# Core Components of CyberStrikeAI: A Modular Go-Based Security Orchestration Platform

> Explore the core components of CyberStrikeAI a modular Go platform designed for automated security orchestration including bootstrap API skills knowledge base agents and communication protocols

- Repository: [公明/CyberStrikeAI](https://github.com/Ed1s0nZ/CyberStrikeAI)
- Tags: architecture
- Published: 2026-03-09

---

**CyberStrikeAI is a modular, Go-based platform that orchestrates automated security assessments through distinct components including application bootstrap, HTTP API handlers, skill management, knowledge base indexing, autonomous agent reasoning, and multi-channel protocol communication.**

CyberStrikeAI, developed by Ed1s0nZ and available at `Ed1s0nZ/CyberStrikeAI`, is an open-source security automation framework written in Go. Understanding the core components of CyberStrikeAI is essential for developers looking to extend its capabilities or integrate it into existing security workflows. The architecture follows a clean modular design, separating concerns between configuration, execution, knowledge management, and AI-assisted analysis.

## Application Bootstrap and Configuration

The lifecycle of CyberStrikeAI begins with its application bootstrap layer, which initializes configuration, logging, and the HTTP server. The entry point resides in [`cmd/server/main.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/cmd/server/main.go), which instantiates the application core defined in [`internal/app/app.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/app/app.go). This bootstrap sequence loads runtime settings from [`config.yaml`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/config.yaml) via [`internal/config/config.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/config/config.go), establishing connections to the database, OpenAI services, and MCP endpoints before exposing any API routes.

To start the server programmatically, import the app package and invoke the bootstrap sequence:

```go
package main

import (
    "github.com/Ed1s0nZ/CyberStrikeAI/internal/app"
)

func main() {
    // Initialize the application (loads config, DB, logger)
    a := app.NewApp()
    // Run the HTTP server (by default on :8080)
    if err := a.Start(); err != nil {
        panic(err)
    }
}

```

*See the full implementation*: [[`internal/app/app.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/app/app.go)](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/app/app.go)

## HTTP API Layer and Handlers

CyberStrikeAI exposes its functionality through a comprehensive HTTP API layer located in `internal/handler/`. This package contains discrete handlers for distinct domains: [`task_manager.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/task_manager.go) orchestrates asynchronous security tasks, [`skills.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/skills.go) manages tool invocations, [`knowledge.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/knowledge.go) provides vector search endpoints, [`robot.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/robot.go) handles messaging integrations, and [`vulnerability.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/vulnerability.go) exposes vulnerability tracking APIs. Together, these handlers implement REST and WebSocket endpoints that bridge client requests to the internal business logic.

## Skill Management and Execution

The **Skill Management** system transforms external security tools into declarative, reusable components. Defined in [`internal/skills/manager.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/skills/manager.go), this component loads YAML specifications from the `tools/` directory, validates parameters, and executes commands through a sandboxed environment. Each YAML file defines a tool's command structure, arguments, and metadata, enabling rapid integration of scanners like Masscan, Nmap, or Hydra without recompiling the application.

To add a custom skill, create a YAML definition in `tools/`:

```yaml

# tools/custom-nmap.yaml

name: "Custom Nmap Scan"
description: "Run Nmap with custom arguments"
command: "nmap {{.Target}} -p {{.Ports}}"
parameters:
  - name: Target
    type: string
    required: true
  - name: Ports
    type: string
    default: "1-65535"

```

When placed in `tools/`, the **Skill Manager** automatically discovers the definition. Invoke it via the API:

```bash
curl -X POST http://localhost:8080/api/skills/run \
    -H "Content-Type: application/json" \
    -d '{"skill":"custom-nmap","params":{"Target":"10.0.0.5","Ports":"22,80"}}'

```

*Skill handling code*: [[`internal/skills/manager.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/skills/manager.go)](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/skills/manager.go)

## Knowledge Base and AI Integration

CyberStrikeAI maintains a **Knowledge Base** for contextual security intelligence, implemented across [`internal/knowledge/manager.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/knowledge/manager.go), [`indexer.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/indexer.go), and [`embedder.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/embedder.go). This subsystem indexes CVE data, attack techniques, and historical scan results into a vector store, enabling semantic search capabilities. The [`internal/openai/openai.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/openai/openai.go) wrapper provides LLM integration for natural language task generation and analysis, allowing the platform to interpret security findings and suggest remediation steps.

