HexStrike AI MCP
An MCP bridge that lets AI clients orchestrate locally installed security-testing tools and workflows.
- Source repo
- 0x4m4/hexstrike-ai
- Stars
- ★ 13k
- Last updated
- 3mo ago
- License
- MIT
- Primary language
- Python
- FA score
- 22/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformClaude.ai
- Cost
- Free, no paid service needed
- Setup effort
- High · needs real infrastructure
- You'll need
- Typical use
- An internal security team, with written authorization, uses Claude Desktop to assess a company-owned web application with content discovery, vulnerability scanning, and security-header checks.
- Not a fit if
- Users who want a turnkey tool with no manual security-tool installs
- Teams that cannot provide an isolated VM or dedicated test host
- Production deployments needing built-in authentication and access control
- Source review
- 22/100 · Major gaps 8 safety controls not found
What does this agent do, and when should you use it?
HexStrike AI MCP is a Python-run local MCP server described in its README as version 6.0. It connects MCP clients such as Claude Desktop, Cursor, and VS Code Copilot to a security-tool execution layer, with HTTP endpoints for health, commands, telemetry, caching, and intelligence analysis. The repository describes specialized components including IntelligentDecisionEngine, BugBountyWorkflowManager, CTFWorkflowManager, and CVEIntelligenceManager, alongside browser automation, process management, and live dashboards. Its deployment boundary is the host machine: it runs installed security tools and returns execution, analysis, and visual results rather than providing a hosted security-testing service. It is intended for authorized penetration tests, in-scope bug bounties, CTFs, and approved red-team work; the documentation explicitly warns that AI clients can receive powerful system access.
An AI client connects through FastMCP/MCP to the HexStrike MCP Server, where IntelligentDecisionEngine is described as selecting tools and optimizing parameters. The server exposes MCP operations such as nmap_scan(), nuclei_scan(), sqlmap_scan(), ghidra_analyze(), and trivy_scan() to run installed external programs; the README also names /api/intelligence/analyze-target, /api/intelligence/select-tools, and /api/intelligence/optimize-parameters. /api/command is documented to execute arbitrary commands with caching, while /api/processes/list, /api/processes/status/<pid>, and /api/processes/terminate/<pid> inspect and control processes. Its Browser Agent uses Selenium with Headless Chrome for screenshots, DOM inspection, network-request logging, form discovery, and security-header analysis; the project describes live dashboards, progress views, vulnerability cards, and risk analysis as outputs.
- An internal security team, with written authorization, uses Claude Desktop to assess a company-owned web application with content discovery, vulnerability scanning, and security-header checks.
- A bug-bounty researcher works within a program’s permitted scope and uses amass_enum(), HTTP probing, and Nuclei templates for asset discovery and initial vulnerability screening.
- A CTF participant analyzes a competition binary with GDB, Ghidra, Radare2, Pwntools, or Angr in the event environment.
- A cloud-security engineer assesses authorized AWS, Azure, GCP, container, or Kubernetes environments with Prowler, Scout Suite, Trivy, Kube-Hunter, or Kube-Bench.
- A red-team lead deploys the service in an isolated testing VM and supervises long-running scans and recovery activity through process endpoints and the dashboard.
How do you install or deploy this agent?
Prerequisites: Python 3.8+, the needed security tools installed on the host, and Chrome or Chromium plus ChromeDriver when using the Browser Agent.
- git clone https://github.com/0x4m4/hexstrike-ai.git
- cd hexstrike-ai
- python3 -m venv hexstrike-env
- source hexstrike-env/bin/activate
- pip3 install -r requirements.txt
- python3 hexstrike_server.py
The examples use local port 8888. Debug and port options shown are python3 hexstrike_server.py --debug and python3 hexstrike_server.py --port 8888. The documentation does not specify authentication, authorization controls, or a one-command installation process for the security tools.
How do you use this agent?
Start the server, then verify it with curl http://localhost:8888/health. For Claude Desktop or Cursor, configure an MCP server with command set to python3 and args set to ["/path/to/hexstrike-ai/hexstrike_mcp.py","--server","http://localhost:8888"]; the README also provides a stdio configuration for VS Code Copilot. A documented first HTTP request is POST /api/intelligence/analyze-target with {"target":"example.com","analysis_type":"comprehensive"}; an MCP client can instead request a named tool. Run tests only against systems you own or are explicitly authorized to test, and monitor execution from an isolated environment.
