AIPentest/CyberStrikeAI

What CyberStrikeAI Is

CyberStrikeAI is an AI‑driven cybersecurity platform written in Go. It lets you describe what you want to test (e.g., “scan this host for open ports”) in natural language, and an internal “agent” turns that intent into a series of audited security actions. The system bundles a web UI, a large collection of pre‑configured security tools, a knowledge base, and optional plugins (Burp Suite, browser extension) into a single, auditable workspace.

Core Concepts

Concept	What It Does
Agentic execution	Converts plain‑language requests into governed tool calls. Supports single‑agent mode and multi‑agent orchestration (deep, plan‑execute, supervisor).
Eino orchestration	The built‑in workflow engine that strings agents, tools, conditions, approvals, and outputs together.
MCP integration	A generic “tool call protocol” (HTTP, stdio, SSE, federation) that lets the platform talk to external tools or services.
Knowledge base	Vector‑based retrieval with query rewriting, reranking and post‑processing, plus a separate vision model for image‑based analysis.
Governance	Human‑in‑the‑loop approvals, RBAC, audit logs, call‑blocking regexes, and result caps to keep actions traceable and safe.
Attack‑chain modeling	Projects can link assets, vulnerabilities, and tool results into a graph that can be replayed step‑by‑step.
C2 / WebShell	Built‑in command‑and‑control listeners and a managed web‑shell UI for authorized post‑exploitation work.

Main Features

• 100+ curated security tools (nmap, sqlmap, nuclei, subfinder, Metasploit, etc.) defined as YAML recipes.
• Visual workflow editor to build reusable attack chains.
• Role‑based testing with predefined security personas (e.g., “external pentester”, “cloud auditor”).
• Multi‑channel AI support – configure OpenAI, DeepSeek, Qwen, etc., with model, token limits, and endpoint.
• Human‑in‑the‑loop approvals and tool‑allowlist policies for high‑risk actions (WebShell, C2).
• RBAC for multiple users, custom roles, and ownership of assets/projects.
• Audit‑ready: SQLite persistence, immutable execution logs, and evidence retention.
• Plugins: Burp Suite extension and a browser extension that feed captured traffic into the AI engine.
• Chatbot connectors for WeChat, Slack, Discord, etc., enabling remote interaction.

Who Might Use It

• Red‑team / pentest teams that want a single UI to orchestrate scans, exploit tools, and post‑exploitation steps while keeping a reproducible audit trail.
• Blue‑team analysts looking to replay attack chains, enrich findings with AI‑generated summaries, and manage assets/vulnerabilities.
• Security researchers who need a programmable, AI‑augmented environment for building and sharing playbooks.

Getting Started (One‑Command Deploy)

1. Install Go 1.25+ and Python 3.10+.
2. Clone the repo and run the provided run.sh script:

   git clone https://github.com/Ed1s0nZ/CyberStrikeAI.git
   cd CyberStrikeAI
   chmod +x run.sh && ./run.sh
   

   The script sets up a Python virtual‑env, installs dependencies, builds the Go binary, and starts the server.
3. Open the displayed URL (default https://127.0.0.1:8080/), accept the self‑signed cert, and log in with the auto‑generated admin password.
4. Configure an AI channel (e.g., OpenAI GPT‑4o) under System Settings → AI Channel Configuration.
5. Install any external tools you need (Homebrew on macOS, apt on Linux, or go install for Go‑based tools).

Extending / Contributing

• Add new tools by dropping a YAML recipe into tools/.
• Create roles or skills in roles/ and skills/ to tailor prompts and tool policies.
• Write multi‑agent orchestrations as Markdown files under agents/.
• Follow the developer guide in docs/en-US/developer-guide.md for building, testing, and submitting pull requests.

Safety Notice

The platform includes powerful capabilities (WebShell, C2, automated exploitation). It is intended only for systems you own or have explicit permission to test. Review the security model and hardening guide before enabling high‑risk features.

---

TL;DR – CyberStrikeAI is a Go‑based, AI‑augmented security orchestration platform that turns natural‑language commands into audited, multi‑tool penetration‑testing workflows, with built‑in governance, a knowledge base, and optional Burp/Browser plugins.