CyberStrikeus/CyberStrike

English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português (Brasil) | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी

Automated penetration testing from your terminal — plug in your Claude, GPT, or any LLM subscription
and turn it into an autonomous red team agent with 13+ specialized agents, 7,600+ security skills, and 120+ OWASP test cases.
150+ AI providers • 5,300+ models • 56+ built-in tools • 176+ MCP tools

Quick Start • Intelligence Layer • What Makes It Different • Agents • Skills • Web UI • Bolt • MCP Ecosystem • Post-Exploitation • Installation • Docs • Website

npm i -g @cyberstrike-io/cyberstrike@latest && cyberstrike

That's it. CyberStrike launches a TUI in your terminal, asks for your LLM provider and API key on first run, and you're ready to go. Tell it what to test — it handles reconnaissance, vulnerability discovery, exploitation, and reporting autonomously.

Already have a Claude Code or OpenAI subscription? CyberStrike's intelligence layer sits on top of your existing AI subscription. No separate API costs — your current plan powers an entire pentest toolkit.

Explore the full documentation at docs.cyberstrike.io or visit cyberstrike.io for demos and guides.

CyberStrike isn't just a wrapper around an LLM. It's an intelligence layer that transforms any AI model into an offensive security specialist.

How it works: When you connect your LLM provider, CyberStrike injects domain-specific context — OWASP testing methodology, vulnerability patterns, attack chain reasoning, and tool orchestration logic — into every interaction. The model doesn't need to know security; CyberStrike teaches it.

What the intelligence layer provides:

• Schema normalization — Structured output from any provider, regardless of response format differences
• Context guard — Prevents prompt leakage and keeps the agent focused on the current test phase
• Provider auto-detection — Automatically identifies your LLM endpoint and configures the optimal transport
• Tool orchestration — Chains security tools intelligently based on findings, not fixed scripts

150+ AI providers and 5,300+ models supported out of the box:

CyberStrike integrates with the entire AI ecosystem through 23 bundled SDK providers and 150+ providers via the models.dev catalog. Here are the core integrations:

Air-gapped environments? Run CyberStrike entirely offline with Ollama or LM Studio. No data leaves your machine — ever.

Switch between agents with Tab. Each one is a domain specialist.

Plus 8 specialized proxy testers that run automatically on intercepted traffic:

Each tester uses a 3-gate confirmation protocol: execute a baseline request, execute the attack, compare responses. A finding is only reported when there is a measurable, reproducible difference — not on speculation. Duplicate findings (same endpoint + attack vector) are automatically suppressed across the session.

CyberStrike ships with 7,600+ security skill files — structured, Ed25519-signed methodology documents that give agents deep domain knowledge at runtime. Skills are lazy-loaded (one at a time, on demand) and statically injected into agent prompts.

Skill categories:

Each skill includes testing procedures, payloads, tool commands, and CWE mappings. Skills are tagged with OWASP WSTG IDs, CIS control IDs, and chain relationships — so agents know which skills to combine for multi-step attack chains.

Full documentation: docs.cyberstrike.io/docs/tools/hacker-browser

HackBrowser is CyberStrike's built-in Chromium browser. Start it from the TUI with /hackbrowser. As you browse, every HTTP request is captured and routed through the proxy-agent pipeline — no manual export, no Burp project files.

Two capture modes:

• Manual — Browse the target yourself. Log in as different users, navigate features, trigger actions. HackBrowser captures the real API traffic behind every click.
• Autonomous — Provide credentials for multiple accounts, set a scope, and let HackBrowser crawl automatically. It logs in as each user, maps reachable pages, and captures the traffic difference between roles.

Role & credential discovery:

As you browse with multiple accounts, CyberStrike builds a session context — a live map of discovered credentials, inferred role hierarchy, and which endpoints each role can reach. The 8 proxy sub-testers use this context directly: they know which token to use for a high-privilege baseline and which lower-privilege credentials to test with, without any manual setup.

Browser traffic → Proxy intercept → Orchestrator → 8 sub-testers (parallel)
                                          ↓
                               Session context (credentials, roles,
                               endpoints, functions) shared across all testers

Scope control:

Use --scope to limit testing to specific domains. CyberStrike automatically derives the registered domain (e.g. --scope api.example.com covers api.example.com but not other.com). Pass multiple --scope flags for multi-domain targets.

CyberStrike includes a full web interface. Run cyberstrike web and control your agents, MCP servers, Bolt connections, and vulnerability findings from any browser.

