@cyberstrike-io/cyberstrike

The first open-source AI agent built for offensive security.

Automated penetration testing from your terminal — plug in your Claude, GPT, or any LLM subscription
and turn it into an autonomous red team agent with 7,300+ security skills across MITRE ATT&CK, CIS, OWASP, and NIST.

Quick Start • Intelligence Layer • What Makes It Different • Agents • Web UI • Bolt • MCP Ecosystem • Installation • Docs • Website

Quick Start

npm i -g @cyberstrike-io/cyberstrike@latest && cyberstrike

That's it. CyberStrike launches a TUI in your terminal, asks for your LLM provider and API key on first run, and you're ready to go. Tell it what to test — it loads relevant skills from 7,300+ MITRE ATT&CK, CIS, OWASP, and NIST test procedures, then handles reconnaissance, vulnerability discovery, exploitation, and reporting autonomously.

Already have a Claude Code or OpenAI subscription? CyberStrike's intelligence layer sits on top of your existing AI subscription. No separate API costs — your current plan powers an entire pentest toolkit.

Explore the full documentation at docs.cyberstrike.io or visit cyberstrike.io for demos and guides.

Intelligence Layer

CyberStrike isn't just a wrapper around an LLM. It's an intelligence layer that transforms any AI model into an offensive security specialist.

How it works: When you connect your LLM provider, CyberStrike injects domain-specific context — OWASP testing methodology, vulnerability patterns, attack chain reasoning, and tool orchestration logic — into every interaction. The model doesn't need to know security; CyberStrike teaches it.

What the intelligence layer provides:

• Schema normalization — Structured output from any provider, regardless of response format differences
• Context guard — Prevents prompt leakage and keeps the agent focused on the current test phase
• Provider auto-detection — Automatically identifies your LLM endpoint and configures the optimal transport
• Tool orchestration — Chains security tools intelligently based on findings, not fixed scripts

15+ LLM providers supported out of the box:

Air-gapped environments? Run CyberStrike entirely offline with Ollama or LM Studio. No data leaves your machine — ever.

Skills System — 7,300+ Actionable Security Tests

CyberStrike doesn't just give agents generic security knowledge — it loads domain-specific skills on-demand with zero context pollution.

What's a skill? A skill is a structured test procedure that includes:

• Target methodology (OWASP WSTG, MITRE ATT&CK, CIS Benchmark, NIST)
• Copy-paste ready test commands
• Tool references and dependencies
• Remediation guidance
• CWE mappings and severity ratings

Coverage:

Lazy Loading — Skills load only when needed. An agent testing for Kerberoasting pulls T1558.003 skill (7 Atomic tests) into context, runs the tests, then discards it. Next test = new skill. Zero bloat.

Search & Discovery — Built-in skill search with relevance scoring. Query by keyword, tech stack, CWE ID, or category. 7,633 skills indexed in-memory.

# Example: Agent loads T1558.003 Kerberoasting skill
Skill: T1558.003 - Kerberoasting
Tests: 7 Atomic Red Team test scenarios
Tools: Invoke-Kerberoast.ps1, Rubeus, setspn
Platforms: Windows

Read more: MITRE ATT&CK Integration, CIS Benchmarks

What Makes It Different

Agents

Switch between agents with Tab. Each one is a domain specialist.

Plus 8 specialized proxy testers that intercept and manipulate traffic for targeted vulnerability classes:

IDOR · Authorization Bypass · Mass Assignment · Injection · Authentication · Business Logic · SSRF · File Attacks

Each proxy tester follows a structured methodology: intercept traffic, identify patterns, generate test cases, execute attacks, and report findings with evidence.

Web UI & Remote Access

Run cyberstrike web and control your agents, MCP servers, Bolt connections, and vulnerability findings from any browser. Access from anywhere with Cloudflare Tunnel — zero open ports, end-to-end encryption, password-protected API. Your data stays on your machine.

export CYBERSTRIKE_SERVER_PASSWORD=your-secure-password
cyberstrike web

Use app.cyberstrike.io (static page, no backend) or self-host from packages/app/dist/.

See the full README for the complete security model.

Bolt — Remote Tool Execution

Bolt is CyberStrike's remote tool server. Deploy it on any VPS, cloud instance, or Docker container — then control it from your local terminal over MCP protocol with Ed25519 authentication.

One CyberStrike, many Bolt servers:

                                          ┌─────────────────────┐
                                     ┌───►│  Bolt Server #1     │
                                     │    │  nmap, nuclei, ffuf  │
┌──────────────────┐   MCP + Ed25519 │    └─────────────────────┘
│  Your Terminal   │   over HTTPS    │    ┌─────────────────────┐
│  CyberStrike TUI │ ◄─────────────►├───►│  Bolt Server #2     │
│                  │   Tool Results   │    │  sqlmap, burp, zap   │
└──────────────────┘                 │    └─────────────────────┘
                                     │    ┌─────────────────────┐
                                     └───►│  Bolt Server #3     │
                                          │  Custom toolkit      │
                                          └─────────────────────┘

• Deploy anywhere — VPS, Docker, Kubernetes, or bare metal with pre-built Kali images
• Ed25519 key pairing — No passwords, no shared secrets, no attack surface
• Real-time streaming — Results flow back to your TUI as they happen
• Manage from TUI — Add, remove, and monitor Bolt servers without leaving CyberStrike
• Scale horizontally — Run heavy scans from servers with better bandwidth while you work locally

MCP Ecosystem

CyberStrike connects to specialized MCP servers that extend its capabilities — 176+ security tools across 5 domains:

All open source. All installable with npx. Plug them into CyberStrike or use them standalone with any MCP-compatible client.

Built-in Tools

CyberStrike agents have direct access to 30+ tools without any external dependencies:

Plus a plugin SDK — build your own agents and tools, register them at runtime.

Installation

# npm (recommended)
npm i -g @cyberstrike-io/cyberstrike@latest

# bun / pnpm / yarn
bun add -g @cyberstrike-io/cyberstrike@latest

# macOS (Homebrew)
brew install CyberStrikeus/tap/cyberstrike

# Windows (Scoop)
scoop install cyberstrike

# Linux / macOS (curl)
curl -fsSL https://cyberstrike.io/install.sh | bash

Who Is This For?

• Pentesters — Automate the repetitive parts. Let agents handle recon and initial testing while you focus on the creative attack chains that need human intuition.
• Bug Bounty Hunters — Faster reconnaissance, wider coverage, consistent methodology across programs. CyberStrike doesn't get tired at 3am.
• Security Teams — Run structured OWASP assessments with reproducible methodology. Get reports that map to standards your compliance team understands.
• Security Researchers — Extend CyberStrike with custom agents and MCP servers. The plugin system and MCP protocol make it a platform, not just a tool.

Contributing

CyberStrike is built by the security community, for the security community. We welcome contributions across:

• Security agents and skills — New attack methodologies, testing patterns, vulnerability detection
• MCP servers — Connect new security tools and data sources
• Knowledge base — WSTG, MASTG, PTES, CIS methodology guides
• Core improvements — Performance, UX, provider integrations, bug fixes

Read the Contributing Guide before submitting a PR. All contributions must follow the project's ethical use policy — CyberStrike is for authorized security testing only.

License

AGPL-3.0-only — Free for personal and open-source use. Commercial licensing available via [email protected].

MCP Security Suite

CyberStrike is the core platform. These MCP servers extend its capabilities:

cyberstrike.io · Docs · Discord · X.com · GitHub

_{Built by hackers who got tired of copy-pasting between terminals.}