HexStrike AI - Community Edition

AI-Powered MCP Cybersecurity Automation Platform

Advanced AI-powered penetration testing MCP framework, on-demand TTP knowledge, and adaptive scanning intelligence

📡 Wiki

🚀 Differences from HexStrike V6

• Increased MCP toolings from 150 to over 185
• Web Dashboard: A real-time web UI — monitor health, tools, system resources, live logs, and much more without touching the terminal.
• 3 Multi-Agent System: Full end-to-end agent workflows for OpenCode.
• Compact Mode: Great for running with smaller, local LLMs.
• Profile Mode: Specify one or more profiles to load only the relevant ones for your workflow.
• LLM Skills: 9 LLM skills now included.
• Refactored Codebase: Improved clarity, maintainability, and performance.
• Updated Dependencies: All packages upgraded for security and compatibility.
• Enhanced Tool Usage: Smarter parameter handling, improved documentation, and endpoint references.
• AI Integration: Upgraded MCP compatibility and agent orchestration (FastMCP v3).

Details

Web Dashboard

Served automatically at http://localhost:8888 the moment the server starts — no extra setup required.

What you get:

• Dashboard — live KPI cards for tools installed, command telemetry, cache stats, and uptime. CPU and memory history charts update in real time.
• Tool Availability — every tool organised by category. Expand any category to see individual install status. Click any tool chip to open a detail modal with description, install command, API endpoint, and parameters.
• Tool Registry — searchable, filterable card grid of all registered tools. Click any card for the same detail modal. Cards show a green/red install indicator pulled live from the health check.
• Server Logs — near-realtime SSE log stream with auto-scroll, configurable line buffer (50–500 lines), and a line count display.
• Help — IDE/agent configuration snippets for Claude Desktop, VS Code Copilot, Cursor, and OpenCode — with a custom install path input so the snippets are copy-paste ready.
• And much more!

HTB CTF Agent System (@htb-ctf)

A 14-specialist agent system built natively for OpenCode, designed to autonomously solve HTB machines and CTF challenges end-to-end.

Key features:

• Confirm before fire — the leader builds a structured attack plan and waits for your yes before any tool runs.
• Full kill chain: recon → enumeration → foothold → privilege escalation → flag capture → loot report.
• 14 specialist subagents: recon, web, api, service-enum, and more.
• Shared state machine via /tmp/htb-<target>/state.json — all agents coordinate through a single canonical file.
• Anti-loop rules prevent duplicate tool runs, blind wordlist exhaustion, and credential spray.
• Generates a full markdown report at /tmp/htb-<target>/report.md on completion.

Bug Bounty Agent System (@bugbounty)

A 7-specialist agent system built natively for OpenCode, designed for autonomous bug bounty hunting across web, API, and broad wildcard scopes.

Key features:

• Scope-first — scope enforcement is absolute. Every tool call is checked against scope[] and out_of_scope[] before firing. No violations.
• Confirm before fire — the leader builds a structured attack plan and waits for your yes before any tools run.
• Full chain: recon → OSINT → enumeration → fuzzing → vulnerability confirmation → report.
• 7 specialist subagents: recon, osint, web, and more.
• web and api agents run in parallel during ENUM and VULN phases for broad scopes.
• P1–P4 severity triage with CVSSv3 scores on every finding.
• Auto-generated PoC per finding: working curl command + numbered reproduction steps.
• Final report at /tmp/bb-<program>/report.md — submission-ready markdown.

Recon Agent System (@recon)

A 5-specialist agent system built natively for OpenCode, designed for pure read-only information gathering across domains, IP addresses, web applications, and APIs.

Key features:

• Read-only by contract — no exploitation, no payload delivery, no login attempts, no brute-force under any circumstances.
• Auto-detects target type (domain, IP, web, API) and invokes only the relevant specialists.
• 5 specialist subagents: domain, network, web, api, and report — running in parallel where possible.
• Passive-first: certificate transparency, historical URLs, and OSINT sources always run before active scanning.
• Nuclei runs in technologies and exposures mode only — no CVE or exploit templates.
• Structured report at /tmp/recon-<target>-<timestamp>/report.md covering subdomains, open ports, tech stack, API surface, and notable observations.

