# CyberStrike — Full Documentation for AI Models

> CyberStrike is an open-source, autonomous AI agent for offensive security
> testing. Licensed AGPL-3.0, fully self-hosted with bring-your-own-key (BYOK).

## What Is CyberStrike

CyberStrike is a CLI-based autonomous agent that performs penetration testing
and security research. It connects to AI providers, receives a target or
objective, then autonomously plans and executes security assessments using
7,600+ built-in security skills and 176+ MCP (Model Context Protocol) tools.

Unlike traditional scanners that run fixed checks, CyberStrike reasons about
targets, chains findings, adapts its approach based on results, and produces
human-readable reports with remediation guidance.

## Key Capabilities

### AI Provider Support (150+ Providers, 5,300+ Models)

CyberStrike supports 150+ AI providers through a unified interface:

- **Commercial APIs**: OpenAI (GPT-4o, o1, o3), Anthropic (Claude Opus, Sonnet, Haiku), Google (Gemini 2.5 Pro/Flash), DeepSeek (V3, R1)
- **Self-Hosted**: Ollama, vLLM, LM Studio, LocalAI, text-generation-webui
- **Cloud Platforms**: AWS Bedrock, Azure OpenAI, Google Vertex AI, Together AI, Fireworks AI, Groq, Cerebras
- **Routing**: OpenRouter, LiteLLM Proxy

Any model accessible through an OpenAI-compatible API works automatically.
Over 5,300 models are available across all supported providers.

### Security Skills (7,600+)

Skills are structured, versioned task definitions that tell the agent what to
do and how to do it. Categories include:

- **Reconnaissance**: subdomain enumeration, port scanning, service fingerprinting, OSINT, DNS analysis
- **Web Application Testing**: SQL injection, XSS, SSRF, IDOR, authentication bypass, API fuzzing, JWT attacks
- **Network Security**: protocol analysis, MITM detection, firewall rule analysis, VPN assessment
- **Cloud Security**: AWS/Azure/GCP misconfiguration, IAM analysis, S3 bucket enumeration, metadata service attacks
- **Mobile Security**: APK analysis, API endpoint extraction, certificate pinning bypass
- **Cryptography**: TLS/SSL assessment, cipher suite analysis, certificate chain validation
- **Social Engineering**: phishing infrastructure analysis, pretexting frameworks
- **Post-Exploitation**: privilege escalation, lateral movement, persistence mechanisms, data exfiltration paths

### MCP Tools (176+)

Model Context Protocol tools provide the agent with concrete capabilities:

- **HackBrowser**: Headless browser for authenticated testing, JavaScript-rendered content, form submission
- **Cloud Audit**: Multi-cloud configuration assessment (AWS, Azure, GCP)
- **GitHub Security**: Repository secret scanning, dependency analysis, CI/CD pipeline review
- **CVE Database**: Real-time vulnerability lookup with exploit availability data
- **OSINT Tools**: Domain intelligence, IP geolocation, WHOIS, DNS history
- **AI Knowledge Graph**: Connects findings across assessments for pattern recognition

### HackBrowser

HackBrowser is CyberStrike's built-in headless browser, purpose-built for
security testing. It renders JavaScript, handles authentication flows,
manages cookies/sessions, and captures network traffic — giving the AI agent
the same browsing capabilities a human tester would have.

### Bolt Server (Distributed Scanning)

Bolt Server enables distributed scanning across multiple machines. Deploy
scanning nodes that connect to a central coordinator, allowing parallel
target assessment at scale. Nodes auto-discover each other, share findings
in real time, and deduplicate results.

### Multi-Agent Cluster

CyberStrike supports multi-agent orchestration where a lead agent coordinates
specialized sub-agents for complex engagements. Each sub-agent focuses on a
specific domain (web, network, cloud, etc.) while the orchestrator manages
task allocation, deconfliction, and finding correlation.

### Agentic Validation Pipeline

A three-stage validation pipeline ensures finding accuracy:
1. **Baseline** — capture normal application behavior
2. **Attack** — execute the exploit or payload
3. **Compare** — diff results to confirm exploitability

Validated findings automatically generate proof-of-concept (PoC) code.

