Traditional penetration testing grinds to a halt under the weight of manual execution and fragmented toolchains. Security engineers often spend more time stitching together scripts and managing tool output than on high-level strategy and analysis. The promise of AI isn't just assistance; it's a fundamental shift towards scaling offensive security beyond human bandwidth. But building a system where intent genuinely becomes governed execution and every operation improves the next is an architectural challenge often glossed over.

Enter CyberStrikeAI, an AI-native cybersecurity platform engineered in Go, designed from the ground up to unify the entire security operations lifecycle. It offers an auditable workspace that connects planning, execution, human oversight, evidence, and replay, providing a comprehensive solution for authorized security testing. Let's be clear from the outset: this is a professional platform for authorized security operations. Its high-risk capabilities like WebShell and C2 are intended strictly for systems you own or are explicitly cleared to test. Review the security model and hardening guide before deploying in any shared or production environment.

The AI-Native Cybersecurity Platform Architecture

At its core, CyberStrikeAI is a Go-built powerhouse leveraging several key architectural components to deliver its "system of action" for cybersecurity:

• Eino-powered agents: These form the intelligence layer, translating natural-language intent into actionable security operations.
• MCP-native tools: Providing a vast arsenal of over 100 curated security tools, integrated seamlessly.
• RAG knowledge: A robust Retrieval-Augmented Generation system for contextual awareness and intelligent responses.
• Visual workflows: For designing, executing, and monitoring complex attack chains.
• Attack-chain modeling and analysis: To understand and visualize multi-stage engagements.

The choice of Go for the backend signals a commitment to performance, concurrency, and reliability, essential traits for a system that needs to execute complex, often blocking, security tools and manage numerous concurrent tasks.

Agentic Execution and Orchestration That Works

The real leap forward with CyberStrikeAI lies in its agentic execution capabilities. Forget crafting complex, bespoke scripts for every penetration testing scenario. The platform translates natural-language intent directly into governed, auditable security actions. This dramatically reduces the cognitive load and accelerates the initial reconnaissance and exploitation phases.

Eino orchestration is at the heart of this intelligence. It supports a range of execution strategies:

• Single-agent execution: For straightforward tasks.
• Deep modes: For focused, in-depth analysis.
• Plan-Execute modes: Where agents autonomously plan a series of steps and then execute them.
• Supervisor multi-agent modes: For complex, collaborative engagements where multiple agents coordinate under a central supervisor.

These strategies empower security teams to define intricate security scenarios. Crucially, these operations are not black boxes. Security workflows are built as transparent graph workflows, combining agents, tools, conditions, approvals, and outputs into reusable, auditable flows. This transforms ad-hoc scripting into programmatic, versionable, and auditable security logic. Furthermore, role-based testing provides focused prompts and tool policies tailored to common security scenarios, ensuring appropriate tool usage and reducing misconfigurations.

Resilient Tooling, Comprehensive Knowledge, and Unyielding Governance

A security automation platform is only as good as its tool integration and its ability to manage external process execution. CyberStrikeAI shines here with 100+ curated YAML tool recipes covering the entire kill chain, from network scanners like nmap and masscan to exploitation frameworks like metasploit and post-exploitation tools like mimikatz. The MCP (Multi-Component Platform) integration supports various protocols, including HTTP, stdio, SSE, external federation, and dynamic tool discovery, making it highly extensible.

One of CyberStrikeAI's most critical architectural achievements lies in its resilient tool execution. This isn't a trivial problem. Running blocking, potentially long-lived external processes (like a lengthy sqlmap scan or a nuclei run) without impacting the core system demands robust engineering. CyberStrikeAI addresses this by:

• Running blocking MCP/tool calls in dedicated workers.
• Employing bounded agent waits to prevent deadlocks.
• Supporting resumable execution_id polling for long-running tasks.
• Implementing cancellation mechanisms.
• Integrating per-server circuit breakers and concurrency limits to prevent resource exhaustion.
• Enforcing unified output caps to manage data volume.

This sophisticated execution model is how you prevent a rogue nmap scan from taking down your entire pentest environment or an agent hanging indefinitely, a common pain point in less mature automation systems.

Beyond execution, the platform's knowledge base is equally robust, combining query rewriting, vector retrieval, reranking, and result post-processing for intelligent contextual analysis. It even features vision analysis using a separate vision model for processing screenshots, captchas, and UI elements, retaining text summaries for efficient context.

Human-in-the-Loop and Uncompromising Auditability

The promise of AI in security must come with robust governance. CyberStrikeAI addresses concerns about autonomous actions by embedding extensive human-in-the-loop features:

• Approval modes: Requiring human consent before high-risk actions.
• Tool allowlists: Restricting agents to approved tools.
• Audit-agent review: An agent dedicated to scrutinizing other agents' actions.
• Traceable decisions: Ensuring every action can be linked back to intent and approval.

Platform RBAC (Role-Based Access Control) further tightens access control, supporting multiple users, system and custom roles, scoped permissions, ownership, and explicit assignments. Security and audit logs, SQLite persistence, and comprehensive operational evidence retention are standard. The platform's result governance stores the exact capped tool result seen by the agent, protecting resume paths from oversized historical output and providing UI safeguards for large detail views, ensuring both integrity and manageability of forensic data.