Compact Mode (--compact)

Activate Compact Mode for the MCP server using the --compact flag. See Flags for more info

• 🚦 Only the two essential gateway tools are loaded—perfect for lightweight deployments, automation pipelines, or running on resource-constrained systems.
• 🏃 Great for running with smaller, local LLMs or when you want minimal overhead.

Profile Mode (--profile)

Specify one or more profiles to load only the relevant ones for your workflow. See Profile flags for more info

• 🚀 Select profiles for targeted workflows to speed up scans and reduce resource usage.
• 🌐 Use --profile full to enable the complete arsenal, it's on default out-the-box for the recommended set.

Major Refactor

• Hexstrike Server has been reduced from 17,289 lines of code to just 100 lines.
• Hexstrike MCP client has been reduced from 5,470 lines of code to just 42 lines.
• Functionality is now split across multiple focused modules for clarity, maintainability, and easier contribution.
• This modular approach enables faster development, easier debugging, and better scalability.
• All MCP tools run async.

Installation

Quick Setup & Run Hexstrike Server

Note: Many tools (nmap, masscan, etc.) require elevated privileges for certain scan types. You can either run the setup as root, or grant individual tool capabilities (e.g. setcap cap_net_raw+ep /usr/bin/nmap). Running as root is simpler but less secure.

# 1. Clone the repository
git clone https://github.com/CommonHuman-Lab/hexstrike-ai-community-edition.git
cd hexstrike-ai-community-edition

# 2. Create virtual environment
python3 -m venv hexstrike-env
source hexstrike-env/bin/activate        # Linux/Mac
# sudo source hexstrike-env/bin/activate # Linux as root
# hexstrike-env\Scripts\activate         # Windows

# 3. Install Python dependencies
pip3 install -r requirements.txt

# 4. Start the API server
python3 hexstrike_server.py

# 5. Dashboard automatically at http://localhost:8888

# 6. In a separate terminal, start the MCP client
# (use the venv python to ensure dependencies are available)
hexstrike-env/bin/python3 hexstrike_mcp.py --server http://localhost:8888 --profile full

See Flags on how to customize the experience.

Verify Installation

# Browse to http://localhost:8888

# Test server API health
curl http://localhost:8888/health

Run Tests

The test suite uses pytest and the Flask test client — no running server or external tools required.

# Activate the virtual environment
source hexstrike-env/bin/activate

# Install pytest (one-time)
pip3 install pytest

# Run the full test suite
pytest tests/

# Run with verbose output
pytest tests/ -v

Use Hexstrike

Installation & Demo Video

Watch the full installation and setup walkthrough here: YouTube - HexStrike AI Installation & Demo

Supported AI Clients for Running & Integration

You can install and run HexStrike AI MCPs with various AI clients, including:

• 5ire (Latest version v0.14.0 not supported for now)
• VS Code Copilot
• Roo Code
• Cursor
• Claude Desktop
• OpenCode
• Any MCP-compatible agent

Refer to the video above for step-by-step instructions and integration examples for these platforms.

Claude Desktop Integration or Cursor

Edit ~/.config/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "hexstrike-ai": {
      "command": "/path/to/hexstrike-ai/hexstrike-env/bin/python3",
      "args": [
        "/path/to/hexstrike-ai/hexstrike_mcp.py",
        "--server",
        "http://localhost:8888",
        "--profile",
        "full"
      ],
      "description": "HexStrike AI Community Edition",
      "timeout": 300,
      "disabled": false
    }
  }
}

VS Code Copilot Integration

Configure VS Code settings in .vscode/settings.json:

