CyberStrikeAI — AI-Native Cybersecurity Action System
Turn intent into governed security actions, make evidence operational memory, and let every operation improve the next.
- Source repo
- AIPentest/CyberStrikeAI
- Stars
- ★ 7.9k
- Last updated
- 3d ago
- License
- Apache-2.0
- Primary language
- Go
- FA score
- 44/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Security researchers run authorized port scans and vulnerability enumeration against target assets.
- Not a fit if
- Anyone without explicit written authorization for WebShell and C2 capabilities
- Users wanting zero-config setup; Go and Python environments must be prepared
- Source review
- 44/100 · Major gaps
What does this agent do, and when should you use it?
CyberStrikeAI is a Go-based AI cybersecurity platform that unifies planning, execution, human oversight, evidence, and replay in one auditable workspace. It combines Eino-powered agents, MCP-native tools, RAG knowledge, visual workflows, and attack-chain modeling for authorized security operations. The project ships with 100+ curated YAML tool recipes, role configurations, skills, and high-risk capabilities like WebShell and C2, along with a web console for task governance, vulnerability and asset management, RBAC permissions, and audit logs. Deployment is self-hosted with a one-command script, and it supports configurable AI providers.
CyberStrikeAI reads natural-language intent and translates it into governed, auditable security actions via Eino-orchestrated agents (supports single-agent, Deep, Plan-Execute, and Supervisor modes). It invokes the built-in 100+ security tools (e.g., nmap, sqlmap, nuclei), integrates external tools via MCP, and enhances analysis with RAG knowledge and vision models. Tool outputs (capped in size) are stored in SQLite for audit and replay. It provides a web console for managing tasks, vulnerabilities, assets, WebShell sessions, and C2 beacons, and includes Burp Suite and browser extensions. Deployment is via run.sh, which compiles the Go binary and starts an HTTPS server, with configurable AI channels (e.g., OpenAI-compatible endpoints).
- Security researchers run authorized port scans and vulnerability enumeration against target assets.
- Penetration testers leverage built-in Metasploit, Sqlmap, and other tools for in-depth exploitation.
- Enterprise security teams use asset and vulnerability management to track exposure and risk.
- Red teams use WebShell and C2 for post-exploitation and command-and-control operations.
- CTF players solve challenges using password cracking and steganography utilities.
- DevSecOps engineers integrate vulnerability scanning into CI/CD pipelines to improve application security.
How do you install or deploy this agent?
Prerequisites: Go 1.25+ and Python 3.10+. Run: git clone https://github.com/Ed1s0nZ/CyberStrikeAI.git && cd CyberStrikeAI && chmod +x run.sh && ./run.sh. The script automatically creates a Python virtual environment, downloads dependencies, and starts the server. On first launch, the console prints a one-time admin password and the Web UI URL (default https://127.0.0.1:8080). Configure an AI channel in System Settings (provider, API key, Base URL, model). Optionally install security tools, e.g., on macOS: brew install nmap masscan sqlmap nikto gobuster ffuf hydra hashcat nuclei subfinder.
How do you use this agent?
Open the Web UI and log in. After first login, navigate to System Settings -> Basic Settings -> AI Channel Configuration, add or edit a channel, and save. Create users or use the default admin account. Start a new conversation and issue commands like "Scan open ports on 192.168.1.1"; the agent will execute the appropriate tools and return results. Use preconfigured advanced playbooks for complex workflows. Manage results via Task Management, Vulnerability Management, and Asset modules. Upgrade with upgrade.sh, but back up config.yaml and data/ first.
What are this agent's strengths and limitations?
- Comprehensive governance: human approval, tool allowlists, audit-agent review, and audit logs
- 100+ prebuilt tool recipes covering the entire kill chain
- Advanced features like WebShell management and built-in C2 for post-exploitation
- Multiple agent orchestration modes and visual workflows for complex scenarios
- Model-provider agnostic via configurable AI channels
- Asset and vulnerability management modules for tracking and reporting
- High-risk features (WebShell, C2) require strict authorization and careful handling
- Default self-signed certificate requires accepting browser warnings
- Requires external AI API keys; no built-in model
- Some tools need separate installation; missing tools are skipped or substituted at runtime
- Upgrade may introduce compatibility issues; must review release notes and back up
- Requires Go and Python environments, adding deployment complexity
How does this agent compare with similar options?
