Built-in Tools

Cyberstrike’s core tools for reading/writing files, running shell commands, and keeping persistent notes across sessions.

File Operations

Five tools for interacting with the filesystem.

Read

Reads file contents with line numbers. Also handles images, PDFs, and binary files.

> Read the contents of src/auth/login.ts
> Read lines 50-100 of src/auth/login.ts
> Read the screenshot at ./evidence/vuln-poc.png

Write

Creates or overwrites a file.

> Write a Python script to exploit the SQL injection to exploit.py

Edit

Makes precise string replacements in existing files. Requires reading the file first.

> Edit src/auth/login.ts to replace the raw SQL concatenation with a parameterized query

Use replace_all to change every occurrence at once.

Glob

Finds files by glob pattern.

Grep

Searches file contents with regex.

> Search for API key patterns in the codebase

File Permissions

Auto-approve writes to specific paths:

{
  "permission": {
    "edit": {
      "reports/**": "allow",
      "findings/**": "allow"
    }
  }
}

Only * and ? are supported as wildcards. See Permissions for the full model.

Bash

Executes shell commands with timeout control and permission gating.

Usage

> Run nmap scan on 192.168.1.1
> Find all .env files and search for API keys

Timeout

Commands timeout after 120 seconds by default. For long-running operations, the agent uses an explicit timeout wrapper or background execution.

Piping Input

echo "analyze this code" | cyberstrike run
nmap -sV target.local | cyberstrike run "analyze these scan results"

Bash Permissions

The bash permission maps a glob (matched against the command string) to an action:

{
  "permission": {
    "bash": {
      "nmap *": "allow",
      "nuclei *": "allow",
      "rm -rf *": "deny"
    }
  }
}

See Permissions for the full model.

Memory

Four tools for persistent notes stored as Markdown files in your project.

Tools

Storage Layout

.cyberstrike/
├── MEMORY.md              ← long-term memory (decisions, preferences, facts)
└── memory/
    └── 2026-07-03.md      ← dated daily notes

• MEMORY.md — durable, long-term facts. Each entry is appended with an ISO timestamp heading.
• memory/YYYY-MM-DD.md — per-day notes, each starting with a # Daily Notes - <date> heading and timestamped entries.

Global memory (shared across projects) lives under ~/.config/cyberstrike/memory/.

memory_write

parameters:
  content: string    — the note content
  type: "long_term" | "daily"  — defaults to "daily"
  title: string?     — optional heading

Long-term entries go into MEMORY.md, daily entries go into memory/<today>.md.

memory_read

Accepts these values for the file parameter:

memory_search

Simple text search across MEMORY.md and all daily note files. Returns up to 20 matches with surrounding context (2 lines before, 2 after).

memory_context

Returns the combined context of long-term memory + today’s notes + yesterday’s notes. Automatically called at session start but can be invoked manually to refresh.

Because everything is Markdown on disk, you can read, edit, or version-control memory like any other project file.

Dynamic Tool Loading

Built-in tools are always available. MCP tools are loaded on demand so that connecting a server with hundreds of tools doesn’t flood the model’s context.

Loading Tools

The agent uses these automatically: it searches for a capability, loads the matching MCP tool, calls it, and can unload it afterward.

{
  "query": "sql injection testing",
  "limit": 10
}

What’s Lazy vs Always-On

• Always available — every built-in tool (bash, read, edit, glob, grep, write, task, webfetch, websearch, memory tools, …).
• Loaded on demand — tools exposed by connected MCP servers (including Bolt). Discovered with tool_search and pulled in with load_tools.

Disabling a Tool

The tools config maps tool name → boolean. Set a tool to false to disable it:

{
  "tools": {
    "websearch": false
  }
}

Related Documentation

• Tools Overview — All tools and permissions
• Permissions — Permission model and glob patterns
• MCP — Connecting MCP servers