HexStrike puts more than 150 security tools behind an agent
HexStrike AI v6.0 connects an MCP client to a Python HTTP server that wraps scanners, fuzzers, password tools, debuggers, cloud auditors, browser automation, and process controls. The README describes more than 150 tools and over 12 specialized agents for bug bounties, CTFs, CVE work, reconnaissance, and exploit development. That catalog is the appeal: an agent can choose a tool, start it, inspect progress, cache results, and build a report without a developer writing a separate adapter for every binary.
The size claim can hide the operating model. Our checkout was only 14 files and about 22,761 lines of source, but the Python code is an orchestrator for a much larger external system. The README separately tells you to install Nmap, Nuclei, SQLMap, browser drivers, Ghidra, cloud CLIs, Kubernetes tools, password crackers, and many more programs. HexStrike does not turn those programs into one dependency. It gives them a shared API and lets an AI decide when to run them.
What happened when we ran it
Our sandbox installed 161 packages in 67 seconds, consuming 602 MB on disk. The build completed in 9 seconds at commit d689933. We ran it in a fresh Debian container with Python 3.12, 3 CPUs, 8 GB of RAM, no secrets, and an unprivileged user. Those figures cover the Python repository and its declared dependencies. They do not mean the external security arsenal from the README was installed.
There was no test script or target, so we skipped tests rather than inventing a substitute. The repository also had no tests directory, no Dockerfile, and 0 CI workflow files. Pip-audit found 43 known vulnerabilities in the installed environment. A security tool with this much command authority needs stronger evidence than a successful import or build. Before using it, a team should pin dependencies, audit reachable routes, and add tests around command construction, authentication, file paths, and process termination.
Port 8888 is a command boundary, not a normal app port
The README's API table openly lists POST /api/command as an endpoint that executes arbitrary commands. That capability is central to the product, since an agent must launch Nmap, SQLMap, debuggers, and other local tools. The same document tells operators to use an isolated environment or dedicated security VM, supervise agent actions, and consider implementing authentication for production. In plain terms, the default server should be treated like a remote shell for an AI client.
Open issues make that warning sharper. Issues #222 through #225, filed on August 4, 2026, report unauthenticated Python execution, arbitrary shell commands, command injection across more than 90 tool endpoints, and path traversal in file-writing routes. The repository's last push was August 3, one day before those reports, and the issues remained open when we checked. We did not reproduce the exploits, so they are reports rather than our findings. The absence of a later commit means buyers cannot point to a repository update that addresses them.
The 602 MB Python layer is the smaller setup job
Cloning the repository, creating a virtual environment, and installing requirements.txt is straightforward. The MCP client then starts hexstrike_mcp.py, which talks to the server over http://localhost:8888. Claude Desktop, Cursor, VS Code Copilot, Roo Code, and other MCP clients can use that pattern. The local URL is important. Exposing the port beyond the test host changes the risk dramatically because the server's reason for existing is to execute powerful commands.
Our 161-package install did not include the dozens of operating-system tools listed in the README. Operators must find compatible packages, install browser drivers, resolve naming collisions, and manage each tool's own requirements. Issue #77 reports one such collision between the Python httpx command and ProjectDiscovery's binary. Issue #147 says a fresh Kali setup did not expose every tool. Windows has a separate problem: issue #227 describes /tmp defaults that can crash startup. This is a Linux security workstation project first.
MCP convenience increases the blast radius
MCP makes a large catalog searchable and callable from an AI client. That is useful during an authorized assessment, especially when process status and tool results return through one interface. It also means a mistaken prompt or compromised client can reach many programs through one trusted server. The README's sample asks users to state that they own the target, but prose in a prompt is not an authorization control. Scope enforcement belongs outside the model, in the network, credentials, target allowlists, and human approval flow.
The repository has 11,367 stars and 2,371 forks, which shows strong interest. Health is less convincing when maintenance signals are combined: the latest-release API returned no published GitHub release, the last push was August 3, and GitHub listed 105 open issues and pull requests. A stale push by itself would not settle the question. Here it sits beside unanswered security reports, no CI, and no test target. Popularity should not substitute for a threat model.
Use it only inside a disposable authorized lab
HexStrike is most defensible as a lab appliance for a security professional who understands every wrapped tool and can discard the environment after a job. Keep port 8888 bound to an isolated interface, restrict outbound and target networks, run with the fewest privileges possible, and place a real authentication and approval layer in front of agent actions. Written permission for the tested systems is a baseline, since many included tools can disrupt services or access sensitive data.
Our run leaves a clear buying decision: 67 seconds to install the Python layer is convenient, while 43 known vulnerabilities and zero automated tests make the default trust story unacceptable. Use Nuclei or ZAP when a narrower scanner solves the job. If HexStrike's broad MCP catalog is the reason to proceed, review the open execution issues first and build the missing isolation around it. Do not connect the stock server to a trusted network and assume an AI client's safety policy will contain it.