{
  "servers": {
    "hexstrike": {
      "type": "stdio",
      "command": "/path/to/hexstrike-ai/hexstrike-env/bin/python3",
      "args": [
        "/path/to/hexstrike-ai/hexstrike_mcp.py",
        "--server",
        "http://localhost:8888",
        "--profile",
        "full"
      ]
    }
  },
  "inputs": []
}

OpenCode Integration

Configure OpenCode settings in ~/.config/opencode/opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hexstrike-ai": {
      "type": "local",
      "timeout": 000,
      "command": ["/path/to/hexstrike-ai/hexstrike_env/bin/python3",
        "/path/to/hexstrike-ai/hexstrike_mcp.py",
        "--server",
        "http://localhost:8888",
        "--profile",
        "full"
      ],
      "enabled": true
    }
  }
}

---

Security Configuration

Network Binding

By default, the server binds to 127.0.0.1 (localhost only). To configure security:

# Set an API token (server will require Bearer auth on all requests)
export HEXSTRIKE_API_TOKEN=your-secret-token

# Optionally bind to all interfaces (NOT recommended without a token)
export HEXSTRIKE_HOST=0.0.0.0

# Start the server
python3 hexstrike_server.py

Features

Security Tools Arsenal

Categories:

🤖 Automated Recon & Enumeration

• BBot – AI-powered reconnaissance and enumeration framework supporting subdomain discovery, module filtering, and safe/fast scanning

🗄️ Database Interaction & Querying

• MySQL Query – Direct SQL querying and enumeration for MySQL/MariaDB databases
• PostgreSQL Query – Direct SQL querying and enumeration for PostgreSQL databases
• SQLite Query – Local file-based SQL querying for SQLite databases

🔍 Network Reconnaissance & Scanning

• Nmap - Advanced port scanning with custom NSE scripts and service detection
• Rustscan - Ultra-fast port scanner with intelligent rate limiting
• Masscan - High-speed Internet-scale port scanning with banner grabbing
• AutoRecon - Comprehensive automated reconnaissance with 35+ parameters
• Amass - Advanced subdomain enumeration and OSINT gathering
• Subfinder - Fast passive subdomain discovery with multiple sources
• Fierce - DNS reconnaissance and zone transfer testing
• DNSEnum - DNS information gathering and subdomain brute forcing
• TheHarvester - Email and subdomain harvesting from multiple sources
• ARP-Scan - Network discovery using ARP requests
• NBTScan - NetBIOS name scanning and enumeration
• RPCClient - RPC enumeration and null session testing
• Whois - Domain and IP registration lookup for ownership and OSINT
• Enum4linux - SMB enumeration with user, group, and share discovery
• Enum4linux-ng - Advanced SMB enumeration with enhanced logging
• SMBMap - SMB share enumeration and exploitation
• Responder - LLMNR, NBT-NS and MDNS poisoner for credential harvesting
• NetExec - Network service exploitation framework (formerly CrackMapExec)

