# cyberstrikeus/cyberstrike architecture

> Architecture diagram of the GitHub repository cyberstrikeus/cyberstrike, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cyberstrikeus/cyberstrike
- Repository: https://github.com/cyberstrikeus/cyberstrike

## Overview

CyberStrike is a terminal-first AI agent for offensive security testing. The principal workflow is an operator request, agent-led testing with an LLM and security skills/tools, then findings and a report. The tree also shows a web app, HTTP server, MCP and LSP commands, and persistent sessions. The README documents broader capabilities, including Bolt remote execution and many specialized agents; sampled source is incomplete, so uncertain implementation wiring is omitted.

Main entry points: [`packages/cyberstrike/src/agent/agent.ts`](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/agent/agent.ts) (Agent runtime), [`packages/cyberstrike/src/cli/cmd/cmd.ts`](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/cmd.ts) (CLI commands), [`packages/cyberstrike/src/cli/cmd/tui/app.tsx`](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/tui/app.tsx) (Terminal UI), [`packages/cyberstrike/src/auth/index.ts`](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/auth/index.ts) (LLM providers)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interaction["User Interfaces"]
  node_cli["CLI commands<br/>[cmd.ts]"]
  node_tui["Terminal UI<br/>[app.tsx]"]
  node_webapp["Web app<br/>[app.tsx]"]
end

subgraph group_agent["Agent Intelligence"]
  node_agentcore["Agent runtime<br/>[agent.ts]"]
  node_provider["LLM providers<br/>[index.ts]"]
  node_skills["Skill index<br/>[index-engine.ts]"]
  node_agents["Specialized agents<br/>[agent.ts]"]
end

subgraph group_testing["Security Testing"]
  node_recon["Reconnaissance<br/>[run.ts]"]
  node_vulndiscovery["Vulnerability discovery<br/>[run.ts]"]
  node_exploitation["Exploitation<br/>[run.ts]"]
  node_report["Findings and reports<br/>[dialog-report.tsx]"]
end

subgraph group_runtime["Runtime Services"]
  node_mcp["MCP commands<br/>[mcp.ts]"]
  node_lsp["Language servers<br/>[server.ts]"]
  node_httpserver["HTTP server<br/>[server.ts]"]
  node_sessions[("Session storage<br/>[storage.ts]")]
  node_webcapture["Browser capture<br/>[ingest.ts]"]
  node_bolt["Bolt remote execution"]
end

node_operator(("Security operator"))
node_target(("Authorized targets"))
node_llm(("LLM service"))

node_operator -->|"submits test"| node_tui
node_cli -->|"launches"| node_tui
node_tui -->|"requests testing"| node_agentcore
node_webapp -.->|"connects to"| node_httpserver
node_agentcore -->|"uses model"| node_provider
node_provider -->|"sends prompts"| node_llm
node_agentcore -->|"retrieves skills"| node_skills
node_agentcore -->|"selects agents"| node_agents
node_agentcore -->|"orchestrates"| node_recon
node_agentcore -->|"orchestrates"| node_vulndiscovery
node_agentcore -->|"orchestrates"| node_exploitation
node_recon -->|"tests"| node_target
node_vulndiscovery -->|"tests"| node_target
node_exploitation -->|"tests"| node_target
node_agentcore -->|"produces findings"| node_report
node_agentcore -->|"persists sessions"| node_sessions
node_cli -->|"dispatches"| node_mcp
node_cli -->|"dispatches"| node_lsp
node_webcapture -->|"submits capture"| node_httpserver
node_agentcore -.->|"uses remote execution"| node_bolt