What are this agent's strengths and limitations?
- Combines an MCP tool surface with HTTP operational endpoints for health, telemetry, caching, intelligence analysis, and process control.
- The README names 150+ security tools across network, web, cloud, binary-analysis, forensics, and OSINT work, allowing deployment-specific tool selection.
- Its documented Headless Chrome/Selenium Browser Agent covers screenshots, DOM inspection, network traffic, forms, and security headers.
- Configuration examples directly cover Claude Desktop, Cursor, and VS Code Copilot, while also describing support for MCP-compatible clients.
- Its capabilities depend on host-installed tools; the documentation supplies a tool list but no automated installation or version-compatibility guarantee.
- /api/command is documented to execute arbitrary commands, and the README warns of powerful system access for AI clients, making isolation, authorization, and human oversight essential.
- Production authentication is only suggested as something to consider; no built-in authentication, access-control, or secret-management configuration is documented.
- The README’s performance, detection-rate, success-rate, and uptime figures have no accompanying methodology or auditable benchmark evidence.
How does this agent compare with similar options?
The README compares claimed AI-automation durations with “traditional manual” work. Because it provides no measurement methodology, those figures should not be used as a procurement benchmark.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| HexStrike AI MCP This agent | 22 · Major gaps | MCP serverFree | ★ 13k | 3mo ago | Python | Claude.ai |
| PentesterFlow | 73 · Some gaps | CLIFree + model costs | ★ 1.4k | 2mo ago | TypeScript | OpenAI API |
| PentestCode | 55 · Major gaps | CLIFree + model costs | ★ 928 | 1d ago | TypeScript | OpenAI API · Claude API |
| VulnClaw | 48 · Major gaps | CLIFree + model costs | ★ 3.9k | 1mo ago | Python | — |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: README describes an MCP server allowing AI agents to execute 150+ security tools, including command execution endpoint (/api/command) and process management. No mechanisms for least privilege, user confirmation, data flow transparency, sensitive data handling, dependency security, external effects control, rollback, or source attribution are found. Deductions: these aspects are completely absent from the provided files.
Evidence shows: README and requirements.txt provide some consistency, but code is not provided, so self-consistency cannot be verified. Dependency list exists, but installation verification is not provided. Failure messages are not mentioned. Deductions: lack of code and tests prevents reliability assessment.
Evidence shows: README identifies target audience (security researchers, bug bounty hunters) and scenarios (pentesting, CTF). Capability boundaries are partially described (tool lists), but limitations are not explicit. Trigger precision is not detailed. Environment fit has installation instructions but no OS compatibility details. Deductions: capability boundaries and trigger precision are insufficiently described.
Evidence shows: README provides architecture, installation, API reference, and examples, indicating good information architecture. Installation notes are detailed. Naming is stable (version v6.0). Examples and FAQ exist but are brief. Known limitations are not mentioned. License is MIT. Versioning changelog is not provided. Maintenance responsibility is claimed by OTT Cybersecurity LLC. Deductions: missing known limitations and changelog.
Evidence shows: Output usability is described as visual reports, but no actual output examples are provided. Marginal value is high (150+ tool integration). Cost-benefit is not discussed. Deductions: output examples and cost analysis are missing.
Evidence shows: Claims in README (e.g., 150+ tools, 12+ agents) are not traceable to evidence. No cross-source corroboration. Facts and inferences are not separated. Deductions: all claims lack supporting evidence.
- Not found in source: least-privilege scopingGrant only what the task needs: a dedicated account or read-only token, scoped to specific directories and repos.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: data-flow disclosureWatch which external services it contacts (proxy or firewall logs) and keep sensitive data out until you know where it goes.
- Not found in source: sensitive-data handlingUse dedicated, low-privilege, revocable API keys — never production credentials — and keep secrets out of logs.
- Not found in source: dependency securityPin versions and run a dependency audit (npm audit, pip-audit) before installing; prefer running it in a container.
- Not found in source: disclosed external effectsEstablish which external systems it writes to, sends to or changes, and verify with test accounts or repos before production.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Not found in source: verifiable attributionInstall from the official repo or registry and check the publisher and URL to avoid look-alike packages.
- This tool allows AI agents to execute arbitrary commands, posing significant security risks; must only be used in authorized environments.
- No permission controls or user confirmation mechanisms are provided, potentially leading to unauthorized actions.
- Relies on numerous external security tools, making installation and configuration complex, and versions are not pinned.