🌐 Web Application Security Testing

• Gobuster - Directory, file, and DNS enumeration with intelligent wordlists
• Dirsearch - Advanced directory and file discovery with enhanced logging
• Feroxbuster - Recursive content discovery with intelligent filtering
• FFuf - Fast web fuzzer with advanced filtering and parameter discovery
• Dirb - Comprehensive web content scanner with recursive scanning
• HTTPx - Fast HTTP probing and technology detection
• Katana - Next-generation crawling and spidering with JavaScript support
• Hakrawler - Fast web endpoint discovery and crawling
• Gau - Get All URLs from multiple sources (Wayback, Common Crawl, etc.)
• Waybackurls - Historical URL discovery from Wayback Machine
• Nuclei - Fast vulnerability scanner with 4000+ templates
• Nikto - Web server vulnerability scanner with comprehensive checks
• SQLMap - Advanced automatic SQL injection testing with tamper scripts
• WPScan - WordPress security scanner with vulnerability database
• Arjun - HTTP parameter discovery with intelligent fuzzing
• ParamSpider - Parameter mining from web archives
• X8 - Hidden parameter discovery with advanced techniques
• Jaeles - Advanced vulnerability scanning with custom signatures
• Dalfox - Advanced XSS vulnerability scanning with DOM analysis
• Wafw00f - Web application firewall fingerprinting
• TestSSL - SSL/TLS configuration testing and vulnerability assessment
• SSLScan - SSL/TLS cipher suite enumeration
• SSLyze - Fast and comprehensive SSL/TLS configuration analyzer
• Anew - Append new lines to files for efficient data processing
• QSReplace - Query string parameter replacement for systematic testing
• Uro - URL filtering and deduplication for efficient testing
• Whatweb - Web technology identification with fingerprinting
• JWT-Tool - JSON Web Token testing with algorithm confusion
• GraphQL-Voyager - GraphQL schema exploration and introspection testing
• Burp Suite Extensions - Custom extensions for advanced web testing
• ZAP Proxy - OWASP ZAP integration for automated security scanning
• Wfuzz - Web application fuzzer with advanced payload generation
• Commix - Command injection exploitation tool with automated detection
• NoSQLMap - NoSQL injection testing for MongoDB, CouchDB, etc.
• Tplmap - Server-side template injection exploitation tool

🌐 Advanced Browser Agent:

• Headless Chrome Automation - Full Chrome browser automation with Selenium
• Screenshot Capture - Automated screenshot generation for visual inspection
• DOM Analysis - Deep DOM tree analysis and JavaScript execution monitoring
• Network Traffic Monitoring - Real-time network request/response logging
• Security Header Analysis - Comprehensive security header validation
• Form Detection & Analysis - Automatic form discovery and input field analysis
• JavaScript Execution - Dynamic content analysis with full JavaScript support
• Proxy Integration - Seamless integration with Burp Suite and other proxies
• Multi-page Crawling - Intelligent web application spidering and mapping
• Performance Metrics - Page load times, resource usage, and optimization insights

🔐 Authentication & Password Security

• Hydra - Network login cracker supporting 50+ protocols
• John the Ripper - Advanced password hash cracking with custom rules
• Hashcat - World's fastest password recovery tool with GPU acceleration
• Medusa - Speedy, parallel, modular login brute-forcer
• Patator - Multi-purpose brute-forcer with advanced modules
• NetExec - Swiss army knife for pentesting networks
• SMBMap - SMB share enumeration and exploitation tool
• Evil-WinRM - Windows Remote Management shell with PowerShell integration
• HashID - Advanced hash algorithm identifier with confidence scoring
• CrackStation - Online hash lookup integration
• Ophcrack - Windows password cracker using rainbow tables

🔬 Binary Analysis & Reverse Engineering

• GDB - GNU Debugger with Python scripting and exploit development support
• GDB-PEDA - Python Exploit Development Assistance for GDB
• GDB-GEF - GDB Enhanced Features for exploit development
• Radare2 - Advanced reverse engineering framework with comprehensive analysis
• Ghidra - NSA's software reverse engineering suite with headless analysis
• IDA Free - Interactive disassembler with advanced analysis capabilities
• Binary Ninja - Commercial reverse engineering platform
• Binwalk - Firmware analysis and extraction tool with recursive extraction
• ROPgadget - ROP/JOP gadget finder with advanced search capabilities
• Ropper - ROP gadget finder and exploit development tool
• One-Gadget - Find one-shot RCE gadgets in libc
• Checksec - Binary security property checker with comprehensive analysis
• Strings - Extract printable strings from binaries with filtering
• Objdump - Display object file information with Intel syntax
• Readelf - ELF file analyzer with detailed header information
• XXD - Hex dump utility with advanced formatting
• Hexdump - Hex viewer and editor with customizable output
• Pwntools - CTF framework and exploit development library
• Angr - Binary analysis platform with symbolic execution
• Libc-Database - Libc identification and offset lookup tool
• Pwninit - Automate binary exploitation setup
• Volatility - Advanced memory forensics framework
• MSFVenom - Metasploit payload generator with advanced encoding
• UPX - Executable packer/unpacker for binary analysis

