English (personal fork) | Upstream translations: 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português (Brasil) | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी

Personal fork: an enhanced CyberStrike distribution and operational workbench.

Maintained by Suren Sahayachny (spetro511)
and built on the original open-source project from CyberStrikeus/CyberStrike and its contributors.

About this fork • Workbench • Installation • Upstream • Ethical use • License

---

About This Fork

Important

CyberStrike originated at CyberStrikeus/CyberStrike. This repository is Suren Sahayachny's personal fork of that AGPL-licensed open-source project. Suren did not create the original CyberStrike project; its original authors and contributors retain full credit through the upstream repository and Git history.

Suren took the upstream project and substantially enhanced it as an operational distribution for day-to-day, authorized security work. The main contribution of this fork is an expanded Web UI that acts as a centralized hub for observing an engagement, understanding its posture, managing evidence, and operating a managed CyberStrike deployment.

The upstream package, website, documentation, releases, and community remain upstream resources. Features documented as fork enhancements below may not be present in an upstream release.

---

Operational Workbench

The fork connects the existing agent, tool, browser, MCP, Bolt, and finding data into one live browser workbench.

Area	Fork enhancement
Central Web UI	A session workbench that keeps agent interaction, findings, execution status, and engagement context together instead of treating the browser as a static companion view.
Live activity	Durable, redacted engagement events with live updates, correlation data, source filters, timeline and lane views, reconnect recovery, and JSONL export.
Mission posture	Methodology phase state, per-asset coverage, blockers, warnings, attack-chain candidates, agent performance, and approval-aware next actions.
Topology	Evidence-linked assets, hosts, services, routes, endpoints, identities, findings, and relationships in a searchable engagement graph.
Nmap workflows	Approval-gated scan profiles, exact command previews, canonical XML ingestion, saved scan history, topology projection, and comparisons between scans.
Target notes	Operator-authored notes attached to topology entities, with links and human-confirmed provenance.
Structured memory	Project and session memory with working, episodic, semantic, and procedural categories; search, provenance, trust, confidence, redaction, and invalidation.
Observer access	A server-enforced read-only role for redacted activity, mission, topology, findings, and status data without mutation, secret, raw-event, PTY, or configuration access.
Managed Kali deployment	Target-selectable source builds, installation of the matching HackBrowser worker and Web UI, and a localhost-only systemd user service template.

The implementation is visible in the session workbench UI, server routes, topology and Nmap model, and structured memory store.

Operational flow

Authorized engagement
        |
        v
CyberStrike agent and tools -----> durable, redacted activity
        |                                      |
        +--> Mission posture                   +--> Web UI timeline and lanes
        +--> Nmap evidence --> Topology
        +--> Findings and target notes
        +--> Structured project/session memory

Operator: full authenticated control
Observer: redacted read-only projection

---

Using This Fork

Upstream release

The published package is maintained by the upstream project:

npm i -g @cyberstrike-io/cyberstrike@latest
cyberstrike

See the upstream documentation for its supported release workflow. The npm package does not necessarily include enhancements that exist only on this fork.

Build and deploy the fork on Kali/Linux

Source deployments require the compiled binary, matching HackBrowser worker, and Web UI bundle. Use the repository-pinned Bun version:

bun install --frozen-lockfile
bun run --cwd packages/app build
CYBERSTRIKE_BUILD_TARGET=linux-x64 bun run --cwd packages/cyberstrike script/build.ts

# Installs the binary and its sibling HackBrowser worker.
./install --binary packages/cyberstrike/dist/cyberstrike-linux-x64/bin/cyberstrike

# Installs the locally built Web UI.
install -d "${XDG_DATA_HOME:-$HOME/.local/share}/cyberstrike/web"
cp -R packages/app/dist/. "${XDG_DATA_HOME:-$HOME/.local/share}/cyberstrike/web/"

CYBERSTRIKE_SERVER_PASSWORD=change-me cyberstrike web --hostname 127.0.0.1

Use linux-x64-baseline on x64 CPUs without AVX2, or the corresponding *-musl target on musl-based distributions. Back up the installed binary, configuration, and data directory before replacing a managed deployment.

For a persistent localhost-only service, install contrib/systemd/cyberstrike-web.service under ~/.config/systemd/user/. Create a mode 0600 file at ~/.config/cyberstrike/web.env containing CYBERSTRIKE_SERVER_PASSWORD, then run:

systemctl --user daemon-reload
systemctl --user enable --now cyberstrike-web.service

Remote access and observers

Keep the service bound to localhost and use an authenticated SSH or Cloudflare tunnel rather than exposing port 4096 directly.

export CYBERSTRIKE_SERVER_PASSWORD=your-operator-password
export CYBERSTRIKE_OBSERVER_PASSWORD=your-read-only-password
cyberstrike web --hostname 127.0.0.1

The optional observer credential is restricted by server policy. It is suitable for monitoring redacted engagement state, not for controlling agents or accessing secrets. If user or project configuration prevents startup, cyberstrike web --safe starts recovery mode without those configuration sources; managed administrator policy is still enforced.

---

Upstream Project and Contributor Credit

This fork exists because of the original CyberStrike project and the work of its maintainers and community.

Resource	Link
Original repository	CyberStrikeus/CyberStrike
Upstream contributors	Contributor history
Documentation	docs.cyberstrike.io
Website	cyberstrike.io
Published package	@cyberstrike-io/cyberstrike
Releases	Upstream releases
Issues and roadmap	Upstream issues
Community	Discord

Git history is intentionally preserved so upstream and fork contributors remain attributed for their work. For changes intended for the original project, read the Contributing Guide and submit them to the upstream repository. Fork-specific work should be proposed to spetro511/CyberStrike against the appropriate personal-fork branch.

---

Ethical Use

CyberStrike is intended only for systems you own or are explicitly authorized to test. Users are responsible for scope, approvals, data handling, tool execution, and compliance with applicable laws and engagement rules.

The agent is not a security sandbox. Review commands and active-test previews before approving them, protect credentials, and do not expose the Web UI directly to untrusted networks. Read the Code of Conduct and ethical-use policy and Security Policy before operating the software.

---

License

The upstream project and this fork are distributed under the GNU Affero General Public License v3.0 only (AGPL-3.0-only). Fork modifications remain under the same license and do not replace or weaken upstream copyright or contributor attribution.

The upstream project also advertises commercial licensing through contact@cyberstrike.io.

---

Original CyberStrike project · Suren's personal fork · Upstream docs · Upstream website

_{Upstream CyberStrike and its contributors are the foundation of this enhanced personal distribution.}