Core Components of CyberStrikeAI: A Modular Go-Based Security Orchestration Platform

CyberStrikeAI is a modular, Go-based platform that orchestrates automated security assessments through distinct components including application bootstrap, HTTP API handlers, skill management, knowledge base indexing, autonomous agent reasoning, and multi-channel protocol communication.

CyberStrikeAI, developed by Ed1s0nZ and available at Ed1s0nZ/CyberStrikeAI, is an open-source security automation framework written in Go. Understanding the core components of CyberStrikeAI is essential for developers looking to extend its capabilities or integrate it into existing security workflows. The architecture follows a clean modular design, separating concerns between configuration, execution, knowledge management, and AI-assisted analysis.

Application Bootstrap and Configuration

The lifecycle of CyberStrikeAI begins with its application bootstrap layer, which initializes configuration, logging, and the HTTP server. The entry point resides in cmd/server/main.go, which instantiates the application core defined in internal/app/app.go. This bootstrap sequence loads runtime settings from config.yaml via internal/config/config.go, establishing connections to the database, OpenAI services, and MCP endpoints before exposing any API routes.

To start the server programmatically, import the app package and invoke the bootstrap sequence:

package main

import (
    "github.com/Ed1s0nZ/CyberStrikeAI/internal/app"
)

func main() {
    // Initialize the application (loads config, DB, logger)
    a := app.NewApp()
    // Run the HTTP server (by default on :8080)
    if err := a.Start(); err != nil {
        panic(err)
    }
}

See the full implementation: [internal/app/app.go](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/app/app.go)

HTTP API Layer and Handlers

CyberStrikeAI exposes its functionality through a comprehensive HTTP API layer located in internal/handler/. This package contains discrete handlers for distinct domains: task_manager.go orchestrates asynchronous security tasks, skills.go manages tool invocations, knowledge.go provides vector search endpoints, robot.go handles messaging integrations, and vulnerability.go exposes vulnerability tracking APIs. Together, these handlers implement REST and WebSocket endpoints that bridge client requests to the internal business logic.

Skill Management and Execution

The Skill Management system transforms external security tools into declarative, reusable components. Defined in internal/skills/manager.go, this component loads YAML specifications from the tools/ directory, validates parameters, and executes commands through a sandboxed environment. Each YAML file defines a tool's command structure, arguments, and metadata, enabling rapid integration of scanners like Masscan, Nmap, or Hydra without recompiling the application.

To add a custom skill, create a YAML definition in tools/:

# tools/custom-nmap.yaml

name: "Custom Nmap Scan"
description: "Run Nmap with custom arguments"
command: "nmap {{.Target}} -p {{.Ports}}"
parameters:
  - name: Target
    type: string
    required: true
  - name: Ports
    type: string
    default: "1-65535"

When placed in tools/, the Skill Manager automatically discovers the definition. Invoke it via the API:

curl -X POST http://localhost:8080/api/skills/run \
    -H "Content-Type: application/json" \
    -d '{"skill":"custom-nmap","params":{"Target":"10.0.0.5","Ports":"22,80"}}'

Skill handling code: [internal/skills/manager.go](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/skills/manager.go)

Knowledge Base and AI Integration

CyberStrikeAI maintains a Knowledge Base for contextual security intelligence, implemented across internal/knowledge/manager.go, indexer.go, and embedder.go. This subsystem indexes CVE data, attack techniques, and historical scan results into a vector store, enabling semantic search capabilities. The internal/openai/openai.go wrapper provides LLM integration for natural language task generation and analysis, allowing the platform to interpret security findings and suggest remediation steps.