☁️ Cloud & Container Security

• Prowler - AWS/Azure/GCP security assessment with compliance checks
• Scout Suite - Multi-cloud security auditing for AWS, Azure, GCP, Alibaba Cloud
• CloudMapper - AWS network visualization and security analysis
• Pacu - AWS exploitation framework with comprehensive modules
• Trivy - Comprehensive vulnerability scanner for containers and IaC
• Clair - Container vulnerability analysis with detailed CVE reporting
• Kube-Hunter - Kubernetes penetration testing with active/passive modes
• Kube-Bench - CIS Kubernetes benchmark checker with remediation
• Docker Bench Security - Docker security assessment following CIS benchmarks
• Falco - Runtime security monitoring for containers and Kubernetes
• Checkov - Infrastructure as code security scanning
• Terrascan - Infrastructure security scanner with policy-as-code
• CloudSploit - Cloud security scanning and monitoring
• AWS CLI - Amazon Web Services command line with security operations
• Azure CLI - Microsoft Azure command line with security assessment
• GCloud - Google Cloud Platform command line with security tools
• Kubectl - Kubernetes command line with security context analysis
• Helm - Kubernetes package manager with security scanning
• Istio - Service mesh security analysis and configuration assessment
• OPA - Policy engine for cloud-native security and compliance

🏆 CTF & Forensics Tools

• Volatility - Advanced memory forensics framework with comprehensive plugins
• Volatility3 - Next-generation memory forensics with enhanced analysis
• Foremost - File carving and data recovery with signature-based detection
• PhotoRec - File recovery software with advanced carving capabilities
• TestDisk - Disk partition recovery and repair tool
• Steghide - Steganography detection and extraction with password support
• Stegsolve - Steganography analysis tool with visual inspection
• Zsteg - PNG/BMP steganography detection tool
• Outguess - Universal steganographic tool for JPEG images
• ExifTool - Metadata reader/writer for various file formats
• Binwalk - Firmware analysis and reverse engineering with extraction
• Scalpel - File carving tool with configurable headers and footers
• Bulk Extractor - Digital forensics tool for extracting features
• Autopsy - Digital forensics platform with timeline analysis
• Sleuth Kit - Collection of command-line digital forensics tools

Cryptography & Hash Analysis:

• John the Ripper - Password cracker with custom rules and advanced modes
• Hashcat - GPU-accelerated password recovery with 300+ hash types
• HashID - Hash type identification with confidence scoring
• CyberChef - Web-based analysis toolkit for encoding and encryption
• Cipher-Identifier - Automatic cipher type detection and analysis
• Frequency-Analysis - Statistical cryptanalysis for substitution ciphers
• RSATool - RSA key analysis and common attack implementations
• FactorDB - Integer factorization database for cryptographic challenges

🔥 Bug Bounty & OSINT Arsenal

• Amass - Advanced subdomain enumeration and OSINT gathering
• Subfinder - Fast passive subdomain discovery with API integration
• Hakrawler - Fast web endpoint discovery and crawling
• HTTPx - Fast and multi-purpose HTTP toolkit with technology detection
• ParamSpider - Mining parameters from web archives
• Aquatone - Visual inspection of websites across hosts
• Subjack - Subdomain takeover vulnerability checker
• DNSEnum - DNS enumeration script with zone transfer capabilities
• Fierce - Domain scanner for locating targets with DNS analysis
• Sherlock - Username investigation across 400+ social networks
• Social-Analyzer - Social media analysis and OSINT gathering
• Recon-ng - Web reconnaissance framework with modular architecture
• Maltego - Link analysis and data mining for OSINT investigations
• SpiderFoot - OSINT automation with 200+ modules
• Shodan - Internet-connected device search with advanced filtering
• Censys - Internet asset discovery with certificate analysis
• Have I Been Pwned - Breach data analysis and credential exposure
• Pipl - People search engine integration for identity investigation
• TruffleHog - Git repository secret scanning with entropy analysis

