CyberStrikeAI Documentation

CyberStrikeAI is an AI-native cybersecurity system designed for authorized security operations. It integrates planning, execution, human oversight, and evidence into an auditable workspace.

Key capabilities include:

• Agentic Execution: Translates natural language into governed security actions using Eino orchestration (supporting Single-agent, Deep, Plan-Execute, and Supervisor modes).
• Tooling & Knowledge: Supports 100+ curated security tools via YAML recipes and MCP (Model Context Protocol) integration (HTTP, stdio, SSE, etc.).
• Governance: Features Human-in-the-loop approval modes, RBAC, and full audit logging.
• Security Operations: Includes Asset Management, Vulnerability Management, Project/Attack Chain modeling, and WebShell/C2 capabilities for authorized testing.

To optimize performance and context window usage, CyberStrikeAI implements specific data handling and preprocessing rules for vision tasks:

• Data Privacy & Context: Raw image bytes are sent only to the vision model call. Agent history stores text summaries rather than raw bytes to reduce context size and prevent accidental image propagation.
• Preprocessing: The runtime automatically resizes and recompress images if they exceed defined limits. Preprocessing is skipped if the image is already within the following constraints:
  • max_image_bytes
  • max_dimension
  • jpeg_quality
  • max_payload_bytes

CyberStrikeAI uses two distinct role systems that do not overlap:

1. Platform role (RBAC Role): Managed via Platform permissions. These control access to features, HTTP APIs, resource queries, and system capabilities.
2. AI testing role (Agent Role): Managed via roles/*.yaml. These control Agent prompts, methodologies, and the specific tools available to an Agent.

Note: Selecting an AI testing role does not grant platform permissions, and granting RBAC permissions does not change the Agent's prompt.

CyberStrikeAI is a single Go Web application that utilizes a static frontend and SQLite for persistence. The system architecture integrates Agent orchestration, Model Context Protocol (MCP) tooling, workflow graphs, and knowledge retrieval. It also supports optional C2 (Command and Control) and WebShell subsystems.

Core Components:

• Gin Router & Handlers: Manages incoming Web, Robot, and API requests.
• Agent / Multi-Agent System: Orchestrates model interactions and tool usage.
• MCP Server: Provides access to built-in, YAML-defined, skill-based, or external MCP tools.
• Knowledge Retrieval: Provides context to agents.
• Workflow Runtime: Executes defined workflow graphs.
• C2 & WebShell: Specialized subsystems for security operations.
• Audit / Monitor: Handles platform management logging and tool execution monitoring.

To get started with a local evaluation of CyberStrikeAI, follow this sequence of tasks:

1. Deployment: Follow the Deployment guide to set up the environment.
2. Configuration: Refer to the Configuration guide to set up your parameters.
3. Troubleshooting: If issues arise, consult the Troubleshooting guide.

To ensure that files within a skill package's references/ directory are correctly identified and accessible, perform the following three tests within an authorized environment:

1. List API Check: Call GET /api/skills/cyberstrike-eino-demo. The response's package_files array must include references/citations.md.
2. Resource Path Check: Call GET /api/skills/cyberstrike-eino-demo?resource_path=references/citations.md. The response should return the actual content of the file.
3. Filesystem Tool Check: In a multi-agent setup with eino_skills.filesystem_tools enabled, attempt to read the file using its relative path.

Use the upgrade.sh script to update the project. The script backs up your config.yaml and data/ directory before pulling the latest code from GitHub.

Upgrade Steps:

1. Enable the script: chmod +x upgrade.sh.
2. Run the upgrade: ./upgrade.sh.

Useful Flags:

• --tag vX.Y.Z: Upgrade to a specific version.
• --no-venv: Do not recreate the Python virtual environment.
• --yes: Automatically accept prompts.

Recommended Command: chmod +x upgrade.sh && ./upgrade.sh --yes

Note: If you encounter GitHub API rate limits, set your token first: export GITHUB_TOKEN="...".