<div align="center"> <img src="images/logo.png" alt="CyberStrikeAI Logo" width="200" > </div>

CyberStrikeAI

中文 | English

The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next.

CyberStrikeAI connects planning, execution, human oversight, evidence, and replay in one auditable workspace. Built in Go, it combines Eino-powered agents, MCP-native tools, RAG knowledge, visual workflows, and attack-chain modeling and analysis for authorized security operations.

Start here: Quick start · Documentation · Security hardening

[!IMPORTANT] Use CyberStrikeAI only on systems you own or are explicitly authorized to test. For shared or production environments, review the security model and hardening guide before enabling high-risk tools, WebShell, or C2 capabilities.

Interface & Integration Preview

<div align="center">

System Dashboard Overview

<table> <tr> <td width="50%" align="center"> <strong>Light Mode</strong><br/> <img src="./images/dashboard.png" alt="System Dashboard (Light)" width="100%"> </td> <td width="50%" align="center"> <strong>Dark Mode</strong><br/> <img src="./images/dark.png" alt="System Dashboard (Dark)" width="100%"> </td> </tr> </table>

The dashboard provides a comprehensive overview of system runtime status, security vulnerabilities, tool usage, and knowledge base, helping users quickly understand the platform's core features and current state.

<details> <summary><strong>More interface screenshots</strong></summary>

Core Features Overview

<table> <tr> <td width="33.33%" align="center"> <strong>Web Console</strong><br/> <img src="./images/web-console.png" alt="Web Console" width="100%"> </td> <td width="33.33%" align="center"> <strong>Task Management</strong><br/> <img src="./images/task-management.png" alt="Task Management" width="100%"> </td> <td width="33.33%" align="center"> <strong>Vulnerability Management</strong><br/> <img src="./images/vulnerability-management.png" alt="Vulnerability Management" width="100%"> </td> </tr> <tr> <td width="33.33%" align="center"> <strong>WebShell Management</strong><br/> <img src="./images/webshell-management.png" alt="WebShell Management" width="100%"> </td> <td width="33.33%" align="center"> <strong>MCP Management</strong><br/> <img src="./images/mcp-management.png" alt="MCP management" width="100%"> </td> <td width="33.33%" align="center"> <strong>Knowledge Base</strong><br/> <img src="./images/knowledge-base.png" alt="Knowledge Base" width="100%"> </td> </tr> <tr> <td width="33.33%" align="center"> <strong>Skills Management</strong><br/> <img src="./images/skills.png" alt="Skills Management" width="100%"> </td> <td width="33.33%" align="center"> <strong>Agent Management</strong><br/> <img src="./images/agent-management.png" alt="Agent Management" width="100%"> </td> <td width="33.33%" align="center"> <strong>Role Management</strong><br/> <img src="./images/role-management.png" alt="Role Management" width="100%"> </td> </tr> <tr> <td width="33.33%" align="center"> <strong>System Settings</strong><br/> <img src="./images/settings.png" alt="System settings" width="100%"> </td> <td width="33.33%" align="center"> <strong>MCP stdio Mode</strong><br/> <img src="./images/mcp-stdio2.png" alt="MCP stdio mode" width="100%"> </td> <td width="33.33%" align="center"> <strong>Burp Suite Plugin</strong><br/> <img src="./images/plugins.png" alt="Burp Suite plugin" width="100%"> </td> </tr> </table> </details> </div>

Highlights

Agents and orchestration

• 🤖 Agentic execution translates natural-language intent into governed, auditable security actions.
• 🧩 Eino orchestration supports single-agent execution plus Deep, Plan-Execute, and Supervisor multi-agent modes.
• 🔀 Graph workflows combine Agents, tools, conditions, approvals, and outputs into reusable flows.
• 🎭 Role-based testing provides focused prompts and tool policies for common security scenarios.

Tools and knowledge

• 🧰 Security tools include 100+ curated YAML recipes with custom extensions and role-scoped access.
• 🔌 MCP integration supports HTTP, stdio, SSE, external federation, and dynamic tool discovery.
• ⏱️ Resilient tool execution runs blocking MCP/tool calls in workers with bounded agent waits, resumable execution_id polling, cancellation, per-server circuit breakers, concurrency limits, and unified output caps.
• 🎯 Agent Skills follow the standard Skill layout and support progressive, on-demand loading.
• 📚 Knowledge base combines query rewriting, vector retrieval, reranking, and result post-processing.
• 🖼️ Vision analysis uses a separate vision model for screenshots, captchas, and UI while retaining text summaries only.

Governance and audit

• 🧑‍⚖️ Human in the loop provides approval modes, tool allowlists, audit-agent review, and traceable decisions.
• 🛡️ Call blocking under Security adds configurable regex checks before MCP execution, reminder templates, and dry runs, with government-domain protection enabled by default. See Tool call blocking.
• 🔐 Platform RBAC supports multiple users, system and custom roles, scoped permissions, ownership, and explicit assignments.
• 🔒 Security and audit provide authenticated access, audit logs, SQLite persistence, and operational evidence retention.
• 📄 Result governance stores the same capped tool result seen by the agent, protects resume paths from oversized historical output, and adds UI safeguards for large detail views. See Tool Execution Governance.

