More than 100 recipes sit behind a privileged control plane
CyberStrikeAI ships more than 100 YAML tool recipes, but its larger idea is the workspace around them. An agent can plan work, call MCP tools, collect evidence, update assets and vulnerabilities, and replay an attack chain. Human approval, role permissions, audit records, and workflow graphs give a team a place to govern those actions instead of passing loose prompts and terminal output between operators.
The breadth changes the risk. The same console can manage WebShell connections, execute commands, and run optional C2 listeners. External MCP servers may read files or call other services. The project's security model therefore treats every person who can log in as an instance operator. This belongs behind an internal boundary with explicit engagement scope, not on a public URL with ordinary app-style user accounts.
What happened when we ran it
Our sandbox installed commit 470eb5e in 14 seconds, adding 88 packages and consuming 102 MB on disk. The build passed in 1 second. Pip-audit reported 0 known vulnerabilities. We ran the checkout in a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Python 3.12, and no secrets.
The harness found no tests script or target for the ecosystem it selected, so the test stage was skipped. That does not prove the repository lacks tests. The current testing guide names Go commands for packages under internal and cmd, and the measured commit contains co-located Go test files. It does mean our run produced no passing or failing test count to use as release evidence.
The checkout contained 1,050 files, about 233,792 source lines, and occupied 24.7 MB. One CI workflow was present, while a Dockerfile and top-level tests directory were absent. Our measurements cover installation, build, dependency audit, and repository shape. We did not connect a model, install scanners, run an engagement, or judge whether the agent found vulnerabilities.
The 14-second install leaves the security tools outside
The current README requires Go 1.25 or newer and Python 3.10 or newer. run.sh creates a Python environment, downloads dependencies, builds the server, and starts it. Actual scanners are another layer: the deployment guide says the YAML files only describe commands and the corresponding tools must already exist in PATH. Missing tools may be skipped or substituted at runtime.
A useful first session also needs at least 1 AI channel with a provider, base URL, API key, model, and token limits. The server creates a one-time admin password and defaults to self-signed HTTPS on port 8080. That is workable for a local trial. A shared install needs stable certificates, a dedicated OS account, backups for the SQLite data and runtime resources, and a model service whose data policy matches the engagement.
Approval narrows risk but cannot establish intent
Release v1.7.20 added TypeSafe Jev as a human-in-the-loop audit backend for non-allowlisted calls. It passes the tool name, arguments, and policy into a structured decision and can combine built-in checks with organization rules. That is more dependable than asking a chat model to return approval JSON, especially when the operation may alter a target.
The project's security guide still warns that approval does not reveal every consequence. A mild-looking tool can wrap a shell, an external MCP description can be dishonest, and target content can feed instructions back to the agent. Keep execution, WebShell writes, C2 tasks, deletion, uploads, and persistence actions out of global allowlists. Human review works best after tools and targets have already been narrowed.
Docker packaging and SQLite concurrency remain rough edges
Our measured checkout had no Dockerfile, and open issue #300 asks for container deployment because host-side component versions can conflict. The official deployment guide instead recommends run.sh for local use or a built binary under systemd for long-running service. The binary still expects templates, static assets, configuration, and several runtime directories beside it, so packaging is a real deployment task.
Open issue #328 describes parallel asset writes failing with database is locked around v1.7.19. The reporter recorded 29 successful create_asset calls and 15 failures in one session, with several failures returning in 4 to 26 milliseconds. That is not our measurement, and the issue remains open. Teams planning parallel agent work should reproduce the write pattern against v1.7.20 before trusting asset capture.
September releases show active work and fast change
The repository now resolves to AIPentest/CyberStrikeAI and was pushed on September 25, 2026. GitHub showed 7,148 stars, 48 open issues, and 16 open pull requests on October 5. Release v1.7.20 arrived September 22, following v1.7.19 four days earlier and v1.7.18 ten days before that. The cadence is active, with a lot changing between close releases.
English and Chinese deployment, configuration, testing, security, and runbook docs are unusually detailed for a project moving this quickly. The open queue still includes reports about model-channel selection, chat slowdown, scanner failures, Docker support, and SQLite contention. Read the patch notes, back up config.yaml and data/, and test upgrades against a copied workspace rather than treating a patch number as proof of compatibility.
Use it in an isolated red-team environment
CyberStrikeAI earns a trial when one authorized team needs MCP tools, approvals, evidence, and asset tracking in the same internal console. Strix is narrower for application vulnerability work. PentestGPT offers an agent framework without the same operations surface. Shannon is aimed at source-aware web and API testing, under the AGPL license.
Our 1-second build says the measured checkout compiled quickly; the skipped test stage leaves a larger question than that timing answers. Start with C2 disabled, four low-risk read tools allowlisted, audit logging on, and access limited by VPN or bastion. Add one capability at a time. If the team cannot name who approves each destructive action and where the evidence is retained, it is not ready to operate this platform.