$ show AIPentest/CyberStrikeAI
CyberStrikeAI is a full-stack, AI-native cybersecurity operations platform designed for autonomous penetration testing and red teaming. It orchestrates multiple AI agents using the CloudWeGo Eino ADK framework to plan and execute complex security assessments. The platform manages its own C2 (Command & Control) infrastructure with encrypted beacons and listeners, integrates with over 100 security tools via the Model Context Protocol (MCP), and maintains a persistent knowledge base and project fact graph. It features a comprehensive governance layer including Role-Based Access Control (RBAC), Human-in-the-Loop (HITL) approval workflows, tool execution guards, and detailed audit logging. The architecture is a monolithic Go-like backend serving a web SPA, with plugins for Burp Suite and Chrome. It supports multi-agent orchestration modes (single, deep, plan-execute, supervisor), a graph-based workflow engine, and integrations with various chat platforms (WeChat, Discord, Telegram). The codebase demonstrates high craftsmanship in its execution governance, process isolation, atomic update mechanism, and database schema reconciliation. A significant technical concern is the use of a non-standard Go dialect (featuring `func`, `type`, and `map` literals) tied to the Eino framework. This creates a hard dependency on a specific toolchain and represents a major drift risk from the standard Go ecosystem, limiting portability and the ability to use standard tooling. Despite this, the project is actively maintained with extensive test coverage and a clear focus on production-grade security automation.
The LLM identified 9 files worth highlighting for reuse:
Manages MCP tool execution lifecycle with concurrency limits, circuit breakers, and output spill-to-disk. The NormalizeToolResultForStorageWithSpill function is a clean, reusable pattern for governing external tool calls.
Provides a platform-agnostic interface for OS-level process containment (cgroups v2 on Linux, Job Objects on Windows). The abstraction cleanly separates the Guard interface from platform-specific implementations.
Implements atomic binary replacement for self-update using a rename-based swap with a .prev backup. A classic systems engineering pattern executed cleanly with proper locking.
Handles large tool outputs by spilling to a temporary file when a memory threshold is exceeded. The SpilledToolOutput type with its Reader/Writer is a clean, isolated abstraction for managing unbounded output sizes.
Provides a safe, non-interactive shell execution environment with strict injection prevention, timeout handling, and stdout/stderr management. A thorough implementation of a common security requirement.
Implements a configurable retry handler for transient errors with exponential backoff, jitter, and error classification. A well-structured, isolated implementation of a universal resilience pattern.
Automatically reconciles the SQLite database schema by diffing the current schema against a reference SQL file and adding missing columns/indexes. Avoids heavy migration frameworks by using a clean, embedded reference pattern.
Provides a centralized audit logging service with structured records, throttling, and retention. Cleanly abstracted and injectable into any handler, solving a common cross-cutting concern.
A pure function that expands environment variables in configuration values using ${VAR:-default} syntax. A simple, reusable utility for configuration management.