CyberStrikeAI: AI-Native Cybersecurity Operations Platform
Ed1s0nZ/CyberStrikeAI
CyberStrikeAI is a self-hosted Go platform that turns natural-language intent into audited, human-approved runs of over 100 pentesting tools, wiring them behind an agent orchestration layer with role-based approval gates. Reach for it if you already run authorized pentests and want one workspace that logs every AI-driven action. Skip it if you just want one scanner or don't want to manage AI provider keys and a Go/Python toolchain yourself.
An AI Platform for Cybersecurity Operations
CyberStrikeAI is a self-hosted security operations platform written in Go that connects AI agents to a curated set of pentesting tools through the Model Context Protocol (MCP). It runs as a web console where an agent plans an engagement, executes tools like nmap or sqlmap under role-based policy, and records the resulting evidence, vulnerabilities, and attack-chain graph in one auditable workspace.
Core Capabilities and Highlights
- ✓Eino orchestration runs single-agent tasks or switches to Deep, Plan-Execute, and Supervisor multi-agent modes for more complex engagements.
- ✓Graph workflows chain agents, tools, conditions, approvals, and outputs into reusable playbooks instead of one-off prompts.
- ✓Role-based testing ships with 12+ predefined roles and scoped tool policies, so a web-app tester and a cloud tester get different prompts and different allowed tools.
- ✓100+ curated tool recipes cover the kill chain: nmap and masscan for recon, sqlmap and nuclei for scanning, metasploit and pwntools for exploitation, volatility for forensics.
- ✓MCP integration supports HTTP, stdio, SSE, external federation, and dynamic tool discovery, including a stdio mode for scripting outside the web console.
- ✓Human-in-the-loop controls add approval modes, tool allowlists, and audit-agent review before a risky action actually runs.
- ✓Asset management dedupes domains, IPs, ports, and services, supports XLSX/CSV import and export, and tracks scan coverage against linked vulnerabilities.
- ✓A Burp Suite extension and a Chrome/Edge browser extension pipe captured traffic straight into the platform for AI-assisted analysis.
Who Benefits from CyberStrikeAI?
CyberStrikeAI fits security teams and individual penetration testers who already run authorized engagements and want an AI agent doing the grunt work of chaining recon, scanning, and exploitation tools while a human signs off on risky steps. It also suits red teamers who want attack-chain graphs and replay for reporting, and teams that need role-scoped access so a junior tester can't touch WebShell or C2. It's a poor fit for anyone hoping to point an AI at a target with no authorization paperwork in place — the README is explicit that unauthorized use is on the user, not the developers.
Quick Start Deployment
Prerequisites are Go 1.25+ and Python 3.10+. Clone the repo, then run the one-command deployment script: ```bash git clone https://github.com/Ed1s0nZ/CyberStrikeAI.git cd CyberStrikeAI chmod +x run.sh && ./run.sh ``` `run.sh` checks the Go and Python environments, creates a Python virtual environment, installs Python dependencies, downloads Go dependencies, builds the project, and starts the server. It defaults to HTTPS with a local self-signed certificate — use `./run.sh --http` for plain HTTP — so you'll need to accept one browser warning. On a fresh install, the console prints a one-time `admin` password under `ADMIN SETUP REQUIRED`; save it, log in, and change it immediately. Before you can run anything, go to System Settings → Basic Settings → AI Channel Configuration and add at least one AI provider channel (OpenAI-compatible endpoints, DeepSeek, and Qwen are all supported through the `openai_compatible` provider type). Nothing works until that's configured. The security tools themselves — nmap, sqlmap, hashcat, and the rest — install separately via Homebrew or apt; missing ones are skipped or substituted at runtime.
Strengths
- ✓The tool catalog is genuinely broad — 100+ recipes spanning recon, web scanning, cloud/container security, binary analysis, forensics, and post-exploitation, not just a wrapper around one scanner.
- ✓Human-in-the-loop is a real design constraint, not a checkbox: approval modes, tool allowlists, and audit-agent review sit between the LLM and tool execution.
- ✓MCP support (HTTP, stdio, SSE, federation, dynamic discovery) means you can plug in external MCP tool servers instead of being limited to the bundled YAML recipes.
- ✓Attack-chain graphs and step-by-step replay turn a multi-session engagement into something you can hand to a client, not just a transcript.
- ✓Apache-2.0 licensing keeps it unencumbered for internal or client-facing use.
Important Usage Guidelines and Restrictions
- △Nothing runs without an AI provider configured first — you're bringing your own OpenAI-compatible key/endpoint (OpenAI, DeepSeek, Qwen, etc.), so there's an ongoing external API cost on top of self-hosting.
- △Setup pulls in two separate toolchains (Go 1.25+ and Python 3.10+) plus a Python virtual environment, and the actual security tools (nmap, sqlmap, hashcat...) are a separate manual install via Homebrew/apt — this isn't a single binary you just run.
- △C2 and WebShell features are built in with default access rather than opt-in add-ons, so a misconfigured deployment has a larger blast radius than a plain scanner wrapper.
- △Evidence and audit data persist in SQLite, which fits a single deployment but isn't built for multi-instance or heavily concurrent team setups.
- △The disclaimer is explicit that authorization and legal compliance are entirely on the operator — CyberStrikeAI doesn't verify you have permission to test a target.
Exploring Similar Security Tools
Common Questions about CyberStrikeAI
CyberStrikeAI is released under the Apache License 2.0, with the full text in the repo's LICENSE file.
CyberStrikeAI is built in Go, with a Python virtual environment used for tools that need it, like api-fuzzer and http-framework-test.
CyberStrikeAI connects to any OpenAI-compatible endpoint through its channel configuration, with the README listing OpenAI's gpt-4o, DeepSeek's deepseek-chat, and Qwen's qwen3-max as example models.
CyberStrikeAI's own README says to use it exclusively on systems under your ownership or for which you possess explicit authorization to test, and to review the security model and hardening guide before enabling WebShell or C2 features on shared or production environments.
CyberStrikeAI supports multi-agent orchestration through its Eino-based Deep, Plan-Execute, and Supervisor modes, on top of plain single-agent execution.
The problem it solves
Running an AI agent against real infrastructure creates a specific problem most chat-based security assistants ignore: nothing stops the agent from executing a destructive command with no one watching, and nothing survives to explain what happened afterward. CyberStrikeAI's answer is to put approval gates, tool allowlists, and audit-agent review between agent intent and actual tool execution, then persist every action, finding, and attack-chain step in SQLite so an operation can be replayed, not just remembered.
Best use cases
- •Chaining recon-to-report on an authorized engagement: subfinder/amass for subdomains, nuclei against the results, then an attack chain built from the findings with severity filtering.
- •Web app testing where a tester wants sqlmap, nikto, dirb, or ffuf run and interpreted by an agent instead of manually parsing each tool's output.
- •Capturing and replaying authenticated traffic from Burp Suite or the browser extension for AI-assisted analysis of what a manual tester already found.
- •Post-exploitation work through the built-in C2 and WebShell management, with every session and payload tied back to the same audit log.
- •Running role-scoped tests where a junior analyst gets a narrow tool policy and prompt while WebShell/C2 stays restricted to senior roles.