AIPentest/CyberStrikeAI

The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next.

CyberStrikeAI – AI‑native Penetration‑Testing Platform

What it is

  • An open‑source security‑testing suite written in Go that lets you drive classic pentesting tools (nmap, sqlmap, nuclei, etc.) through natural‑language commands.
  • The core idea is agentic execution: you describe what you want (e.g., “scan 192.168.1.1 for open ports”) and an LLM‑powered Eino orchestrator turns that intent into a reproducible, auditable workflow.
  • All actions, evidence, and results are stored in a SQLite‑backed workspace so you can replay or review an engagement later.

Key components

Component Role
Agents & Orchestration Translates NL intent into tool calls; supports single‑agent, plan‑execute, and multi‑agent supervisor modes.
MCP (Multi‑Channel Protocol) Integration Uniform interface for HTTP, stdio, SSE, and external tool federation; handles retries, circuit‑breaking, and result caps.
Knowledge Base Vector‑store + reranking for fast retrieval of past findings, CVE data, or custom docs.
Governance Human‑in‑the‑loop approvals, RBAC, call‑blocking regexes, audit logs, and evidence retention.
Web UI Dashboard, task/asset/vulnerability managers, role‑based testing presets, and chat‑bots for Slack/Discord/WeChat, etc.
C2 / WebShell Optional high‑risk capabilities (listeners, encrypted beacons, file ops) for authorized red‑team work.
Plugins Burp Suite extension and a browser extension that feed captured traffic into the AI workflow.

How you use it

  1. Deploy – One‑liner git clone … && ./run.sh sets up Go, a Python venv, installs dependencies, builds the server, and starts it (HTTPS by default).
  2. Configure an AI channel – Add your LLM provider (OpenAI, DeepSeek, Qwen, etc.) in the UI or config.yaml (model, API key, token limits).
  3. Create a project / conversation – Type natural‑language tasks or select a predefined role (e.g., “Web App Pentester”). The agent builds a graph workflow, calls the appropriate tool recipes from tools/ (YAML definitions for 100+ utilities), and stores the output.
  4. Review & approve – High‑impact actions (e.g., C2 launch, file writes) can be gated behind manual approval or regex‑based blocking.
  5. Replay / export – Attack‑chain graphs, asset inventories, and vulnerability reports can be exported, filtered, or re‑executed.

What’s inside the repo

  • cmd/ – Server binary and MCP entry points.
  • internal/ – Core agent logic, MCP handling, C2 implementation, security executor.
  • web/ – SPA front‑end (HTML/JS) served by the Go server.
  • tools/ – Over 100 YAML‑described tool recipes (network scanners, web app scanners, cloud security, forensics, etc.).
  • roles/ – Pre‑written role configurations that tailor prompts and tool policies for common testing scenarios.
  • skills/ – Reusable “Skill” modules that agents can load on demand.
  • agents/ – Markdown orchestrations describing multi‑agent plans.
  • docs/ – Full documentation: deployment, configuration, security hardening, API reference, knowledge‑base usage, C2/WebShell guides, and contributor notes.

Typical workflow example

User: "Enumerate subdomains for example.com and run nuclei on the results."
→ Agent creates a graph: subfinder → dedup → nuclei → summarize.
→ Each step calls the corresponding tool via MCP; results are stored in the SQLite evidence store.
→ UI shows a live graph, allows the user to approve the nuclei scan, and finally presents a CVE‑ranked report.

Safety & Legal

  • The README stresses that the platform must only be used on systems you own or have explicit permission to test.
  • Built‑in call‑blocking, role‑based tool allowlists, and a hardening guide help prevent accidental misuse.
  • All actions are logged and can be audited, supporting responsible penetration‑testing practices.

Community & Support

  • Discord server, WeChat group, and optional sponsorship via WeChat/Alipay.
  • The project is part of the 404Starlink ecosystem and has been recognized in the TCH Intelligent Pentest competition.

License – Apache 2.0.

Bottom line: CyberStrikeAI is a genuine, AI‑driven pentesting framework that combines LLM orchestration with a large catalog of security tools, offering a web‑based, auditable environment for authorized security assessments.

Related

  • Project
    Gentleman-Programming/engram

    Engram is a single‑binary Go program that gives AI coding agents a persistent, searchable memory store (SQLite + FTS5). It works with any MCP‑compatible agent (Claude Code, Gemini CLI, VS Code Copilot, Cursor, etc.) via CLI, HTTP API, MCP, or a terminal UI. The tool is zero‑dependency, supports local‑first storage with optional cloud replication, and provides a rich set of memory commands (`mem_save`, `mem_search`, `mem_context`, `mem_session_summary`, …) to let agents remember decisions, bug fixes, and design rationales across sessions and teams.

  • Project
    flashlight/wav2letter

    wav2letter++ is an end-to-end automatic speech recognition framework that provides recipes and pre-trained models to implement state-of-the-art speech-to-text architectures.

  • Project
    akitaonrails/ai-memory

    ai‑memory is a Rust‑based server that records every observation a coding‑assistant makes (prompts, tool calls, session boundaries) as plain markdown files in a git‑backed wiki. The server can be run locally, in Docker/Podman, or on a homelab box and is designed to be shared across many agents (Claude Code, Codex, Cursor, Gemini CLI, etc.), machines and team members. Hooks posted by agents are consolidated into readable wiki pages at session end; the next session receives a concise handoff so it can continue exactly where the previous one stopped. Storage is human‑readable markdown plus a SQLite index (FTS5, entity and optional vector search). By default it needs no LLM or embedding keys; optional Anthropic/OpenAI integrations add LLM‑generated summaries and semantic search. Multi‑user authentication, audit logs and per‑person attribution are built in. Install via Arch AUR, Docker wrapper, or native binary, start the server, register a client and its hooks, and the system works transparently.

  • Project
    Gentleman-Programming/gentle-ai

    Gentle‑AI is a Go‑based configurator that enhances existing AI coding agents (Claude Code, Cursor, etc.) with persistent memory, skill libraries, planning (Spec‑Driven Development), security guardrails and optional evidence‑based review (Receipt‑Driven Development). It installs via a simple script, runs an interactive TUI to select agents and components, writes native config files, and provides a health‑check command. The tool does not ship its own model; it merely augments agents you already use.