Cyberstrike
AI-powered offensive security agent with 7,300+ actionable security skills. Autonomous pentesting powered by MITRE ATT&CK (2,000+ Atomic tests), CIS Benchmarks (1,500+ controls), OWASP, NIST. Lazy-loading, zero context pollution. Your AI red team.
Last verified:
What is Cyberstrike?
Cyberstrike is an autonomous AI agent for penetration testing and offensive security research. It transforms any LLM into an offensive security specialist by injecting domain-specific context including OWASP testing methodology, vulnerability patterns, and tool orchestration logic. The tool runs from your terminal with a CLI and TUI interface, handling reconnaissance, exploitation, and reporting autonomously after you point it at a target.
Key features include 13+ specialized security agents for web applications, cloud security (AWS/Azure/GCP), mobile applications (Android/iOS), and internal networks (Active Directory, Kerberos). It integrates 100+ security tools like Nmap, Nuclei, and SQLMap, supports 15+ LLM providers including Anthropic, OpenAI, Google Gemini, and Ollama for offline use, and generates professional pentest reports in PDF, Markdown, or HTML with severity ratings, evidence, and remediation guidance. The tool uses a BYOK (Bring Your Own Key) model where you supply your own API keys.
Cyberstrike is designed for security professionals including penetration testers, red team members, security engineers, bug bounty hunters, and security consultants. It's also suitable for CISOs and organizations needing authorized security testing, researchers, and educators. The tool is open source under AGPL-3.0 license, making it free for personal use, research, and education, with commercial licensing available for enterprises.
Cyberstrike pricing
Pricing model: Freemium
Cyberstrike is open source under AGPL-3.0 license and is free for personal use, research, and education. No subscription fee for the tool itself. You must bring your own API keys (BYOK) from LLM providers - OpenRouter and Google Gemini have free tiers, while Anthropic and OpenAI require paid API keys. Commercial licensing is available for enterprises via [email protected]. The tool has no vendor lock-in and you control your own API costs by choosing providers and monitoring usage.
Cyberstrike pros
- Open source under AGPL-3.0 license with full transparency
- BYOK model gives you full control over API costs and data privacy
- 13+ specialized agents for web, cloud, mobile, and network testing
- Supports 15+ LLM providers including offline local models via Ollama
- 100+ security tools integrated including Nmap, Nuclei, SQLMap
- Generates professional reports in PDF, Markdown, and HTML formats
- Both CLI for scripting and TUI for interactive sessions available
- Real-time streaming of results including tool calls and findings
- OWASP Top 10 and WSTG methodology built into web-application agent
- MITRE ATT&CK powered with 2,000+ Atomic tests and 7,300+ security skills
- No vendor lock-in - switch between AI models mid-session seamlessly
- Fully extensible with Plugin SDK for custom tools and agents
- Bolt remote execution for running tools on remote servers with authentication
- 176+ additional security tools via 5 specialized MCP servers
- Self-hostable and air-gapped capable for compliance requirements
Cyberstrike cons
- Requires your own API keys from paid LLM providers (Anthropic, OpenAI)
- Only works for authorized security testing - legal restrictions apply
- Docker image not yet available - must use npm or curl installation
- Bun and Homebrew package support not yet available
- Node.js 18.0+ required minimum (20.0+ recommended)
- Minimum 4GB RAM required (8GB recommended) for proper operation
- Learning curve for terminal-based interface and CLI commands
- API costs can add up depending on LLM provider and test scope
Frequently asked questions about Cyberstrike
What is Cyberstrike?
Cyberstrike is the first open-source AI agent built for offensive security and penetration testing. It transforms any LLM into an offensive security specialist by injecting domain-specific context including OWASP testing methodology, vulnerability patterns, and tool orchestration logic. You install it, connect your LLM provider, and run structured penetration tests autonomously from reconnaissance through exploitation and reporting.
Is Cyberstrike free to use?
Yes, Cyberstrike is free for personal use, research, and education under the AGPL-3.0 open source license. However, you need to bring your own API keys from LLM providers. Some providers like OpenRouter, Google Gemini, and Ollama (local) have free tiers, while Anthropic and OpenAI require paid API keys. Commercial licensing is available for enterprises.
What LLM providers does Cyberstrike support?
Cyberstrike supports 15+ LLM providers including Anthropic (Claude), OpenAI (GPT-4), Google Gemini, Amazon Bedrock, and Ollama for fully offline use. On first launch, you select your provider and enter your API key. You can switch between models mid-session, and different models excel at different tasks.
What specialized agents are available?
Cyberstrike includes 13+ specialized agents: the cyberstrike agent for general recon and full-scope testing, web-application agent for OWASP Top 10 and WSTG methodology, cloud-security agent for AWS/Azure/GCP misconfigurations, mobile-application agent for Android/iOS with Frida and MASTG, and internal-network agent for Active Directory, Kerberos, and lateral movement testing.
How do I install Cyberstrike?
Install Cyberstrike globally via npm with the command 'npm i -g @cyberstrike-io/cyberstrike@latest'. It also works on macOS, Linux, and Windows with WSL via curl or PowerShell scripts. On first launch, run 'cyberstrike' in your terminal and it opens a TUI that walks you through selecting an LLM provider and entering your API key.
What security tools are integrated?
Cyberstrike integrates 100+ security tools including Nmap for network scanning, Nuclei for automated vulnerability scanning, SQLMap for SQL injection testing, and Frida for mobile application testing. It also connects to 176+ additional security tools via 5 specialized MCP servers covering browser, cloud, GitHub, CVE, and OSINT testing.
What reports does Cyberstrike generate?
Cyberstrike generates professional pentest reports in PDF, Markdown, or HTML formats. Findings are formatted with severity ratings, evidence, and remediation guidance. Reports are mapped to OWASP standards and include reproducible steps for discovered vulnerabilities.
Can I use Cyberstrike offline?
Yes, you can use Cyberstrike fully offline by connecting it to Ollama with local LLM models. This is ideal for air-gapped environments and compliance requirements. Many organizations self-host with local models to keep client data private and meet regulatory requirements.
Is Cyberstrike safe to use legally?
Cyberstrike is for authorized security testing only. You must always obtain written permission before testing any system you do not own. The project has a Code of Conduct with an ethical use policy. Using it on systems without authorization is illegal and violates the tool's terms of use.
How do I customize Cyberstrike for my methodology?
Cyberstrike is fully extensible with AGPL-3.0 licensing. You can fork it, modify it, add your own tools using the @cyberstrike-io/plugin SDK for building custom agents, tools, and hooks. Create a cyberstrike.json file in your project directory to set default options like model and agent. PRs are welcome for community contributions.