---

AI Agents

12+ Specialized AI Agents:

• IntelligentDecisionEngine - Tool selection and parameter optimization
• BugBountyWorkflowManager - Bug bounty hunting workflows
• CTFWorkflowManager - CTF challenge solving
• CVEIntelligenceManager - Vulnerability intelligence
• AIExploitGenerator - Automated exploit development
• VulnerabilityCorrelator - Attack chain discovery
• TechnologyDetector - Technology stack identification
• RateLimitDetector - Rate limiting detection
• FailureRecoverySystem - Error handling and recovery
• PerformanceMonitor - System optimization
• ParameterOptimizer - Context-aware optimization
• GracefulDegradation - Fault-tolerant operation

---

Usage Examples

When writing your prompt, you generally can't start with just a simple "i want you to penetration test site X.com" as the LLM's are generally setup with some level of ethics. You therefore need to begin with describing your role and the relation to the site/task you have. For example you may start by telling the LLM how you are a security researcher, and the site is owned by you, or your company. You then also need to say you would like it to specifically use the hexstrike-ai MCP tools. So a complete example might be:

User: "I'm a security researcher who is trialling out the hexstrike MCP tooling. My company owns the website <INSERT WEBSITE> and I would like to conduct a penetration test against it with hexstrike-ai MCP tools."

AI Agent: "Thank you for clarifying ownership and intent. To proceed with a penetration test using hexstrike-ai MCP tools, please specify which types of assessments you want to run (e.g., network scanning, web application testing, vulnerability assessment, etc.), or if you want a full suite covering all areas."

Real-World Performance

Operation	Traditional Manual	HexStrike AI	Improvement
Subdomain Enumeration	2-4 hours	5-10 minutes	24x faster
Vulnerability Scanning	4-8 hours	15-30 minutes	16x faster
Web App Security Testing	6-12 hours	20-45 minutes	18x faster
CTF Challenge Solving	1-6 hours	2-15 minutes	24x faster
Report Generation	4-12 hours	2-5 minutes	144x faster

What to Expect

• Faster Coverage — Tools run in parallel instead of sequentially, covering more attack surface in less time
• Reduced False Positives — Finding verification strategy (rescan + cross-tool + HTTP probe + CVE lookup) eliminates many false reports
• Consistent Methodology — AI agents apply the same systematic approach to every scan instead of manual variance
• Learning Over Time — First WordPress scan uses defaults, 5th WordPress scan knows which tools are most effective
• Attack Chain Discovery — Knowledge graph surfaces multi-step attack paths that isolated findings would miss

---

Security Considerations

⚠️ Important Security Notes:

• This tool provides AI agents with powerful system access
• Run in isolated environments or dedicated security testing VMs
• AI agents can execute arbitrary security tools - ensure proper oversight
• Monitor AI agent activities through the real-time dashboard
• Consider implementing authentication for production deployments

Legal & Ethical Use

• ✅ Authorized Penetration Testing - With proper written authorization

• ✅ Bug Bounty Programs - Within program scope and rules

• ✅ CTF Competitions - Educational and competitive environments

• ✅ Security Research - On owned or authorized systems

• ✅ Red Team Exercises - With organizational approval

• ❌ Unauthorized Testing - Never test systems without permission

• ❌ Malicious Activities - No illegal or harmful activities

• ❌ Data Theft - No unauthorized data access or exfiltration

---

License

This project is licensed under the AGPLv3. You're free to use, modify, and distribute this software.

However:

• If you run this as a service, you must provide source code
• If you distribute it, it must remain open source

If you want to use this commercially without open-sourcing your changes, contact me.

---

Based Of

0x4m4 - HexStrike AI

🚀 Ready to Transform Your AI Agents?

Made with ❤️ by the cybersecurity community for AI-powered security automation

HexStrike AI - Where artificial intelligence meets cybersecurity excellence