English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português (Brasil) | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी

Open-source AI agent that runs complete penetration tests.

Plug in any LLM — Claude, GPT, Gemini, or 150+ others — and get autonomous
reconnaissance, vulnerability discovery, exploitation, and reporting from your terminal.

Quick Start · Who Is This For · How It Works · Agents · HackBrowser · Vortex · Bolt & MCP · Web UI · Docs

Quick Start

npm i -g @cyberstrike-io/cyberstrike@latest && cyberstrike

CyberStrike launches in your terminal, asks for your LLM provider on first run, and you're ready. No separate AI costs — it runs on top of your existing Claude, OpenAI, or any other LLM subscription.

Point it at a target. CyberStrike runs reconnaissance, finds attack surfaces, tests for vulnerabilities, and delivers a report — each finding with severity, proof-of-concept requests, CWE mapping, and remediation steps. No manual tool chaining, no copy-pasting between terminals.

Explore the full documentation at docs.cyberstrike.io.

Who Is This For

• Pentesters — Automate the repetitive parts. Let agents handle recon and initial testing while you focus on the creative attack chains that need human intuition.
• Bug Bounty Hunters — Faster reconnaissance, wider coverage, consistent methodology across programs. CyberStrike doesn't get tired at 3am.
• Security Teams — Run structured OWASP assessments with reproducible methodology. Get reports that map to standards your compliance team understands.
• Security Researchers — Extend CyberStrike with custom agents, skills, and MCP servers. The plugin system makes it a platform, not just a tool.

How It Works

CyberStrike injects offensive security methodology — OWASP testing procedures, vulnerability patterns, attack chain reasoning — into every AI interaction, turning a general-purpose model into a security specialist.

You describe the target. CyberStrike selects the right agent, loads relevant skills from a library of 7,600+ methodology documents, picks tools, and runs the assessment. Findings are confirmed with a 3-gate protocol (baseline → attack → response diff) — speculative results are discarded.

Agents

Switch agents with Tab. Each one carries domain-specific methodology and testing patterns.

| Agent | What It Does | |-------|-------------| | cyberstrike | Full-access primary agent — recon, exploitation, reporting | | wstg-agent | OWASP WSTG orchestrator + 12 specialist sub-agents for web testing | | general | General-purpose security assistant | | explore | Read-only reconnaissance and analysis |

The web pipeline runs 8 parallel testers on intercepted traffic — testing access control, injection, authentication, business logic, and file security across every request.

CyberStrike Pro adds cloud security (AWS/Azure/GCP), internal network (Active Directory, Kerberos), and mobile application (Android/iOS, Frida) agents. Learn more →

HackBrowser

Built-in browser for web application testing. Start with /hackbrowser.

Browse manually or let it crawl autonomously with multiple accounts. Every HTTP request routes through the agent pipeline — no export steps, no proxy setup. CyberStrike builds a live map of credentials, roles, and endpoints as traffic flows, and the testing agents use it directly.

Vortex

HTTP traffic engine for security testing. Intercept, filter, and analyze requests with a purpose-built DSL. Write rules as data — portable, versionable, composable — and let the canary engine verify findings automatically.

If you've used Caido or Burp Suite's proxy: Vortex is the same concept, native to CyberStrike's agent pipeline.

Bolt & MCP

Bolt runs your security tools on remote servers. Deploy on any VPS or Docker container, pair with Ed25519 keys, and control from your terminal. One CyberStrike instance orchestrates many Bolt servers — each with its own toolkit and network position.

MCP servers extend CyberStrike with specialized security tools:

| Server | Tools | Domain | |--------|-------|--------| | hackbrowser-mcp | 39 | Browser security testing | | cloud-audit-mcp | 38 | Cloud security — AWS, Azure, GCP | | github-security-mcp | 39 | GitHub security posture | | cve-mcp | 23 | CVE intelligence — NVD, EPSS, KEV, GHSA | | osint-mcp-server | 37 | OSINT — Shodan, VirusTotal, Censys, DNS |

All open source. All installable with npx. More security MCP servers at github.com/badchars.

Web UI

Run cyberstrike web for a browser-based interface. Add a Cloudflare Tunnel for secure remote access — zero open ports, end-to-end encryption, password-protected API.

app.cyberstrike.io is a hosted static frontend that connects to your server. No backend, no data storage — or self-host from packages/app/dist/.

Installation

# npm (recommended)
npm i -g @cyberstrike-io/cyberstrike@latest
bun / pnpm / yarn
bun add -g @cyberstrike-io/cyberstrike@latest
macOS (Homebrew)
brew install CyberStrikeus/tap/cyberstrike
Windows (Scoop)
scoop install cyberstrike
Linux / macOS (curl)
curl -fsSL https://cyberstrike.io/install.sh | bash

Contributing

We welcome contributions: security agents and skills, MCP servers, methodology guides, and core improvements. Read the Contributing Guide before submitting a PR.

License

AGPL-3.0-only — Free for personal and open-source use. Commercial licensing available via [email protected].

cyberstrike.io · Docs · Discord · X.com · GitHub

_{Built by hackers who got tired of copy-pasting between terminals.}