CyberStrikeAI is a production-grade AI-native penetration testing platform written in Go, with a Gin web server, SQLite persistence, and a modular multi-agent orchestration layer built on CloudWeGo's Eino ADK framework. It provides REST and SSE endpoints for real-time agent interaction, WebSocket terminals, and a browser-based SPA frontend. The system integrates over 100 security tools (nmap, sqlmap, Metasploit, etc.) via MCP (Model Context Protocol) definitions, and includes a full C2 (Command & Control) framework with encrypted beacons, TCP/HTTP/WebSocket listeners, and session management. It also supports human-in-the-loop (HITL) approval, RBAC, audit logging, knowledge base with vector retrieval, workflow automation (DAG-based), and multi-platform robot integrations (WeChat, DingTalk, Slack, Telegram, etc.). External plugins exist for Burp Suite and Chrome DevTools to capture HTTP traffic for live analysis. Architecturally, the system is a monolith with clear module boundaries: the Eino agent runtime handles single-agent, deep (multi-agent), plan-execute, and supervisor modes; the MCP layer manages tool registration, execution tracking, and external MCP client connections; the workflow engine compiles YAML-defined graphs into Eino subgraphs with conditional branching and HITL wait nodes; the C2 layer manages beacon check-ins, task queuing, and result ingestion; and the security layer enforces RBAC, rate limiting, and safe shell execution. Key entry points include `cmd/server/main.go`, `internal/handler/eino_single_agent.go`, `internal/handler/multi_agent.go`, `internal/handler/workflow.go`, `internal/handler/c2.go`, and `internal/handler/asset.go`. Data flows center on conversation-driven penetration testing: a user sends a message via the REST API, the Eino agent runtime processes it through a chain of middleware (system message normalization, tool pair reconciliation, orphan pruning, summarization, HITL), executes tools (MCP calls, C2 commands, shell commands), and streams results back via SSE. All actions are recorded in SQLite for audit, conversation history, and attack chain reconstruction. The knowledge base uses embeddings and reranking for retrieval. External dependencies include LLM providers (OpenAI, Anthropic, DeepSeek), MCP servers, FOFA/Shodan/Quake APIs, and multiple IM platforms.