CyberStrike is a terminal AI agent for authorized offensive security. Installed as an npm package, it launches a TUI, asks for an LLM provider and API key on first run, and then drives penetration testing tasks: reconnaissance, vulnerability discovery, exploitation, and reporting. It works on top of an existing Claude, GPT, or other LLM subscription rather than charging separate API costs.

Instead of acting as a thin wrapper around a model, CyberStrike injects security domain context into every interaction: OWASP testing methodology, vulnerability patterns, attack-chain reasoning, and tool orchestration. It normalises structured output across providers, guards context between test phases, auto-detects the provider endpoint, and chains tools based on findings. Around 150 providers and 5,300 models are supported, including Anthropic, OpenAI, Google, Amazon Bedrock, Azure, GitHub Copilot, and fully offline runners such as Ollama and LM Studio for air-gapped use.

Work is divided among domain-specialist agents (web application, mobile, cloud, internal network, and a general agent), switchable with Tab, plus eight proxy sub-testers that run on intercepted traffic for issues such as IDOR, authorization bypass, injection, SSRF, and business-logic flaws. Each sub-tester uses a three-gate protocol, sending a baseline request, then the attack, then comparing responses, so a finding is only reported on a measurable, reproducible difference. Agents draw on a large library of signed, lazy-loaded skill files carrying testing procedures, payloads, tool commands, and CWE mappings.

HackBrowser, a built-in Chromium, captures HTTP traffic as you browse (manually or autonomously across multiple accounts) and feeds it to the proxy pipeline, building a session context of credentials, roles, and reachable endpoints that the sub-testers share. Bolt runs security tools on remote servers paired over MCP with Ed25519 keys, so one CyberStrike instance can orchestrate several toolkits. A web UI, additional MCP servers, built-in post-exploitation hooks, and a plugin SDK extend the system further.

Features

Intelligence layer: injects OWASP methodology, vulnerability patterns, and tool-orchestration logic, with schema normalisation and context guarding across providers
Provider coverage: around 150 providers and 5,300 models, including cloud APIs, subscriptions such as GitHub Copilot, and offline runners like Ollama, LM Studio, and vLLM
Specialist agents: domain agents for web, mobile, cloud, and internal-network testing, switchable from the TUI
Proxy sub-testers: eight testers for IDOR, authorization bypass, mass assignment, injection, authentication, business logic, SSRF, and file attacks, each using a three-gate confirmation protocol
Security skills: thousands of signed, lazy-loaded methodology files tagged with OWASP WSTG and CIS IDs and chain relationships
HackBrowser: a built-in Chromium that captures API traffic manually or autonomously and maps credentials, roles, and endpoints into a shared session context
Bolt remote execution: run tools on remote VPS, Docker, or Kubernetes servers over MCP with Ed25519 pairing and real-time result streaming
MCP ecosystem: connects to security MCP servers for cloud audits, GitHub posture, CVE intelligence, and OSINT recon
Built-in tools: 56+ tools for shell execution, discovery, offensive actions, reporting, and post-exploitation
Post-exploitation: platform hooks for macOS, Windows, Linux/eBPF, AWS, Azure, Kubernetes, and CI/CD, driven by context rather than fixed scripts
Web UI and remote access: a browser interface for agents, MCP status, Bolt connections, and findings, exposable through an outbound-only Cloudflare Tunnel with Basic Auth
Plugin SDK: 15+ hook types for building and registering custom agents and tools at runtime

Claim CyberStrike

Verify write access with GitHub