How to Configure CyberStrikeAI for HTTP MCP Mode: Complete Setup Guide

Enable HTTP MCP mode in CyberStrikeAI by setting mcp.enabled: true in config.yaml and starting the application, which exposes a JSON-RPC endpoint at http://<host>:<port>/mcp for tool calling.

CyberStrikeAI exposes its security tool suite through the Model Context Protocol (MCP) as an HTTP JSON-RPC endpoint, allowing any MCP-compatible client to invoke tools like httpx remotely. This configuration requires editing the central config.yaml file and launching the built-in server from cmd/server/main.go. Below is the definitive guide to enabling both built-in and external HTTP MCP servers according to the Ed1s0nZ/CyberStrikeAI source code.

Enabling the Built-in HTTP MCP Server

Edit config.yaml at the repository root to activate the internal MCP server. Set enabled: true under the mcp section and specify the host and port where the HTTP endpoint will listen.

# =========================================================

# MCP 相关配置

# =========================================================

mcp:
  enabled: true               # ← enable built-in MCP server

  host: 0.0.0.0              # listen on all interfaces

  port: 8081                 # endpoint: http://0.0.0.0:8081/mcp

The configuration loader parses these values during startup in cmd/server/main.go (lines 15‑31). When cfg.MCP.Enabled evaluates to true, the application constructor invokes mcp.NewServer to instantiate the server, register all internal tools, and bind to the specified TCP address.

Configuring External HTTP MCP Servers

To configure CyberStrikeAI as a client to a remote HTTP MCP provider, add an entry under external_mcp.servers in config.yaml (lines 99‑102). Use transport: http to specify the JSON-RPC over HTTP protocol.

external_mcp:
  servers:
    my-http-mcp:
      transport: http                # ← HTTP-only mode

      url: http://127.0.0.1:9000/mcp   # target endpoint

      description: "My custom HTTP MCP"
      timeout: 30                     # seconds, optional

      external_mcp_enable: true       # ← activate this server

The ExternalMCPManager in internal/mcp/external_manager.go instantiates an HTTP client from internal/mcp/client_sdk.go when transport is set to http. The boolean flag external_mcp_enable (or the legacy enabled) controls activation; the isEnabled helper in internal/handler/external_mcp.go (lines 52‑66) validates this flag before establishing connections.

Starting the Application

Build and run the server binary to initialize the MCP endpoint. The entry point at cmd/server/main.go orchestrates configuration loading and server startup.

# Build the server binary

go build -o cyberstrike ./cmd/server

# Run with explicit config path

./cyberstrike -config config.yaml

Upon successful startup, the console emits:

[INFO] MCP server listening on 0.0.0.0:8081

If external MCPs are enabled, ExternalMCPManager.StartClient attempts automatic connection during the boot sequence. Restart the application after any configuration change to reload MCP definitions.

Calling Tools via HTTP MCP

Invoke tools through the built-in MCP by sending JSON-RPC POST requests to the /mcp path. The handler in internal/mcp/server.go (lines 118‑154) processes these requests, while handleCallTool (lines 84‑146) executes the specific tool logic.

Example: Calling the httpx tool

curl -X POST http://localhost:8081/mcp \
     -H "Content-Type: application/json" \
     -d '{
           "jsonrpc": "2.0",
           "id": "12345",
           "method": "tools/call",
           "params": {
             "name": "httpx",
             "arguments": {
               "url": "https://example.com"
             }
           }
         }'

The server returns a structured JSON-RPC response:

{
  "jsonrpc": "2.0",
  "id": "12345",
  "type": "result",
  "result": {
    "content": [
      {
        "type": "text",
        "text": "httpx scan completed – 0 hosts up"
      }
    ],
    "isError": false
  }
}

All JSON-RPC routing, parameter parsing, and response formatting occurs within internal/mcp/server.go.

Managing External MCPs via REST API

Control external HTTP MCP connections dynamically through the administrative REST API defined in internal/handler/external_mcp.go (lines 32‑78). These endpoints allow runtime activation without restarting the service.

Start an external MCP:

curl -X POST http://localhost:8080/api/external-mcp/my-http-mcp/start

Stop an external MCP:

curl -X POST http://localhost:8080/api/external-mcp/my-http-mcp/stop

The StartExternalMCP and StopExternalMCP handlers manage the lifecycle by invoking ExternalMCPManager methods, which handle HTTP client instantiation and connection teardown for transport: http configurations.

Testing External MCP Connectivity

Validate external HTTP MCP configurations using the dedicated test utility at cmd/test-external-mcp/main.go. This binary loads config.yaml, displays server statistics, and attempts to establish connections.

go run ./cmd/test-external-mcp/main.go ./config.yaml

The utility prints configuration details including transport type, URL, and enabled status, then calls manager.StartClient for each enabled server. It subsequently queries available tools via manager.GetAllTools, mirroring the exact flow used by the production server when communicating with external MCP providers.

Summary

• Enable the built-in server by setting mcp.enabled: true, host, and port in config.yaml (lines 92‑98).
• Configure external clients under external_mcp.servers with transport: http and external_mcp_enable: true (lines 99‑102).
• Start the application via cmd/server/main.go to automatically launch the MCP HTTP listener.
• Call tools by POSTing JSON-RPC payloads to http://<host>:<port>/mcp as implemented in internal/mcp/server.go.
• Manage connections dynamically using the REST API endpoints handled by internal/handler/external_mcp.go.

Frequently Asked Questions

What is the default port for CyberStrikeAI's HTTP MCP mode?

The default port is 8081, configured in config.yaml under the mcp.port key. You can modify this to any available TCP port before starting the application. The server binds to the address specified by mcp.host (typically 0.0.0.0 for all interfaces).

How do I enable an external HTTP MCP server without restarting CyberStrikeAI?

Use the REST API endpoints POST /api/external-mcp/:name/start and POST /api/external-mcp/:name/stop. These handlers in internal/handler/external_mcp.go trigger ExternalMCPManager to establish or tear down HTTP connections to the configured URL. Ensure the external server is defined in config.yaml with external_mcp_enable: true before attempting to start it via API.

What JSON-RPC method do I use to invoke tools via HTTP MCP?

Send a POST request with method: "tools/call" to the /mcp endpoint. The request body must include a params object containing name (the tool identifier) and arguments (a dictionary of tool-specific parameters). The server processes this through handleCallTool in internal/mcp/server.go and returns results in the JSON-RPC 2.0 format.

Can I run CyberStrikeAI as both an MCP server and client simultaneously?

Yes. Enable the built-in server with mcp.enabled: true while also defining external servers under external_mcp.servers. The application runs mcp.NewServer for the built-in endpoint and instantiates ExternalMCPManager clients for each configured external HTTP MCP. Both operate independently, allowing CyberStrikeAI to expose its own tools while consuming remote MCP services.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}