **Container Security** – trivy, clair, docker-bench-security, kube-bench, kube-hunter - **Cloud Security** – prowler, scout-suite, cloudmapper, pacu, terrascan, checkov - **Binary Analysis** – gdb, radare2, ghidra, objdump, strings, binwalk - **Exploitation** – metasploit, msfvenom, pwntools, ropper, ropgadget - **Password Cracking** – hashcat, john, hashpump - **Forensics** – volatility, volatility3, foremost, steghide, exiftool - **Post-Exploitation** – linpeas, winpeas, mimikatz, bloodhound, impacket, responder - **CTF Utilities** – stegsolve, zsteg, hash-identifier, fcrackzip, pdfcrack, cyberchef - **System Helpers** – exec, create-file, delete-file, list-files, modify-file ## Basic Usage ### Quick Start (One-Command Deployment) **Prerequisites:** - Go 1.21+ ([Install](https://go.dev/dl/)) - Python 3.10+ ([Install](https://www.python.org/downloads/)) **One-Command Deployment:** ```bash git clone https://github.com/Ed1s0nZ/CyberStrikeAI.git cd CyberStrikeAI chmod +x run.sh && ./run.sh ``` The `run.sh` script will automatically: - βœ… Check and validate Go & Python environments - βœ… Create Python virtual environment - βœ… Install Python dependencies - βœ… Download Go dependencies - βœ… Build the project - βœ… Start the server **Networking defaults:** `run.sh` starts the server with **`--https`** and the repo **`config.yaml`** (local self-signed TLS; better for many concurrent streams). Use **`./run.sh --http`** for plain HTTP. In production, set **`server.tls_cert_path`** / **`server.tls_key_path`** in **`config.yaml`** (see comments there). For manual runs, add **`--https`** or **`CYBERSTRIKE_HTTPS=1`**; if **`-config`** is wrong, the binary prints a short usage hint on stderr. **First-Time Configuration:** 1. **Configure OpenAI-compatible API** (required before first use) - After launch, open **`https://127.0.0.1:8080/`** (or **`https://localhost:8080/`**; replace **8080** with `server.port` in `config.yaml`) and accept the self-signed certificate warning once. If you used `./run.sh --http`, use **`http://`** instead. - Go to `Settings` β†’ Fill in your API credentials: ```yaml openai: api_key: "sk-your-key" base_url: "https://api.openai.com/v1" # or https://api.deepseek.com/v1 model: "gpt-4o" # or deepseek-chat, claude-3-opus, etc. ``` - Or edit `config.yaml` directly before launching 2. **Login** - Use the auto-generated password shown in the console (or set `auth.password` in `config.yaml`) 3. **Install security tools (optional)** - Install tools from `tools/` as needed; missing tools are skipped or substituted at runtime. Common examples: **macOS (Homebrew):** ```bash brew install nmap masscan sqlmap nikto gobuster ffuf hydra hashcat nuclei subfinder ``` **Linux (Kali / Debian / Ubuntu):** ```bash sudo apt update sudo apt install -y nmap masscan sqlmap nikto gobuster hydra hashcat john binwalk # On some distros, install ffuf/nuclei/subfinder via go install or upstream docs ``` See the `tools/` directory for the full list; refer to each tool's official docs for install details. **Alternative Launch Methods:** ```bash # Direct Go run (set up env yourself); add --https to match run.sh defaults go run cmd/server/main.go --https # Manual build go build -o cyberstrike-ai cmd/server/main.go ./cyberstrike-ai --https ``` If server logs show `client sent an HTTP request to an HTTPS server`, a client is still using **`http://`** on a TLS-only portβ€”switch the URL to **`https://`**. **Note:** The Python virtual environment (`venv/`) is automatically created and managed by `run.sh`. Tools that require Python (like `api-fuzzer`, `http-framework-test`, etc.) will automatically use this environment. ### Version Update (No Breaking Changes) **CyberStrikeAI one-click upgrade (recommended):** 1. (First time) enable the script: `chmod +x upgrade.sh` 2. Upgrade with: `./upgrade.sh` (optional flags: `--tag vX.Y.Z`, `--no-venv`, `--yes`). Local `tools/`, `roles/`, and `skills/` are always preserved. 3. The script will back up your `config.yaml` and `data/`, upgrade the code from GitHub Release, update `config.yaml`'s `version`, then restart the server. Recommended one-liner: `chmod +x upgrade.sh && ./upgrade.sh --yes` If something goes wrong, you can restore from `.upgrade-backup/` (or manually copy `/data` and `config.yaml` back) and run `./run.sh` again. Requirements / tips: * You need `curl` or `wget` for downloading Release packages. * `rsync` is recommended/required for the safe code sync. * If GitHub API rate-limits you, set `export GITHUB_TOKEN="..."