# How Python Dependencies Are Managed in CyberStrikeAI

> Discover how CyberStrikeAI manages Python dependencies using requirements.txt and the run.sh script for robust, reproducible installations with pip.

- Repository: [公明/CyberStrikeAI](https://github.com/Ed1s0nZ/CyberStrikeAI)
- Tags: internals
- Published: 2026-03-09

---

**CyberStrikeAI manages Python dependencies through a central [`requirements.txt`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/requirements.txt) file processed by the [`run.sh`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/run.sh) bootstrap script, ensuring reproducible installations via pip with temporary mirror configuration.**

CyberStrikeAI, an open-source security automation platform hosted at `Ed1s0nZ/CyberStrikeAI`, relies on a straightforward yet robust Python dependency management strategy. The project uses a classic pip-based workflow centered around a root-level [`requirements.txt`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/requirements.txt) file and an automated installation script. This approach guarantees that every deployment—from local development to CI/CD pipelines—uses identical library versions without polluting the host system.

## Centralized Dependency Definition in [`requirements.txt`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/requirements.txt)

Located at the project root, the [`requirements.txt`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/requirements.txt) file serves as the single source of truth for all Python packages. It follows the standard pip format, with each line specifying a package and optional version constraints.

The file includes production dependencies like HTTP clients and security frameworks, while keeping optional heavy libraries commented out for on-demand activation:

```text

# Python HTTP helpers leveraged by tools like api‑fuzzer, dnslog, http‑intruder, http‑framework‑test

requests>=2.32.3
httpx>=0.27.0
charset-normalizer>=3.3.2
chardet>=5.2.0

# Python exploitation / analysis frameworks referenced by tool recipes

# angr>=9.2.96

# pwntools>=4.12.0

arjun>=2.2.0
uro>=1.0.2

bloodhound>=1.6.1
impacket>=0.11.0

# MCP (Model Context Protocol) SDK

mcp>=1.0.0

```

According to the CyberStrikeAI source code, only packages required for built-in tools are active by default. This selective inclusion keeps the base installation lightweight while allowing developers to uncomment entries like `angr>=9.2.96` or `pwntools>=4.12.0` when advanced exploitation frameworks are needed.

## Automated Installation via [`run.sh`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/run.sh)

The [`run.sh`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/run.sh) bootstrap script automates the entire installation flow, handling mirror configuration, pip upgrades, and dependency installation in a single execution. This script references the requirements file via the `$REQUIREMENTS_FILE` variable (typically pointing to `$ROOT_DIR/requirements.txt`).

### Temporary Mirror Configuration

Before installation begins, the script configures a temporary pip index to accelerate downloads without permanently altering the system configuration. It sets the `PIP_INDEX_URL` environment variable to a fast mirror (such as Tsinghua University's PyPI mirror) that persists only for the current script execution.

### Pip Upgrade and Installation Steps

Between lines 161 and 179, [`run.sh`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/run.sh) executes a three-step process:

1. **Upgrade pip**: Ensures the latest installer is available using `pip install --upgrade pip`
2. **Install dependencies**: Reads [`requirements.txt`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/requirements.txt) and installs all packages via `pip install -r "$REQUIREMENTS_FILE"`
3. **Capture logs**: Redirects output to `$PIP_LOG` for troubleshooting

```sh

# snippet from run.sh (lines 161‑179)

note "⚠️  使用临时 pip 镜像源（仅本次脚本运行有效）"
info "升级 pip..."
pip install --index-url "$PIP_INDEX_URL" --upgrade pip >/dev/null 2>&1 || true
info "安装 Python 依赖..."
pip install --index-url "$PIP_INDEX_URL" -r "$REQUIREMENTS_FILE" >"$PIP_LOG" 2>&1

```

This implementation ensures isolation—the bootstrap runs in dedicated containers or VMs without modifying the host's global Python environment.

## Practical Usage Examples

### Adding a New Library

To introduce a new dependency, append the package specifier to [`requirements.txt`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/requirements.txt) and rerun the bootstrap:

```bash

# Edit requirements.txt (e.g., add pandas)

echo "pandas>=2.2.0" >> requirements.txt

# Re‑run the installer

./run.sh

```

### Manual Installation Outside [`run.sh`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/run.sh)

For development environments where you prefer manual control, replicate the script's behavior by setting the same temporary index:

```bash

# Use the same temporary index that the script uses

export PIP_INDEX_URL="https://pypi.tuna.tsinghua.edu.cn/simple"
pip install --index-url "$PIP_INDEX_URL" -r requirements.txt

```

### Verifying Installed Versions

After installation, confirm package versions match the specifications using Python's `pkg_resources`:

```python
import pkg_resources, json
installed = {dist.key: dist.version for dist in pkg_resources.working_set}
print(json.dumps(installed, indent=2, sort_keys=True))

```

## Summary

- **Single source of truth**: All Python dependencies are declared in the root [`requirements.txt`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/requirements.txt) file using standard pip format.
- **Automated bootstrapping**: The [`run.sh`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/run.sh) script handles pip upgrades, temporary mirror configuration, and installation logging (lines 161-179).
- **Environment isolation**: Installations run in isolated contexts without modifying the host's global Python environment.
- **Flexible opt-ins**: Heavy frameworks like `angr` and `pwntools` remain commented out by default to keep base images lightweight.

## Frequently Asked Questions

### Where are Python dependencies defined in CyberStrikeAI?

Python dependencies are defined in the [`requirements.txt`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/requirements.txt) file located at the project root. This file lists all required packages with version constraints, such as `requests>=2.32.3` and `impacket>=0.11.0`, while leaving optional heavy frameworks commented out.

### How does the run.sh script install Python packages?

The [`run.sh`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/run.sh) script installs packages by first setting a temporary `PIP_INDEX_URL` for faster downloads, upgrading pip to the latest version, then executing `pip install -r "$REQUIREMENTS_FILE"` (where `$REQUIREMENTS_FILE` points to [`requirements.txt`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/requirements.txt)). Output is logged to `$PIP_LOG` for debugging purposes.

### Can I install dependencies manually without using run.sh?

Yes. You can manually install dependencies by setting the `PIP_INDEX_URL` environment variable to match the script's configuration (e.g., `https://pypi.tuna.tsinghua.edu.cn/simple`) and running `pip install --index-url "$PIP_INDEX_URL" -r requirements.txt` directly in your terminal.

### Why are some packages commented out in requirements.txt?

Certain packages like `angr>=9.2.96` and `pwntools>=4.12.0` are commented out to prevent unnecessary bloat in the default installation. Developers can uncomment these lines in [`requirements.txt`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/requirements.txt) before running [`run.sh`](https://github.com/Ed1s0nZ/CyberStrikeAI/blob/main/run.sh) to enable advanced exploitation and analysis frameworks on demand.