The README does not explicitly name direct competitors, but it can be compared to other AI penetration testing tools like PentestGPT or Caldera in terms of capabilities.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| CyberStrikeAI — AI-Native Cybersecurity Action System This agent | 44 · Major gaps | CLIFree + model costs | ★ 7.9k | 3d ago | Go | OpenAI API · Claude API |
| PentesterFlow | 73 · Some gaps | CLIFree + model costs | ★ 1.4k | 1mo ago | TypeScript | OpenAI API |
| Tracecat Security Automation Platform | 55 · Major gaps | Self-hosted serviceFreemium | ★ 3.8k | today | Python | Codex · Claude Code |
| PentestAgent | 50 · Major gaps | CLIFree + model costs | ★ 3.2k | 27d ago | Python | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows RBAC, approval modes, tool allowlists, audit logs, but lacks implementation details or verification. Deductions: no code-level evidence, least privilege, user confirmation, data flow transparency are only documented claims.
Documentation describes a consistent architecture and features, but dependency versions are not pinned (e.g., pseudo-versions in go.mod), and no specific failure message examples. Deductions: dependency availability unverified, failure messages lack concrete evidence.
Clearly targets security testers, provides multiple scenarios and deployment methods, but capability boundaries and trigger precision are insufficiently described. Deductions: capability boundaries unclear, trigger conditions lack precise specification.
Information architecture is clear, install notes are detailed, but naming stability, known limitations, versioning/changelog, and maintenance responsibility are insufficient. Deductions: missing version history, known limitations, and clear maintenance responsibility statement.
Output usability is good, with rich tools and UI, but cost-benefit analysis is missing. Deductions: no performance or resource consumption data, marginal value based only on feature list.
Claims in documentation lack traceable code or test evidence, and facts are not separated from inferences. Deductions: claims unverifiable, lack cross-source corroboration.
- This tool includes high-risk capabilities (e.g., WebShell, C2, command execution) and must only be used in authorized environments.
- Dependency versions are not pinned, posing supply chain risks; recommend using fixed versions and regular audits.
- Publisher identity is unverified; assess source trustworthiness carefully.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
本次更新重点优化了长任务执行、上下文恢复和用量统计的可靠性：修复摘要达到输出上限、历史工具参数格式异常导致的对话中断；解决上下文压缩后证据难以追溯、恢复任务时遗漏已有脚本和测试结论的问题，减少重复探索；修复缓存写入 Token 在流式响应、持久化和汇总过程中丢失、DeepSeek 缓存命中用量未正确识别等统计问题，并完善去重及总量缺失时的计算逻辑，新增用量明细与趋势展示。同时修复移动端项目页面遮挡、滚动受限和表格重叠，以及并发创建资产时的数据库锁冲突。 --- This update improves the reliability of long-running tasks, context recovery, and usage tracking. It fixes conversation interruptions caused by summary output limits and malformed historical tool arguments, preserves retrievable evidence after context compaction, and restores existing scripts and test outcomes when resuming tasks to reduce repeated work. It also …View on GitHub ↗ -
Release notes excerpt
新增漏洞复测功能，可从漏洞列表一键创建独立复测对话，继承原始对话历史与模型上下文，支持多轮验证修复结果。复测提示词自动带入已有验证方式，并支持漏洞与会话 ID 占位符替换；验证完成后可更新漏洞状态，追加保存复测证据，便于持续跟踪修复进展。 --- Added vulnerability retesting with a dedicated conversation branch created directly from the vulnerability list. Each branch inherits the original conversation history and model context, supporting multiple rounds of fix verification. Retest prompts include existing verification guidance and resolve vulnerability and conversation ID placeholders. Findings can then be updated with their verification status and supporting evidence to track remediation progress.View on GitHub ↗ -
Release notes excerpt
优化了 CyberStrikeAI 的手机端使用体验，新增底部导航、侧边抽屉和手势操作，调整聊天输入区、表格、弹窗及 API 文档的小屏布局，改善触控操作、软键盘和屏幕安全区域适配。同时延迟加载较大的前端依赖，减少首屏加载阻塞，并补充多语言支持和主屏幕启动配置。 --- Improved CyberStrikeAI’s mobile experience with bottom navigation, slide-out drawers, swipe gestures, and layouts tailored for chat input, tables, dialogs, and API documentation. The update improves touch usability, on-screen keyboard handling, and safe-area support, while deferring large frontend dependencies to reduce initial loading delays. It also adds multilingual support and home-screen launch configuration.View on GitHub ↗