How Python Dependencies Are Managed in CyberStrikeAI

CyberStrikeAI manages Python dependencies through a central requirements.txt file processed by the run.sh bootstrap script, ensuring reproducible installations via pip with temporary mirror configuration.

CyberStrikeAI, an open-source security automation platform hosted at Ed1s0nZ/CyberStrikeAI, relies on a straightforward yet robust Python dependency management strategy. The project uses a classic pip-based workflow centered around a root-level requirements.txt file and an automated installation script. This approach guarantees that every deployment—from local development to CI/CD pipelines—uses identical library versions without polluting the host system.

Centralized Dependency Definition in requirements.txt

Located at the project root, the requirements.txt file serves as the single source of truth for all Python packages. It follows the standard pip format, with each line specifying a package and optional version constraints.

The file includes production dependencies like HTTP clients and security frameworks, while keeping optional heavy libraries commented out for on-demand activation:

# Python HTTP helpers leveraged by tools like api‑fuzzer, dnslog, http‑intruder, http‑framework‑test

requests>=2.32.3
httpx>=0.27.0
charset-normalizer>=3.3.2
chardet>=5.2.0

# Python exploitation / analysis frameworks referenced by tool recipes

# angr>=9.2.96

# pwntools>=4.12.0

arjun>=2.2.0
uro>=1.0.2

bloodhound>=1.6.1
impacket>=0.11.0

# MCP (Model Context Protocol) SDK

mcp>=1.0.0

According to the CyberStrikeAI source code, only packages required for built-in tools are active by default. This selective inclusion keeps the base installation lightweight while allowing developers to uncomment entries like angr>=9.2.96 or pwntools>=4.12.0 when advanced exploitation frameworks are needed.

Automated Installation via run.sh

The run.sh bootstrap script automates the entire installation flow, handling mirror configuration, pip upgrades, and dependency installation in a single execution. This script references the requirements file via the $REQUIREMENTS_FILE variable (typically pointing to $ROOT_DIR/requirements.txt).

Temporary Mirror Configuration

Before installation begins, the script configures a temporary pip index to accelerate downloads without permanently altering the system configuration. It sets the PIP_INDEX_URL environment variable to a fast mirror (such as Tsinghua University's PyPI mirror) that persists only for the current script execution.

Pip Upgrade and Installation Steps

Between lines 161 and 179, run.sh executes a three-step process:

1. Upgrade pip: Ensures the latest installer is available using pip install --upgrade pip
2. Install dependencies: Reads requirements.txt and installs all packages via pip install -r "$REQUIREMENTS_FILE"
3. Capture logs: Redirects output to $PIP_LOG for troubleshooting

# snippet from run.sh (lines 161‑179)

note "⚠️  使用临时 pip 镜像源（仅本次脚本运行有效）"
info "升级 pip..."
pip install --index-url "$PIP_INDEX_URL" --upgrade pip >/dev/null 2>&1 || true
info "安装 Python 依赖..."
pip install --index-url "$PIP_INDEX_URL" -r "$REQUIREMENTS_FILE" >"$PIP_LOG" 2>&1

This implementation ensures isolation—the bootstrap runs in dedicated containers or VMs without modifying the host's global Python environment.

Practical Usage Examples

Adding a New Library

To introduce a new dependency, append the package specifier to requirements.txt and rerun the bootstrap:

# Edit requirements.txt (e.g., add pandas)

echo "pandas>=2.2.0" >> requirements.txt

# Re‑run the installer

./run.sh

Manual Installation Outside run.sh

For development environments where you prefer manual control, replicate the script's behavior by setting the same temporary index:

# Use the same temporary index that the script uses

export PIP_INDEX_URL="https://pypi.tuna.tsinghua.edu.cn/simple"
pip install --index-url "$PIP_INDEX_URL" -r requirements.txt

Verifying Installed Versions

After installation, confirm package versions match the specifications using Python's pkg_resources:

import pkg_resources, json
installed = {dist.key: dist.version for dist in pkg_resources.working_set}
print(json.dumps(installed, indent=2, sort_keys=True))

Summary

• Single source of truth: All Python dependencies are declared in the root requirements.txt file using standard pip format.
• Automated bootstrapping: The run.sh script handles pip upgrades, temporary mirror configuration, and installation logging (lines 161-179).
• Environment isolation: Installations run in isolated contexts without modifying the host's global Python environment.
• Flexible opt-ins: Heavy frameworks like angr and pwntools remain commented out by default to keep base images lightweight.

Frequently Asked Questions

Where are Python dependencies defined in CyberStrikeAI?

Python dependencies are defined in the requirements.txt file located at the project root. This file lists all required packages with version constraints, such as requests>=2.32.3 and impacket>=0.11.0, while leaving optional heavy frameworks commented out.

How does the run.sh script install Python packages?

The run.sh script installs packages by first setting a temporary PIP_INDEX_URL for faster downloads, upgrading pip to the latest version, then executing pip install -r "$REQUIREMENTS_FILE" (where $REQUIREMENTS_FILE points to requirements.txt). Output is logged to $PIP_LOG for debugging purposes.

Can I install dependencies manually without using run.sh?

Yes. You can manually install dependencies by setting the PIP_INDEX_URL environment variable to match the script's configuration (e.g., https://pypi.tuna.tsinghua.edu.cn/simple) and running pip install --index-url "$PIP_INDEX_URL" -r requirements.txt directly in your terminal.

Why are some packages commented out in requirements.txt?

Certain packages like angr>=9.2.96 and pwntools>=4.12.0 are commented out to prevent unnecessary bloat in the default installation. Developers can uncomment these lines in requirements.txt before running run.sh to enable advanced exploitation and analysis frameworks on demand.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}