Access from anywhere with Cloudflare Tunnel:

Browser ──HTTPS──▶ Cloudflare Tunnel ──encrypted──▶ cloudflared (localhost) ──▶ CyberStrike Server

export CYBERSTRIKE_SERVER_PASSWORD=your-secure-password
cyberstrike web
# In another terminal:
cloudflared tunnel --url http://localhost:4096 run your-tunnel

Why this is secure:

• Zero open ports — CyberStrike binds to localhost:4096. cloudflared makes an outbound-only connection to Cloudflare's edge. No firewall rules, no port forwarding needed.
• End-to-end encryption — Browser to Cloudflare edge is TLS. Cloudflare edge to your machine is an encrypted tunnel. No plaintext leaves your network.
• Password-protected API — Every API request requires Basic Auth. Local requests on localhost bypass auth for convenience; remote requests via CF tunnel always require credentials (detects X-Forwarded-For / CF-Connecting-IP).
• Your data stays local — LLM inference runs on your hardware. CyberStrike processes everything locally. The tunnel is just a secure pipe.

What's in the Web UI:

app.cyberstrike.io is a hosted static page (no backend, no data storage) for convenience. Or self-host: clone the repo and serve packages/app/dist/ from your own domain.

Bolt is CyberStrike's remote tool server. Deploy it on any VPS, cloud instance, or Docker container — then control it from your local terminal over MCP protocol with Ed25519 authentication.

One CyberStrike, many Bolt servers:

                                          ┌─────────────────────┐
                                     ┌───►│  Bolt Server #1     │
                                     │    │  nmap, nuclei, ffuf  │
┌──────────────────┐   MCP + Ed25519 │    └─────────────────────┘
│  Your Terminal   │   over HTTPS    │    ┌─────────────────────┐
│  CyberStrike TUI │ ◄─────────────►├───►│  Bolt Server #2     │
│                  │   Tool Results   │    │  sqlmap, burp, zap   │
└──────────────────┘                 │    └─────────────────────┘
                                     │    ┌─────────────────────┐
                                     └───►│  Bolt Server #3     │
                                          │  Custom toolkit      │
                                          └─────────────────────┘

• Deploy anywhere — VPS, Docker, Kubernetes, or bare metal with pre-built Kali images
• Ed25519 key pairing — No passwords, no shared secrets, no attack surface
• Real-time streaming — Results flow back to your TUI as they happen
• Manage from TUI — Add, remove, and monitor Bolt servers without leaving CyberStrike
• Scale horizontally — Run heavy scans from servers with better bandwidth while you work locally

CyberStrike connects to specialized MCP servers that extend its capabilities — 176+ security tools across 5 domains:

All open source. All installable with npx. Plug them into CyberStrike or use them standalone with any MCP-compatible client.

CyberStrike agents have direct access to 56+ tools without any external dependencies:

Plus a plugin SDK with 15+ hook types (tool interception, message transformation, permission prompts, shell environment) — build your own agents and tools, register them at runtime.

CyberStrike includes built-in post-exploitation capabilities across multiple platforms — no external tools required.

All post-exploitation tools are agent-driven — they execute based on context and findings, not as fixed scripts.

# npm (recommended)
npm i -g @cyberstrike-io/cyberstrike@latest

# bun / pnpm / yarn
bun add -g @cyberstrike-io/cyberstrike@latest

# macOS (Homebrew)
brew install CyberStrikeus/tap/cyberstrike

# Windows (Scoop)
scoop install cyberstrike

# Linux / macOS (curl)
curl -fsSL https://cyberstrike.io/install.sh | bash

• Pentesters — Automate the repetitive parts. Let agents handle recon and initial testing while you focus on the creative attack chains that need human intuition.
• Bug Bounty Hunters — Faster reconnaissance, wider coverage, consistent methodology across programs. CyberStrike doesn't get tired at 3am.
• Security Teams — Run structured OWASP assessments with reproducible methodology. Get reports that map to standards your compliance team understands.
• Security Researchers — Extend CyberStrike with custom agents and MCP servers. The plugin system and MCP protocol make it a platform, not just a tool.

CyberStrike is built by the security community, for the security community. We welcome contributions across:

• Security agents and skills — New attack methodologies, testing patterns, vulnerability detection
• MCP servers — Connect new security tools and data sources
• Knowledge base — WSTG, MASTG, PTES, CIS methodology guides
• Core improvements — Performance, UX, provider integrations, bug fixes

Read the Contributing Guide before submitting a PR. All contributions must follow the project's ethical use policy — CyberStrike is for authorized security testing only.

AGPL-3.0-only — Free for personal and open-source use. Commercial licensing available via contact@cyberstrike.io.

CyberStrike is the core platform. These MCP servers extend its capabilities:

cyberstrike.io · Docs · Discord · X.com · GitHub

_{Built by hackers who got tired of copy-pasting between terminals.}