` before running `./upgrade.sh`. ⚠️ **Note:** This procedure only applies to version updates without compatibility or breaking changes. If a release includes compatibility changes, this method may not apply. **Examples:** No breaking changes β€” e.g. v1.3.1 β†’ v1.3.2; with breaking changes β€” e.g. v1.3.1 β†’ v1.4.0. The project follows [Semantic Versioning](https://semver.org/) (SemVer): when only the patch version (third number) changes, this upgrade path is usually safe; when the minor or major version changes, config, data, or APIs may have changed β€” check the release notes before using this method. ### Core Workflows - **Conversation testing** – Natural-language prompts trigger toolchains with streaming SSE output. - **Single vs multi-agent** – Chat UI switches between **Eino single-agent** (`/api/eino-agent/stream`) and **multi-agent** (`/api/multi-agent/stream` with `orchestration`: `deep` | `plan_execute` | `supervisor`). Multi mode requires `multi_agent.enabled: true`. MCP tools are bridged the same way for both paths. - **Role-based testing** – Select from predefined security testing roles (Penetration Testing, CTF, Web App Scanning, API Security Testing, etc.) to customize AI behavior and tool availability. Each role applies custom system prompts and can restrict available tools for focused testing scenarios. - **Tool monitor** – Inspect running jobs, execution logs, and large-result attachments. - **History & audit** – Every conversation and tool invocation is stored in SQLite with replay. - **Conversation groups** – Organize conversations into groups, pin important groups, rename or delete groups via context menu. - **Vulnerability management** – Create, update, and track vulnerabilities discovered during testing. Filter by severity (critical/high/medium/low/info), status (open/confirmed/fixed/false_positive), and conversation. View statistics and export findings. - **Batch task management** – Create task queues with multiple tasks, add or edit tasks before execution, and run them sequentially. Each task executes as a separate conversation, with status tracking (pending/running/completed/failed/cancelled) and full execution history. - **WebShell management** – Add and manage WebShell connections (PHP/ASP/ASPX/JSP or custom). Use the virtual terminal to run commands, the file manager to list, read, edit, upload, and delete files, and the AI assistant tab to drive scripted tests with per-connection conversation history. Connections are stored in SQLite; supports GET/POST and configurable command parameter (e.g. IceSword/AntSword style). - **Built-in C2** – Create/start **listeners**, generate **payloads**, track **sessions**, enqueue **tasks**, and subscribe to **events** (SSE) from the Web UI or `/api/c2/*`. Agents and external clients use the C2 MCP tool family (including **`c2_task`**); when HITL is enabled, high-risk tasks can require human approval. Intended **only** for systems you are explicitly authorized to test. - **Settings** – Tweak provider keys, MCP enablement, tool toggles, and agent iteration limits. - **Human-in-the-loop (HITL)** – Sidebar sets mode and allowlisted tools (comma- or newline-separated); global list lives in `config.yaml` under `hitl.tool_whitelist`. **Apply** updates browser/server and can merge new tools into the file (**no restart**). **New chat** keeps sidebar choices; **HITL** nav shows pending approvals. Removing a tool in the sidebar does not remove it from the global list in `config.yaml`β€”edit the file if needed. ### Built-in Safeguards - Required-field validation prevents accidental blank API credentials. - Auto-generated strong passwords when `auth.password` is empty. - Unified auth middleware for every web/API call (Bearer token flow). - Timeout and sandbox guards per tool, plus structured logging for triage. ## Advanced Usage ### Role-Based Testing - **Predefined roles** – System includes 12+ predefined security testing roles (Penetration Testing, CTF, Web App Scanning, API Security Testing, Binary Analysis, Cloud Security Audit, etc.) in the `roles/` directory. - **Custom prompts** – Each role can define a `user_prompt` that prepends to user messages, guiding the AI to adopt specialized testing methodologies and focus areas. - **Tool restrictions** – Roles can specify a `tools` list to limit available tools, ensuring focused testing workflows (e.g., CTF role restricts to CTF-specific utilities). - **Skills** – Skill packs live under `skills_dir` and load via the Eino ADK **`skill`** tool (**progressive disclosure**) in both **single- and multi-agent** sessions when **`multi_agent.eino_skills`** is … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source β€” we do not rehost the code. - **Author:** [Ed1s0nZ](https://github.com/Ed1s0nZ) - **Source:** [Ed1s0nZ/CyberStrikeAI](https://github.com/Ed1s0nZ/CyberStrikeAI) - **License:** Apache-2.0 Install and usage instructions live in the source repository linked above. ## Pricing - **Free** β€” Free ## Security capabilities Automated source analysis of v0.1.0 β€” what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source β€” more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** β€” security scan: passed β€” Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-ed1s0nz-cyberstrikeai - Seller: https://agentstack.voostack.com/s/ed1s0nz - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack β€” the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.