click node_cli "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/cmd.ts"
click node_tui "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/tui/app.tsx"
click node_webapp "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/app/src/app.tsx"
click node_agentcore "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/agent/agent.ts"
click node_provider "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/auth/index.ts"
click node_skills "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/skill/index-engine.ts"
click node_agents "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/agent/agent.ts"
click node_recon "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/run.ts"
click node_vulndiscovery "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/run.ts"
click node_exploitation "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/run.ts"
click node_report "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/tui/component/dialog-report.tsx"
click node_mcp "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/mcp.ts"
click node_lsp "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/lsp/server.ts"
click node_httpserver "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/server/server.ts"
click node_sessions "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/storage/storage.ts"
click node_webcapture "https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/hackbrowser/src/ingest.ts"
click node_bolt "https://github.com/cyberstrikeus/cyberstrike/tree/main/packages/cyberstrike/src"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_tui,node_webapp toneBlue
class node_agentcore,node_provider,node_skills,node_agents toneAmber
class node_recon,node_vulndiscovery,node_exploitation,node_report toneMint
class node_mcp,node_lsp,node_httpserver,node_sessions,node_webcapture,node_bolt toneRose
class node_operator,node_target,node_llm toneIndigo
```

## Components

### User Interfaces

- [CLI commands](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/cmd.ts): `packages/cyberstrike/src/cli/cmd/cmd.ts`
- [Terminal UI](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/tui/app.tsx): `packages/cyberstrike/src/cli/cmd/tui/app.tsx`
- [Web app](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/app/src/app.tsx): `packages/app/src/app.tsx`

### Agent Intelligence

- [Agent runtime](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/agent/agent.ts): `packages/cyberstrike/src/agent/agent.ts`
- [LLM providers](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/auth/index.ts): `packages/cyberstrike/src/auth/index.ts`
- [Skill index](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/skill/index-engine.ts): `packages/cyberstrike/src/skill/index-engine.ts`
- [Specialized agents](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/agent/agent.ts): `packages/cyberstrike/src/agent/agent.ts`

### Security Testing

- [Reconnaissance](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/run.ts): `packages/cyberstrike/src/cli/cmd/run.ts`
- [Vulnerability discovery](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/run.ts): `packages/cyberstrike/src/cli/cmd/run.ts`
- [Exploitation](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/run.ts): `packages/cyberstrike/src/cli/cmd/run.ts`
- [Findings and reports](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/tui/component/dialog-report.tsx): `packages/cyberstrike/src/cli/cmd/tui/component/dialog-report.tsx`

### Runtime Services

- [MCP commands](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/cli/cmd/mcp.ts): `packages/cyberstrike/src/cli/cmd/mcp.ts`
- [Language servers](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/lsp/server.ts): `packages/cyberstrike/src/lsp/server.ts`
- [HTTP server](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/server/server.ts): `packages/cyberstrike/src/server/server.ts`
- [Session storage](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/cyberstrike/src/storage/storage.ts): `packages/cyberstrike/src/storage/storage.ts`
- [Browser capture](https://github.com/cyberstrikeus/cyberstrike/blob/main/packages/hackbrowser/src/ingest.ts): `packages/hackbrowser/src/ingest.ts`
- [Bolt remote execution](https://github.com/cyberstrikeus/cyberstrike/tree/main/packages/cyberstrike/src): `packages/cyberstrike/src`

### Other components

- **Security operator**
- **Authorized targets**
- **LLM service**

## Connections

- Security operator → Terminal UI: submits test
- CLI commands → Terminal UI: launches
- Terminal UI → Agent runtime: requests testing
- Web app → HTTP server: connects to
- Agent runtime → LLM providers: uses model
- LLM providers → LLM service: sends prompts
- Agent runtime → Skill index: retrieves skills
- Agent runtime → Specialized agents: selects agents
- Agent runtime → Reconnaissance: orchestrates
- Agent runtime → Vulnerability discovery: orchestrates
- Agent runtime → Exploitation: orchestrates
- Reconnaissance → Authorized targets: tests
- Vulnerability discovery → Authorized targets: tests
- Exploitation → Authorized targets: tests
- Agent runtime → Findings and reports: produces findings
- Agent runtime → Session storage: persists sessions
- CLI commands → MCP commands: dispatches
- CLI commands → Language servers: dispatches
- Browser capture → HTTP server: submits capture
- Agent runtime → Bolt remote execution: uses remote execution