English |
简体中文 |
繁體中文 |
한국어 |
Deutsch |
Español |
Français |
Italiano |
Dansk |
日本語 |
Polski |
Русский |
Bosanski |
العربية |
Norsk |
Português (Brasil) |
ไทย |
Türkçe |
Українська |
বাংলা |
Ελληνικά |
Tiếng Việt |
हिन्दी
Open-source AI agent that runs complete penetration tests.
Plug in any LLM — Claude, GPT, Gemini, or 150+ others — and get autonomous
reconnaissance, vulnerability discovery, exploitation, and reporting from your terminal.
Quick Start ·
Who Is This For ·
How It Works ·
Agents ·
HackBrowser ·
Vortex ·
Bolt & MCP ·
Web UI ·
Docs
Quick Start
npm i -g @cyberstrike-io/cyberstrike@latest && cyberstrike
CyberStrike launches in your terminal, asks for your LLM provider on first run, and you’re ready. No separate AI costs — it runs on top of your existing Claude, OpenAI, or any other LLM subscription.
Point it at a target. CyberStrike runs reconnaissance, finds attack surfaces, tests for vulnerabilities, and delivers a report — each finding with severity, proof-of-concept requests, CWE mapping, and remediation steps. No manual tool chaining, no copy-pasting between terminals.
Explore the full documentation at docs.cyberstrike.io.
Who Is This For
- Pentesters — Automate the repetitive parts. Let agents handle recon and initial testing while you focus on the creative attack chains that need human intuition.
- Bug Bounty Hunters — Faster reconnaissance, wider coverage, consistent methodology across programs. CyberStrike doesn’t get tired at 3am.
- Security Teams — Run structured OWASP assessments with reproducible methodology. Get reports that map to standards your compliance team understands.
- Security Researchers — Extend CyberStrike with custom agents, skills, and MCP servers. The plugin system makes it a platform, not just a tool.
How It Works
CyberStrike injects offensive security methodology — OWASP testing procedures, vulnerability patterns, attack chain reasoning — into every AI interaction, turning a general-purpose model into a security specialist.
You describe the target. CyberStrike selects the right agent, loads relevant skills from a library of 7,600+ methodology documents, picks tools, and runs the assessment. Findings are confirmed with a 3-gate protocol (baseline → attack → response diff) — speculative results are discarded.
Supported AI providers (150+)
| Provider |
Models |
Notes |
| Anthropic |
Claude 4.5, Claude 4 |
Best performance with extended thinking |
| OpenAI |
GPT-5, GPT-4.1, o3, o4 |
Full tool-use + reasoning |
| Google |
Gemini 2.5 Pro/Flash |
Long context for large codebases |
| Amazon Bedrock |
All Bedrock models |
IAM auth, no API keys needed |
| Azure OpenAI |
All Azure-hosted models |
Enterprise deployments |
| GitHub Copilot |
GPT-5, Claude, Gemini |
Use your Copilot subscription |
| Ollama / LM Studio |
Any local model |
Fully offline, air-gapped |
| OpenRouter |
300+ models |
Single API, any model |
Plus Groq, Mistral, xAI, DeepSeek, Cerebras, Cohere, Together AI, and any OpenAI-compatible endpoint — 150+ providers total.
Agents
Switch agents with Tab. Each one carries domain-specific methodology and testing patterns.
| Agent |
What It Does |
| cyberstrike |
Full-access primary agent — recon, exploitation, reporting |
| wstg-agent |
OWASP WSTG orchestrator + 12 specialist sub-agents for web testing |
| general |
General-purpose security assistant |
| explore |
Read-only reconnaissance and analysis |
The web pipeline runs 8 parallel testers on intercepted traffic — testing access control, injection, authentication, business logic, and file security across every request.
CyberStrike Pro adds cloud security (AWS/Azure/GCP), internal network (Active Directory, Kerberos), and mobile application (Android/iOS, Frida) agents. Learn more →
HackBrowser
Built-in browser for web application testing. Start with /hackbrowser.
Browse manually or let it crawl autonomously with multiple accounts. Every HTTP request routes through the agent pipeline — no export steps, no proxy setup. CyberStrike builds a live map of credentials, roles, and endpoints as traffic flows, and the testing agents use it directly.
Vortex
HTTP traffic engine for security testing. Intercept, filter, and analyze requests with a purpose-built DSL. Write rules as data — portable, versionable, composable — and let the canary engine verify findings automatically.
If you’ve used Caido or Burp Suite’s proxy: Vortex is the same concept, native to CyberStrike’s agent pipeline.
Bolt & MCP
Bolt runs your security tools on remote servers. Deploy on any VPS or Docker container, pair with Ed25519 keys, and control from your terminal. One CyberStrike instance orchestrates many Bolt servers — each with its own toolkit and network position.
MCP servers extend CyberStrike with specialized security tools:
All open source. All installable with npx. More security MCP servers at github.com/badchars.
Web UI
Run cyberstrike web for a browser-based interface. Add a Cloudflare Tunnel for secure remote access — zero open ports, end-to-end encryption, password-protected API.
app.cyberstrike.io is a hosted static frontend that connects to your server. No backend, no data storage — or self-host from packages/app/dist/.
Installation
# npm (recommended)
npm i -g @cyberstrike-io/cyberstrike@latest
# bun / pnpm / yarn
bun add -g @cyberstrike-io/cyberstrike@latest
# macOS (Homebrew)
brew install CyberStrikeus/tap/cyberstrike
# Windows (Scoop)
scoop install cyberstrike
# Linux / macOS (curl)
curl -fsSL https://cyberstrike.io/install.sh | bash
Contributing
We welcome contributions: security agents and skills, MCP servers, methodology guides, and core improvements. Read the Contributing Guide before submitting a PR.
License
AGPL-3.0-only — Free for personal and open-source use. Commercial licensing available via [email protected].
cyberstrike.io · Docs · Discord · X.com · GitHub
Built by hackers who got tired of copy-pasting between terminals.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?v=4)
评论