Your Security Operations Playbook

CyberStrikeAI goes beyond just running tools; it provides a comprehensive operational framework:

• Conversation management: For organizing and pinning security engagement dialogues.
• Projects and attack chains: Connect cross-session facts, risk scoring, graph views, and step-by-step replay for forensic analysis and reporting.
• Asset management: Normalizes and deduplicates domains, IP addresses, ports, and services. It supports XLSX/CSV import/export, advanced filters, saved views, ownership, business metadata, cross-page bulk maintenance, and duplicate merging. Critically, it tracks scan coverage, linked vulnerabilities, and risk state.
• Vulnerability management: Provides severity classification, lifecycle tracking, filtering, and statistics.
• Batch tasks: Queued execution, editing, status tracking, and retained results for large-scale operations.
• Chatbot integrations: Connecting with Personal WeChat, WeCom, DingTalk, Lark, Telegram, Slack, Discord, and QQ Bot for flexible communication.

The platform also includes powerful, yet carefully segregated, high-risk capabilities like WebShell management (virtual terminal, file operations, AI-assisted workflows) and a built-in C2 framework (listeners, encrypted beacons, sessions, task queues, payload helpers, live events). These tools, while incredibly potent for red teaming, underscore the absolute necessity of explicit authorization.

Getting Started: Deployment and Configuration

CyberStrikeAI aims for a streamlined developer and operator experience.

Prerequisites:

• Go 1.25+
• Python 3.10+

One-Command Deployment:

bash
git clone https://github.com/Ed1s0nZ/CyberStrikeAI.git
cd CyberStrikeAI
chmod +x run.sh && ./run.sh

The run.sh script automates environmental checks, Python virtual environment creation, dependency installation, project build, and server startup. Upon successful launch, you'll see a ● ONLINE message with the Web UI URL. The default HTTPS mode uses a self-signed certificate, which your browser will prompt you to accept once.

First-Time Configuration: AI Channels After launching, navigate to the Web UI (e.g., https://127.0.0.1:8080/). You'll need to configure your AI channels under System Settings > Basic Settings > AI Channel Configuration. An example configuration snippet looks like this:

yaml
ai:
  default_channel: openai-main
  channels:
    openai-main:
      name: OpenAI Main
      provider: openai_compatible
      api_key: "${OPENAI_API_KEY}"
      base_url: "https://api.openai.com/v1" # or https://api.deepseek.com/v1
      model: "gpt-4o" # or deepseek-chat, qwen3-max, etc.
      max_total_tokens: 120000
      max_completion_tokens: 16384

This configuration can also be done by editing config.yaml directly before launching. The ai.default_channel is used for new conversations and tasks that do not explicitly select a channel.

Installing Security Tools: While CyberStrikeAI ships with tool definitions, the actual tools need to be installed on your system. Common installation methods include Homebrew for macOS or apt for Linux distributions:

bash
# macOS (Homebrew)
brew install nmap masscan sqlmap nikto gobuster ffuf hydra hashcat nuclei subfinder

# Linux (Kali / Debian / Ubuntu)
sudo apt update
sudo apt install -y nmap masscan sqlmap nikto gobuster hydra hashcat john binwalk
# For ffuf/nuclei/subfinder, refer to their upstream docs or go install

Upgrades: Upgrading is designed to be straightforward with a one-click script:

bash
chmod +x upgrade.sh && ./upgrade.sh --yes

The upgrade script will back up your config.yaml and data/ directory, fetch the latest code from GitHub Releases, update your config.yaml's version, and restart the server. Local tools/, roles/, and skills/ directories are always preserved. Remember to review target release notes for any configuration or database changes, as backups are always recommended.

Practical Applications: From Port Scans to Attack Chain Playbooks

CyberStrikeAI empowers security professionals to execute a wide array of tasks, from basic scans to complex, multi-stage attack simulations.

Basic Usage Examples:

• "Scan open ports on 192.168.1.1"
• "Perform a comprehensive port scan on 192.168.1.1 focusing on 80,443,22"
• "Check if https://example.com/page?id=1 is vulnerable to SQL injection"
• "Scan https://example.com for hidden directories and outdated software"
• "Enumerate subdomains for example.com, then run nuclei against the results"

These simple natural language prompts demonstrate the agent's ability to select and execute the appropriate tools (e.g., nmap, sqlmap, gobuster, subfinder, nuclei) without manual intervention.

Advanced Playbooks: The real power emerges with advanced playbooks:

• "Load the recon-engagement template, run amass/subfinder, then brute-force dirs on every live host." This orchestrates multiple reconnaissance tools and then proceeds to web enumeration, showcasing chained execution.
• "Use external Burp-based MCP server for authenticated traffic replay, then pass findings back for graphing." This highlights enterprise-grade integration with existing security proxies for authenticated vulnerability assessment.
• "Compress the 5 MB nuclei report, summarize critical CVEs, and attach the artifact to the conversation." Here, AI assists not just with execution but with post-processing, summarization, and artifact management, streamlining reporting.
• "Build an attack chain for the latest engagement and export the node list with severity >= high." This exemplifies the platform's ability to model, visualize, and report on complex attack flows.

CyberStrikeAI isn't just another security tool. It's a statement about the future of offensive security: automated, intelligent, and above all, governed. For organizations serious about scaling their security posture and moving beyond manual drudgery, this platform offers a potent glimpse into what's possible when AI works in concert with human expertise.

It bears repeating: CyberStrikeAI is for authorized security operations only. Ensure explicit authorization for any system you test. Responsibility for misuse lies solely with the user.

References

• https://github.com/Ed1s0nZ/CyberStrikeAI