Query the knowledge base programmatically:

package main

import (
    "context"
    "fmt"
    "github.com/Ed1s0nZ/CyberStrikeAI/internal/knowledge"
)

func main() {
    // Assume the knowledge manager is already instantiated in the app
    km := knowledge.NewManager()
    results, err := km.Search(context.Background(), "SQL injection")
    if err != nil {
        panic(err)
    }
    for _, r := range results {
        fmt.Printf("- %s (score: %.2f)\n", r.Title, r.Score)
    }
}

Search implementation: [internal/knowledge/retriever.go](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/knowledge/retriever.go)

Autonomous Agent and Attack Chains

The Agent subsystem in internal/agent/agent.go implements autonomous reasoning capabilities, maintaining compressed memory of prior actions via internal/agent/memory_compressor.go. This allows CyberStrikeAI to execute multi-step security assessments without human intervention. The Attack-Chain Builder (internal/attackchain/builder.go) constructs ordered execution graphs from user-defined steps, enabling complex attack scenario automation.

Use the agent to auto-generate an attack chain:

package main

import (
    "context"
    "fmt"
    "github.com/Ed1s0nZ/CyberStrikeAI/internal/agent"
)

func main() {
    ag := agent.NewAgent()
    // Provide an initial high‑level goal
    chain, err := ag.Plan(context.Background(), "Compromise the internal web server")
    if err != nil {
        panic(err)
    }
    fmt.Println("Generated attack chain:")
    for i, step := range chain.Steps {
        fmt.Printf("%d. %s -> %s\n", i+1, step.Tool, step.Description)
    }
}

Planning logic: [internal/agent/agent.go](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/internal/agent/agent.go)

Security, Communication, and Data Layers

CyberStrikeAI implements comprehensive security controls in internal/security/auth_manager.go and internal/security/executor.go, providing JWT-based authentication and sandboxed execution environments for dangerous tools. The Multi-Channel Protocol (MCP) layer (internal/mcp/server.go and client_sdk.go) enables protobuf-based communication with external scanners and remote agents. Robot integrations in internal/robot/lark.go and ding.go facilitate alerting via Lark and DingTalk.

Data persistence relies on SQLite via GORM, implemented in internal/database/database.go, vulnerability.go, and skill_stats.go. Centralized structured logging across all packages is handled by internal/logger/logger.go, ensuring consistent observability throughout the application lifecycle.

Summary

• CyberStrikeAI organizes its architecture into discrete Go packages under internal/, each responsible for specific security automation concerns.
• The bootstrap layer (cmd/server/main.go, internal/app/app.go) initializes configuration and starts the HTTP server.
• HTTP handlers (internal/handler/*) expose REST endpoints for tasks, skills, knowledge, and vulnerabilities.
• Skill management (internal/skills/manager.go) executes declarative tools defined in tools/*.yaml through a sandboxed security executor.
• The knowledge base (internal/knowledge/*) and OpenAI integration (internal/openai/openai.go) provide vector search and LLM capabilities.
• The autonomous agent (internal/agent/*) and attack-chain builder (internal/attackchain/builder.go) enable automated multi-step security assessments.
• MCP (internal/mcp/*), robot integrations (internal/robot/*), and the database layer (internal/database/*) complete the infrastructure.

Frequently Asked Questions

What programming language is CyberStrikeAI built with?

CyberStrikeAI is written entirely in Go (Golang). The repository uses standard Go project layout conventions with cmd/ for entry points and internal/ for package-private code, leveraging Go's concurrency model for orchestrating security tasks.

How does CyberStrikeAI ensure safe execution of external security tools?

The platform implements a sandboxed executor located in internal/security/executor.go that isolates tool execution from the host system. Additionally, the Skill Manager (internal/skills/manager.go) validates all parameters against YAML-defined schemas before invoking commands, preventing injection attacks.

What is the purpose of the Multi-Channel Protocol (MCP) in CyberStrikeAI?

The Multi-Channel Protocol (MCP) provides a protobuf-based communication layer defined in internal/mcp/server.go and internal/mcp/client_sdk.go. It enables CyberStrikeAI to integrate with external scanners, remote agents, and third-party security services through a standardized binary protocol rather than HTTP alone.

How does the autonomous agent generate attack chains?

The Agent (internal/agent/agent.go) uses the Attack-Chain Builder (internal/attackchain/builder.go) to construct ordered execution graphs. It analyzes the current security context, retrieves compressed historical memory from internal/agent/memory_compressor.go, and selects appropriate skills to create a logical sequence of penetration testing steps toward a defined goal.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}