CyberStrikeus/CyberStrike

English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português (Brasil) | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी

The first open-source AI agent built for offensive security.

Automated penetration testing from your terminal — plug in your Claude, GPT, or any LLM subscription
and turn it into an autonomous red team agent with 13+ specialized agents and 120+ OWASP test cases.

Quick Start • Intelligence Layer • What Makes It Different • Agents • Web UI • Bolt • MCP Ecosystem • Installation • Docs • Website

Quick Start

npm i -g @cyberstrike-io/cyberstrike@latest && cyberstrike

That's it. CyberStrike launches a TUI in your terminal, asks for your LLM provider and API key on first run, and you're ready to go. Tell it what to test — it handles reconnaissance, vulnerability discovery, exploitation, and reporting autonomously.

Already have a Claude Code or OpenAI subscription? CyberStrike's intelligence layer sits on top of your existing AI subscription. No separate API costs — your current plan powers an entire pentest toolkit.

Explore the full documentation at docs.cyberstrike.io or visit cyberstrike.io for demos and guides.

Intelligence Layer

CyberStrike isn't just a wrapper around an LLM. It's an intelligence layer that transforms any AI model into an offensive security specialist.

How it works: When you connect your LLM provider, CyberStrike injects domain-specific context — OWASP testing methodology, vulnerability patterns, attack chain reasoning, and tool orchestration logic — into every interaction. The model doesn't need to know security; CyberStrike teaches it.

What the intelligence layer provides:

• Schema normalization — Structured output from any provider, regardless of response format differences
• Context guard — Prevents prompt leakage and keeps the agent focused on the current test phase
• Provider auto-detection — Automatically identifies your LLM endpoint and configures the optimal transport
• Tool orchestration — Chains security tools intelligently based on findings, not fixed scripts

15+ LLM providers supported out of the box:

Air-gapped environments? Run CyberStrike entirely offline with Ollama or LM Studio. No data leaves your machine — ever.

What Makes It Different

Agents

Switch between agents with Tab. Each one is a domain specialist.

Plus 8 specialized proxy testers that run automatically on intercepted traffic:

Each tester uses a 3-gate confirmation protocol: execute a baseline request, execute the attack, compare responses. A finding is only reported when there is a measurable, reproducible difference — not on speculation. Duplicate findings (same endpoint + attack vector) are automatically suppressed across the session.

HackBrowser

Full documentation: docs.cyberstrike.io/docs/tools/hacker-browser

HackBrowser is CyberStrike's built-in Chromium browser. Start it from the TUI with /hackbrowser. As you browse, every HTTP request is captured and routed through the proxy-agent pipeline — no manual export, no Burp project files.

Two capture modes:

• Manual — Browse the target yourself. Log in as different users, navigate features, trigger actions. HackBrowser captures the real API traffic behind every click.
• Autonomous — Provide credentials for multiple accounts, set a scope, and let HackBrowser crawl automatically. It logs in as each user, maps reachable pages, and captures the traffic difference between roles.

Role & credential discovery:

As you browse with multiple accounts, CyberStrike builds a session context — a live map of discovered credentials, inferred role hierarchy, and which endpoints each role can reach. The 8 proxy sub-testers use this context directly: they know which token to use for a high-privilege baseline and which lower-privilege credentials to test with, without any manual setup.

Browser traffic → Proxy intercept → Orchestrator → 8 sub-testers (parallel)
                                          ↓
                               Session context (credentials, roles,
                               endpoints, functions) shared across all testers

Scope control:

Use --scope to limit testing to specific domains. CyberStrike automatically derives the registered domain (e.g. --scope api.example.com covers api.example.com but not other.com). Pass multiple --scope flags for multi-domain targets.

Web UI & Remote Access

CyberStrike includes a full web interface. Run cyberstrike web and control your agents, MCP servers, Bolt connections, and vulnerability findings from any browser.

Access from anywhere with Cloudflare Tunnel:

Browser ──HTTPS──▶ Cloudflare Tunnel ──encrypted──▶ cloudflared (localhost) ──▶ CyberStrike Server

export CYBERSTRIKE_SERVER_PASSWORD=your-secure-password
cyberstrike web
# In another terminal:
cloudflared tunnel --url http://localhost:4096 run your-tunnel

Why this is secure:

• Zero open ports — CyberStrike binds to localhost:4096. cloudflared makes an outbound-only connection to Cloudflare's edge. No firewall rules, no port forwarding needed.
• End-to-end encryption — Browser to Cloudflare edge is TLS. Cloudflare edge to your machine is an encrypted tunnel. No plaintext leaves your network.
• Password-protected API — Every API request requires Basic Auth. Local requests on localhost bypass auth for convenience; remote requests via CF tunnel always require credentials (detects X-Forwarded-For / CF-Connecting-IP).
• Your data stays local — LLM inference runs on your hardware. CyberStrike processes everything locally. The tunnel is just a secure pipe.

What's in the Web UI:

app.cyberstrike.io is a hosted static page (no backend, no data storage) for convenience. Or self-host: clone the repo and serve packages/app/dist/ from your own domain.

Bolt — Remote Tool Execution

Bolt is CyberStrike's remote tool server. Deploy it on any VPS, cloud instance, or Docker container — then control it from your local terminal over MCP protocol with Ed25519 authentication.

One CyberStrike, many Bolt servers:

                                          ┌─────────────────────┐
                                     ┌───►│  Bolt Server #1     │
                                     │    │  nmap, nuclei, ffuf  │
┌