CyberStrike — Open-Source AI Penetration Testing & Red Team Platform
Turn your AI subscription into an autonomous red team agent that performs reconnaissance, vulnerability discovery, exploitation, and reporting.
Evidence shows a permission system exists but is not a sandbox, user confirmation mechanism exists (SECURITY.md), but data flow transparency and sensitive data handling are only partially mentioned, dependency security has CodeQL but no vulnerability scanning evidence, external effects (Bolt remote execution) have authentication but risks not fully mitigated, rollback mechanism absent, source attribution only via license and repo metadata.
Self-consistency is good, tests cover ACP interface and event subscription, but dependency availability unverified, failure messages not well demonstrated.
Audience clear (pentesters etc.), scenarios diverse, but capability boundaries (e.g., permission scope) not clearly defined, trigger precision (e.g., command execution) relies on user confirmation, environment fit (local/remote) documented.
Information architecture clear (multi-language README), install notes detailed, naming stable (cyberstrike), examples and FAQ present, known limitations partially mentioned (no sandbox), license clear (AGPL-3.0), version changelog exists but not detailed, maintenance responsibility unclear.
Output usability (report format) not detailed, marginal value high (automated pentesting), cost-benefit not quantified.
Claim traceability partial (README claims features), cross-source corroboration insufficient, fact-inference separation unclear.
- This is an offensive security tool that could be misused; ensure it is only used for authorized testing.
- The permission system is not a sandbox and does not provide security isolation; run in isolated environments.
- Bolt remote execution poses risks; ensure server security.
What does this agent do, and when should you use it?
CyberStrike is an open-source AI-augmented offensive security harness that provides 13+ specialized agents, 7,600+ Ed25519-signed security skills, 56+ built-in tools, and 176+ MCP tools. It transforms any LLM into a security expert through its intelligence layer, supporting 150+ AI providers and 5,300+ models. The tool aligns with MITRE ATT&CK, OWASP WSTG, and CIS benchmarks, covering web, mobile, cloud, internal network, and post-exploitation scenarios. It offers a TUI, a web UI with Cloudflare Tunnel remote access, and Bolt remote tool execution. Installation is straightforward via npm.
CyberStrike launches a TUI in the terminal, guiding users to configure an LLM provider and API key. It performs reconnaissance, vulnerability discovery, exploitation, and reporting autonomously. It includes HackBrowser, a built-in Chromium browser that captures HTTP requests and routes them through a proxy-agent pipeline. It uses 8 proxy sub-testers to detect IDOR, authorization bypass, mass assignment, injection, authentication, business logic, SSRF, and file attacks, each with a 3-gate confirmation protocol to ensure reproducible differences. It integrates 176+ MCP tools for cloud auditing, GitHub security, CVE intelligence, and OSINT. It supports post-exploitation across macOS, Windows, Linux/eBPF, AWS, Azure, Kubernetes, and CI/CD. All operations are executed locally via the TUI and web UI.
- Pentesters: Automate repetitive reconnaissance and initial testing, focusing on creative attack chains needing human intuition.
- Bug bounty hunters: Achieve faster, broader coverage and consistent methodology across programs.
- Security teams: Run structured OWASP assessments with reproducible methodology and compliance-aligned reports.
- Security researchers: Extend with custom agents and tools via the plugin SDK and MCP protocol.
- Cloud security engineers: Use cloud-audit-mcp for AWS, Azure, and GCP audits.
- Air-gapped environments: Run fully offline with Ollama or LM Studio, ensuring data never leaves the machine.
What are this agent's strengths and limitations?
- 150+ AI providers and 5,300+ models supported, avoiding lock-in
- Built-in HackBrowser and proxy testers automatically capture and analyze traffic
- 13+ specialized agents and 7,600+ skills covering multiple security domains
- MCP ecosystem extends capabilities with 176+ tools
- Bolt remote execution and Cloudflare Tunnel enable distributed attacks
- Built-in post-exploitation modules for macOS, Windows, Linux, cloud, and CI/CD
- Requires a valid LLM API key or subscription, adding cost
- Depends on external MCP servers and tools, requiring network access
- Installation and configuration have a learning curve
- Some features like Cloudflare Tunnel need additional setup
- False positives/negatives may require manual verification
- Commercial use requires contacting for licensing
How do you install or deploy this agent?
Install globally via npm: npm i -g @cyberstrike-io/cyberstrike@latest. Alternative installers: bun add -g @cyberstrike-io/cyberstrike@latest, Homebrew (brew install CyberStrikeus/tap/cyberstrike), Scoop (scoop install cyberstrike), or curl -fsSL https://cyberstrike.io/install.sh | bash.
How do you use this agent?
After installation, run cyberstrike in the terminal. On first run it will ask for your LLM provider and API key. Use the TUI to interact with agents and tools. For web access, run cyberstrike web and optionally set up a Cloudflare Tunnel. Set environment variable CYBERSTRIKE_SERVER_PASSWORD for remote access security.