Strix is an open-source, AI-powered penetration testing tool that orchestrates multiple LLM-driven agents to autonomously discover and validate security vulnerabilities in web applications, APIs, source code, and infrastructure. The system operates as a CLI application with three interface surfaces: a headless/non-interactive mode for CI/CD pipelines, a feature-rich Go Bubble Tea TUI for interactive scanning, and a local React web viewer for reviewing results. Scans run inside Docker sandboxes with a Caido interception proxy sidecar, allowing agents to execute shell commands, browse applications, modify requests, and apply patches. The architecture follows a multi-agent coordination pattern where a root agent delegates tasks to child agents, tracks coverage, manages budgets, and produces comprehensive reports including CVSS-scored vulnerabilities, proof-of-concept exploits, and fix recommendations. The codebase demonstrates strong engineering practices with extensive test coverage, atomic file operations, output bounding, MCP tool integration, and a sophisticated IPC protocol between the Python backend and Go TUI. Key features include: multi-agent orchestration with parent/child messaging and budget enforcement; Docker sandboxed execution with Caido proxy integration; support for multiple LLM providers (OpenAI, Anthropic, LiteLLM, Bedrock, etc.); MCP (Model Context Protocol) tool integration; SARIF and PDF report generation; cloud platform integration for managed scans; and a local web viewer with live transcript and vulnerability triage. The repository is primarily an application but includes data-oriented components like LLM cost tracking, coverage ledgers, and vulnerability deduplication using LLM-based comparison.
CyberStrikeAI is a production-grade AI-native penetration testing platform written in Go, with a Gin web server, SQLite persistence, and a modular multi-agent orchestration layer built on CloudWeGo's Eino ADK framework. It provides REST and SSE endpoints for real-time agent interaction, WebSocket terminals, and a browser-based SPA frontend. The system integrates over 100 security tools (nmap, sqlmap, Metasploit, etc.) via MCP (Model Context Protocol) definitions, and includes a full C2 (Command & Control) framework with encrypted beacons, TCP/HTTP/WebSocket listeners, and session management. It also supports human-in-the-loop (HITL) approval, RBAC, audit logging, knowledge base with vector retrieval, workflow automation (DAG-based), and multi-platform robot integrations (WeChat, DingTalk, Slack, Telegram, etc.). External plugins exist for Burp Suite and Chrome DevTools to capture HTTP traffic for live analysis. Architecturally, the system is a monolith with clear module boundaries: the Eino agent runtime handles single-agent, deep (multi-agent), plan-execute, and supervisor modes; the MCP layer manages tool registration, execution tracking, and external MCP client connections; the workflow engine compiles YAML-defined graphs into Eino subgraphs with conditional branching and HITL wait nodes; the C2 layer manages beacon check-ins, task queuing, and result ingestion; and the security layer enforces RBAC, rate limiting, and safe shell execution. Key entry points include `cmd/server/main.go`, `internal/handler/eino_single_agent.go`, `internal/handler/multi_agent.go`, `internal/handler/workflow.go`, `internal/handler/c2.go`, and `internal/handler/asset.go`. Data flows center on conversation-driven penetration testing: a user sends a message via the REST API, the Eino agent runtime processes it through a chain of middleware (system message normalization, tool pair reconciliation, orphan pruning, summarization, HITL), executes tools (MCP calls, C2 commands, shell commands), and streams results back via SSE. All actions are recorded in SQLite for audit, conversation history, and attack chain reconstruction. The knowledge base uses embeddings and reranking for retrieval. External dependencies include LLM providers (OpenAI, Anthropic, DeepSeek), MCP servers, FOFA/Shodan/Quake APIs, and multiple IM platforms.