### Web UI Dashboard

A browser-based dashboard provides real-time visibility into agent operations:
- Terminal output with full command history
- Chat interface for interactive agent guidance
- Findings panel with severity classification
- Agent activity log with decision reasoning
- Statistics and progress tracking

## Architecture

CyberStrike follows a modular architecture:

```
┌─────────────────────────────────────┐
│           CLI / Web UI              │
├─────────────────────────────────────┤
│         Agent Orchestrator          │
│  (planning, reasoning, execution)   │
├──────────┬──────────┬───────────────┤
│ AI       │ Skills   │ MCP Tools     │
│ Providers│ Engine   │ Runtime       │
│ (150+)   │ (7600+)  │ (176+)        │
├──────────┴──────────┴───────────────┤
│    Bolt Server (distributed)        │
├─────────────────────────────────────┤
│        Target Interface             │
│  (network, web, cloud, mobile)      │
└─────────────────────────────────────┘
```

The agent operates in a loop:
1. **Observe** — gather information about the target
2. **Orient** — analyze findings, identify attack surface
3. **Decide** — select appropriate skills and tools
4. **Act** — execute the chosen approach
5. **Validate** — confirm exploitability via agentic validation
6. **Report** — document findings with evidence and remediation

## Installation

### Linux / macOS (one-line)

```bash
curl -fsSL https://cyberstrike.io/install.sh | bash
```

### Windows (PowerShell)

```powershell
irm https://cyberstrike.io/install.ps1 | iex
```

### Requirements

- Linux, macOS, or Windows with Docker
- API key for at least one supported AI provider
- Network access to targets (for active testing)

### Configuration

After installation, configure your AI provider:

```bash
cyberstrike config set provider openai
cyberstrike config set api-key sk-...
```

Or use environment variables:

```bash
export CYBERSTRIKE_PROVIDER=anthropic
export CYBERSTRIKE_API_KEY=sk-ant-...
```

## Usage Examples

### Basic Web Application Scan

```bash
cyberstrike scan --target https://example.com --scope web
```

### Cloud Security Assessment

```bash
cyberstrike scan --target aws --profile production --scope cloud
```

### Custom Skill Execution

```bash
cyberstrike run --skill "sql-injection-detection" --target https://example.com/api
```

### Autonomous Mode

```bash
cyberstrike auto --target example.com --objective "find critical vulnerabilities"
```

### Distributed Scan with Bolt Server

```bash
cyberstrike bolt start --nodes 4 --target example.com
```

## Comparison with Alternatives

| Feature | CyberStrike | Traditional Scanners | Manual Pentesting |
|---------|-------------|---------------------|-------------------|
| AI-Driven | Yes (150+ providers) | No | No |
| Autonomous Reasoning | Yes | No | Yes (human) |
| Skills | 7,600+ | Fixed checks | Variable |
| MCP Tools | 176+ | Built-in only | Manual tools |
| Multi-Agent | Yes | No | Team-based |
| Validation Pipeline | Automated PoC | Manual verify | Manual verify |
| Self-Hosted | Yes | Varies | N/A |
| BYOK | Yes | N/A | N/A |
| Open Source | Yes (AGPL-3.0) | Rarely | N/A |
| Cost | Free + API costs | $$$-$$$$ | $$$$$ |
| Adaptability | Real-time | None | Human judgment |

## Licensing

CyberStrike is licensed under AGPL-3.0. This means:
- Free to use, modify, and distribute
- Network use constitutes distribution (source must be shared)
- Derivative works must use the same license
- Commercial use is permitted

## Links

- Website: https://cyberstrike.io
- Documentation: https://docs.cyberstrike.io
- GitHub: https://github.com/CyberStrikeus/CyberStrike
- Blog: https://cyberstrike.io/blog
- Install Script: https://cyberstrike.io/install.sh

## Contact

- General: contact@cyberstrike.io
- Security: security@cyberstrike.io
- Twitter/X: @cyberstrike_io