Security operations

• 📁 Conversation management provides pinning, renaming, and batch organization.
• 📂 Projects and attack chains connect cross-session facts, risk scoring, graph views, and step-by-step replay.
• 🗂️ Asset management normalizes and deduplicates domains, IP addresses, ports, and services; supports XLSX/CSV import and export, advanced filters and saved views, ownership and business metadata, cross-page bulk maintenance, and duplicate merging; and tracks scan coverage, linked vulnerabilities, and risk state. See the Asset Management guide.
• 🛡️ Vulnerability management provides severity classification, lifecycle tracking, filtering, and statistics.
• 📋 Batch tasks provide queued execution, editing, status tracking, and retained results.
• 📱 Chatbots connect Personal WeChat, WeCom, DingTalk, Lark, Telegram, Slack, Discord, and QQ Bot.

Authorized security operations

• 🐚 WebShell management provides connection management, a virtual terminal, file operations, and AI-assisted workflows.
• 📡 Built-in C2 provides listeners, encrypted beacons, sessions, task queues, payload helpers, and live events.

WebShell, C2, and other high-risk capabilities are for systems you own or are explicitly authorized to test. See the security model and hardening guide.

Plugins

CyberStrikeAI includes optional integrations under plugins/.

• Burp Suite extension: plugins/burp-suite/cyberstrikeai-burp-extension/
  Build output: plugins/burp-suite/cyberstrikeai-burp-extension/dist/cyberstrikeai-burp-extension.jar
  Docs: plugins/burp-suite/cyberstrikeai-burp-extension/README.md
• Browser extension (Chrome / Edge): plugins/browser-extension/cyberstrikeai-browser-extension/
  Capture Network traffic in DevTools and send it to CyberStrikeAI for AI-assisted security testing—aligned with the Burp plugin.
  Install: chrome://extensions/ → Load unpacked → F12 → CyberStrikeAI tab
  Package output: plugins/browser-extension/cyberstrikeai-browser-extension/dist/cyberstrikeai-browser-extension.zip
  Docs: plugins/browser-extension/cyberstrikeai-browser-extension/README.md / README.zh-CN.md

Tool Overview

CyberStrikeAI ships with 100+ curated tools covering the whole kill chain:

<details> <summary><strong>View the complete tool categories</strong></summary>

• Network Scanners – nmap, masscan, rustscan, arp-scan, nbtscan
• Web & App Scanners – sqlmap, nikto, dirb, gobuster, feroxbuster, ffuf, httpx
• Vulnerability Scanners – nuclei, wpscan, wafw00f, dalfox, xsser
• Subdomain Enumeration – subfinder, amass, findomain, dnsenum, fierce
• Network Space Search Engines – fofa_search, zoomeye_search, quake_search, shodan_search
• API Security – graphql-scanner, arjun, api-fuzzer, api-schema-analyzer
• Container Security – trivy, clair, docker-bench-security, kube-bench, kube-hunter
• Cloud Security – prowler, scout-suite, cloudmapper, pacu, terrascan, checkov
• Binary Analysis – gdb, radare2, ghidra, objdump, strings, binwalk
• Exploitation – metasploit, msfvenom, pwntools, ropper, ropgadget
• Password Cracking – hashcat, john, hashpump
• Forensics – volatility, volatility3, foremost, steghide, exiftool
• Post-Exploitation – linpeas, winpeas, mimikatz, bloodhound, impacket, responder
• CTF Utilities – stegsolve, zsteg, hash-identifier, fcrackzip, pdfcrack, cyberchef
• System Helpers – exec, create-file, delete-file, list-files, modify-file

</details>

See tools/README_EN.md for tool definitions, customization, and usage notes.

Basic Usage

Quick Start (One-Command Deployment)

Prerequisites:

• Go 1.25+ (Install; required by go.mod)
• Python 3.10+ (Install)

One-Command Deployment:

git clone https://github.com/Ed1s0nZ/CyberStrikeAI.git
cd CyberStrikeAI
chmod +x run.sh && ./run.sh

The run.sh script will automatically:

• ✅ Check and validate Go & Python environments
• ✅ Create Python virtual environment
• ✅ Install Python dependencies
• ✅ Download Go dependencies
• ✅ Build the project
• ✅ Start the server

Verify the startup:

1. Confirm the terminal displays ● ONLINE followed by the actual Web UI URL.
2. Open that URL; the default HTTPS mode uses a local self-signed certificate, so accept the browser warning once.
3. On a new installation, store the one-time admin password shown under ADMIN SETUP REQUIRED, sign in, and change it immediately.

Networking defaults: run.sh starts the server with --https and the repo config.yaml (local self-signed TLS; better for many concurrent streams). Use ./run.sh --http for plain HTTP. In production, set server.tls_cert_path / server.tls_key_path in config.yaml (see comments there). For manual runs, add --https or CYBERSTRIKE_HTTPS=1; if -config is wrong, the binary prints a short usage hint on stderr.

First-Time Configuration:

1. Configure AI channels (required before first use)
   • After launch, open https://127.0.0.1:8080/ (or https://localhost:8080/; replace 8080 with server.port in config.yaml) and accept the self-signed certificate warning once. If you used ./run.sh --http, use http:// instead.
   • Go to System Settings → Basic Settings → AI Channel Configuration, add or edit a channel, then fill in provider, Base URL, API key, model, and token limits. Click Save changes. The left channel list supports setting a default, copy, delete, and bulk probe.

     ai:
       default_channel: openai-main
       channels:
         openai-main:
           name: OpenAI Main
           provider: openai_compatible
           api_key: "${OPENAI_API_KEY}"
           base_url: "https://api.openai.com/v1"  # or https://api.deepseek.com/v1
           model: "gpt-4o"  # or deepse