CyberStrikeus/CyberStrike

What it is

CyberStrike (AGPL-3.0-only, commercial licence via contact@cyberstrike.io) is a terminal agent for authorized penetration testing. It wraps an LLM you already pay for and adds security methodology, tool orchestration and a proxy browser. The page claims 13+ agents, 7,600+ Ed25519-signed skill files, 56+ built-in tools and 176+ MCP tools. It lists post-exploitation tooling across several platforms, driven by the agent rather than fixed scripts.

How it works

• Proxy testing: the built-in Chromium browser (/hackbrowser) sends all captured traffic to an orchestrator. Eight sub-testers run in parallel against it, sharing a session context of credentials, inferred role hierarchy and reachable endpoints. Capture is either manual or autonomous (you supply several accounts and a scope, and it crawls as each user).
• Confirmation: each tester sends a baseline request, then the attack, then compares responses. A finding is reported only on a measurable, reproducible difference. Duplicates (same endpoint and attack vector) are suppressed per session.
• Skills: loaded lazily, one at a time, and tagged with WSTG IDs, CIS control IDs and chain relationships.
• Bolt: a remote MCP tool server (for example nmap, nuclei, ffuf, sqlmap, burp, zap) that you deploy on a VPS, Docker, Kubernetes or a Kali image. The TUI pairs with it by Ed25519 key over HTTPS and streams results back.

Preconditions / Affected

You need an LLM provider key or subscription (23 bundled SDK providers, 150+ via models.dev). For no data leaving the machine, the page says to use Ollama or LM Studio. The page's claim that inference stays on your hardware holds only with local models. Scope is limited with --scope, which derives the registered domain, so --scope api.example.com does not cover other.com. Repeat the flag for multi-domain targets.

What to do

Install and start:

npm i -g @cyberstrike-io/cyberstrike@latest && cyberstrike

Other installers are bun/pnpm/yarn, brew install CyberStrikeus/tap/cyberstrike, scoop install cyberstrike, and curl -fsSL https://cyberstrike.io/install.sh | bash.

Remote Web UI, as documented:

export CYBERSTRIKE_SERVER_PASSWORD=your-secure-password
cyberstrike web
# In another terminal:
cloudflared tunnel --url http://localhost:4096 run your-tunnel

The server binds to localhost:4096 and the tunnel is outbound-only.

Caveats

• Per the page, requests on localhost skip auth, and remote requests are recognised by the X-Forwarded-For and CF-Connecting-IP headers and then require Basic Auth. Set a strong password and test this behaviour before exposing the tunnel.
• The hosted UI at app.cyberstrike.io is described as a static page with no backend. You can self-host packages/app/dist/ instead.
• The page gives no benchmarks, false-positive rates or independent validation of the "no separate API costs" and "autonomous" claims.
• Use is restricted to authorized testing under the project's ethical use policy.