CyberStrikeus/CyberStrike

Open-source AI-powered offensive security harness for automated penetration testing.

CyberStrike – Open‑source AI‑powered offensive‑security agent

What it is – CyberStrike is a terminal‑based AI agent that turns any LLM (Claude, GPT, Gemini, etc.) into an autonomous red‑team tool. It ships with a knowledge‑rich “intelligence layer” that injects security methodology, normalises model output, and orchestrates real security tools. The result is a self‑contained pentesting suite that can run from a single cyberstrike command.

Core concepts

Concept What you get
Intelligence layer Adds OWASP, MITRE ATT&CK, CIS, and other security context to any LLM, normalises responses, guards prompt leakage, and auto‑detects the provider.
Specialised agents 13+ built‑in agents (web‑app, mobile, cloud, internal‑network, etc.) each with its own methodology and toolset.
Security skills >7,600 signed “skill files” (attack patterns, payloads, CWE mappings) that are lazily loaded into prompts.
Bolt remote execution Deploy lightweight Bolt servers on remote hosts; CyberStrike streams tool results (nmap, nuclei, sqlmap, …) back to your TUI.
MCP ecosystem 176+ additional security tools are available via plug‑in MCP servers (cloud‑audit, etc.).
Web UI & Cloudflare Tunnel Optional browser UI for chat, vulnerability view, Bolt monitoring, and MCP status – reachable securely through an outbound‑only Cloudflare tunnel.
Model agnostic Supports 150+ AI providers and >5,300 models (Anthropic, OpenAI, Gemini, Bedrock, Groq, Ollama, LM Studio, etc.). Offline use is possible with local models.

Quick start (from the README)

npm i -g @cyberstrike-io/cyberstrike@latest && cyberstrike
  • The first run asks for your LLM provider and API key.
  • After that you can type a natural‑language request (e.g., “test the login page”) and the agent will handle reconnaissance, vulnerability discovery, exploitation, and reporting automatically.

Main features (as described in the README)

  • 13+ domain‑specific agents (web, mobile, cloud, network, plus 8 proxy‑based sub‑testers such as IDOR, SSRF, injection, etc.)
  • 7,600+ security skill files – Ed25519‑signed, lazily loaded, with CWE/OWASP tags.
  • 150+ AI providers / 5,300 models – plug‑and‑play, no lock‑in; works offline with Ollama/LM Studio.
  • Bolt remote tool execution – run heavy scanners on any remote machine, authenticated with Ed25519 keys.
  • MCP ecosystem – 176+ extra tools across cloud, container, and host security.
  • Web UI – chat, vulnerability dashboard, Bolt & MCP monitoring, accessible via a secure Cloudflare tunnel.
  • HackBrowser – built‑in Chromium that captures traffic and feeds it to the proxy‑tester pipeline, with manual or autonomous crawling modes.
  • 3‑gate confirmation for each finding (baseline request → attack → response comparison) to reduce false positives.

Typical workflow

  1. Configure LLM – supply API key for your chosen provider.
  2. Select an agent – Tab cycles between cyberstrike, web-application, mobile-application, etc.
  3. Issue a test command – e.g., run full scan on https://example.com.
  4. Agent orchestrates – uses the intelligence layer to generate recon steps, runs tools locally or via Bolt, validates findings with the 3‑gate protocol.
  5. Review results – in the TUI, the web UI, or exported reports.

Installation & requirements

Requirement Details
Node.js The package is distributed via npm (@cyberstrike-io/cyberstrike).
LLM access Any provider supported by the bundled SDKs or by the models.dev catalog.
Optional remote tools Docker/Kali images for Bolt servers, or any machine with the needed security tools installed.
Optional web UI cloudflared for tunnelling if you want remote browser access.

Who might use it?

  • Red‑team engineers who want a quick, AI‑augmented pentest harness without writing custom scripts.
  • Security consultants looking to run repeatable, methodology‑driven assessments across many targets.
  • DevSecOps teams that want to integrate an LLM‑driven scanner into CI pipelines (via the CLI or Bolt).
  • Researchers experimenting with LLM‑guided attack generation.

Limitations & cautions (from the README)

  • The agent relies on the underlying LLM’s reasoning; quality varies by model.
  • Remote execution (Bolt) requires you to expose security tools on other hosts – you must secure those endpoints yourself.
  • While the 3‑gate confirmation reduces false positives, the tool can still produce noisy results on complex applications.
  • Using the agent against systems you do not have permission to test is illegal and against the project’s intended use.

Links & resources

Bottom line

CyberStrike is a genuine, open‑source AI agent that layers security knowledge on top of any LLM and couples it with real penetration‑testing tools. It aims to make autonomous, methodology‑driven red‑team operations accessible from a single terminal command while remaining provider‑agnostic and extensible via remote Bolt servers and MCP plug‑ins.

Related

  • Project
    Ed1s0nZ/CyberStrikeAI

    CyberStrikeAI is an open‑source Go platform that lets security teams drive penetration‑testing workflows with natural‑language prompts. An Eino‑based agent interprets intent, runs a curated set of 100+ security tools, records evidence, and stores the whole attack chain for replay. The system includes a web UI, role‑based access control, RAG knowledge base, optional C2/WebShell, and plugins for Burp Suite and browsers. One‑click deployment (`run.sh`) builds the server, creates a Python virtual environment, and starts an HTTPS service. It is licensed under Apache 2.0 and intended for authorized, ethical testing only.

  • Project
    0x4m4/hexstrike-ai

    An AI-powered cybersecurity automation platform that integrates 150+ security tools into an MCP framework for autonomous penetration testing.

  • Project
    chenhg5/cc-connect

    cc‑connect is an open‑source bridge that lets you run AI agents (Kimi, Claude, Copilot CLI, etc.) on your own machine and control them from chat apps like Slack, Discord, Telegram, Feishu, QQ, and more. It forwards messages to the local agent, returns the agent’s response, and supports many platforms and agents out‑of‑the‑box.

  • Project
    OTT-Cybersecurity-LLC/lyrie-ai

    An autonomous security agent that performs automated penetration testing, LLM red-teaming, and provides a cryptographic identity standard for AI agents via the Agent Trust Protocol.

  • Project
    AISBench/benchmark

    A model evaluation tool based on OpenCompass that provides accuracy and performance benchmarking for both local and service-based AI models across text and multimodal tasks.