Skip to main content
CyberStrike is the first open-source AI agent built for offensive security. Install it, connect your LLM provider, and run structured penetration tests autonomously — from reconnaissance through exploitation and reporting.

Quick Start

Install CyberStrike and run your first pentest in under 5 minutes.

Agents

Explore 13+ specialized security agents for web, mobile, cloud, and network testing.

Configuration

Configure LLM providers, permissions, keybinds, and project settings.

CLI Reference

Full reference for every command, flag, and option in the CyberStrike CLI.

​
How it works

CyberStrike transforms any LLM into an offensive security specialist by injecting domain-specific context — OWASP testing methodology, vulnerability patterns, and tool orchestration logic — into every interaction.
1

Install CyberStrike

Install globally via npm, bun, Homebrew, or Scoop:
npm i -g @cyberstrike-io/cyberstrike@latest
2

Connect your LLM provider

On first launch, CyberStrike prompts for your LLM provider and API key. It supports 15+ providers including Anthropic, OpenAI, Google, Amazon Bedrock, and Ollama for fully offline use.
3

Choose your agent and target

Select a specialized agent — web-application, cloud-security, mobile-application, or internal-network — and describe your target.
4

Review your findings

CyberStrike runs reconnaissance, discovers vulnerabilities, and generates structured reports mapped to OWASP standards. All findings include evidence and reproducible steps.

​
What’s included

Bolt remote execution

Deploy Bolt on remote servers and control them from your local terminal over MCP with Ed25519 authentication.

MCP ecosystem

Connect 176+ additional security tools via 5 specialized MCP servers covering browser, cloud, GitHub, CVE, and OSINT testing.

Plugin SDK

Build custom agents, tools, and hooks using the @cyberstrike-io/plugin SDK.

Proxy testing

8 specialized proxy tester agents that intercept HTTP traffic and test for IDOR, injection, auth bypass, SSRF, and more.
CyberStrike is for authorized security testing only. Always obtain written permission before testing any system you do not own. See the Code of Conduct for the project’s ethical use policy.

Build docs developers (and LLMs) love

Get started for freeTalk to us