Query the knowledge base programmatically:

```go
package main

import (
    "context"
    "fmt"
    "github.com/Ed1s0nZ/CyberStrikeAI/internal/knowledge"
)

func main() {
    // Assume the knowledge manager is already instantiated in the app
    km := knowledge.NewManager()
    results, err := km.Search(context.Background(), "SQL injection")
    if err != nil {
        panic(err)
    }
    for _, r := range results {
        fmt.Printf("- %s (score: %.2f)\n", r.Title, r.Score)
    }
}

```

*Search implementation*: [[`internal/knowledge/retriever.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/knowledge/retriever.go)](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/knowledge/retriever.go)

## Autonomous Agent and Attack Chains

The **Agent** subsystem in [`internal/agent/agent.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/agent/agent.go) implements autonomous reasoning capabilities, maintaining compressed memory of prior actions via [`internal/agent/memory_compressor.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/agent/memory_compressor.go). This allows CyberStrikeAI to execute multi-step security assessments without human intervention. The **Attack-Chain Builder** ([`internal/attackchain/builder.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/attackchain/builder.go)) constructs ordered execution graphs from user-defined steps, enabling complex attack scenario automation.

Use the agent to auto-generate an attack chain:

```go
package main

import (
    "context"
    "fmt"
    "github.com/Ed1s0nZ/CyberStrikeAI/internal/agent"
)

func main() {
    ag := agent.NewAgent()
    // Provide an initial high‑level goal
    chain, err := ag.Plan(context.Background(), "Compromise the internal web server")
    if err != nil {
        panic(err)
    }
    fmt.Println("Generated attack chain:")
    for i, step := range chain.Steps {
        fmt.Printf("%d. %s -> %s\n", i+1, step.Tool, step.Description)
    }
}

```

*Planning logic*: [[`internal/agent/agent.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/agent/agent.go)](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/agent/agent.go)

## Security, Communication, and Data Layers

CyberStrikeAI implements comprehensive **security controls** in [`internal/security/auth_manager.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/security/auth_manager.go) and [`internal/security/executor.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/security/executor.go), providing JWT-based authentication and sandboxed execution environments for dangerous tools. The **Multi-Channel Protocol (MCP)** layer ([`internal/mcp/server.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/mcp/server.go) and [`client_sdk.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/client_sdk.go)) enables protobuf-based communication with external scanners and remote agents. **Robot integrations** in [`internal/robot/lark.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/robot/lark.go) and [`ding.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/ding.go) facilitate alerting via Lark and DingTalk.

Data persistence relies on **SQLite via GORM**, implemented in [`internal/database/database.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/database/database.go), [`vulnerability.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/vulnerability.go), and [`skill_stats.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/skill_stats.go). Centralized structured logging across all packages is handled by [`internal/logger/logger.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/logger/logger.go), ensuring consistent observability throughout the application lifecycle.

## Summary

- **CyberStrikeAI** organizes its architecture into discrete Go packages under `internal/`, each responsible for specific security automation concerns.
- The **bootstrap layer** ([`cmd/server/main.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/cmd/server/main.go), [`internal/app/app.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/app/app.go)) initializes configuration and starts the HTTP server.
- **HTTP handlers** (`internal/handler/*`) expose REST endpoints for tasks, skills, knowledge, and vulnerabilities.
- **Skill management** ([`internal/skills/manager.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/skills/manager.go)) executes declarative tools defined in `tools/*.yaml` through a sandboxed **security executor**.
- The **knowledge base** (`internal/knowledge/*`) and **OpenAI integration** ([`internal/openai/openai.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/openai/openai.go)) provide vector search and LLM capabilities.
- The **autonomous agent** (`internal/agent/*`) and **attack-chain builder** ([`internal/attackchain/builder.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/attackchain/builder.go)) enable automated multi-step security assessments.
- **MCP** (`internal/mcp/*`), **robot integrations** (`internal/robot/*`), and the **database layer** (`internal/database/*`) complete the infrastructure.

## Frequently Asked Questions

### What programming language is CyberStrikeAI built with?

CyberStrikeAI is written entirely in **Go** (Golang). The repository uses standard Go project layout conventions with `cmd/` for entry points and `internal/` for package-private code, leveraging Go's concurrency model for orchestrating security tasks.

### How does CyberStrikeAI ensure safe execution of external security tools?

The platform implements a **sandboxed executor** located in [`internal/security/executor.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/security/executor.go) that isolates tool execution from the host system. Additionally, the **Skill Manager** ([`internal/skills/manager.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/skills/manager.go)) validates all parameters against YAML-defined schemas before invoking commands, preventing injection attacks.

### What is the purpose of the Multi-Channel Protocol (MCP) in CyberStrikeAI?

The **Multi-Channel Protocol (MCP)** provides a protobuf-based communication layer defined in [`internal/mcp/server.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/mcp/server.go) and [`internal/mcp/client_sdk.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/mcp/client_sdk.go). It enables CyberStrikeAI to integrate with external scanners, remote agents, and third-party security services through a standardized binary protocol rather than HTTP alone.

### How does the autonomous agent generate attack chains?

The **Agent** ([`internal/agent/agent.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/agent/agent.go)) uses the **Attack-Chain Builder** ([`internal/attackchain/builder.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/attackchain/builder.go)) to construct ordered execution graphs. It analyzes the current security context, retrieves compressed historical memory from [`internal/agent/memory_compressor.go`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/agent/memory_compressor.go), and selects appropriate skills to create a logical sequence of penetration testing steps toward a defined goal.