Project Configuration

Project configuration customizes Cyberstrike behavior for specific projects, overriding global settings when present.

📸 SCREENSHOT: project-config.png

Project configuration file structure

File Location

Project configuration is stored in cyberstrike.json at the project root:

my-project/
├── cyberstrike.json     ← Project config
├── src/
├── package.json
└── ...

Creating Project Config

Interactive Creation

cyberstrike config init

Manual Creation

{
  "$schema": "https://cyberstrike.io/schema/config.json",
  "model": "anthropic/claude-sonnet-4-20250514"
}

Basic Settings

Model Selection

{
  "model": "anthropic/claude-opus-4-5-20251101"
}

Agent Selection

{
  "agent": "web-application"
}

Custom Instructions

{
  "instructions": "This is a Node.js security application. Focus on OWASP Top 10 vulnerabilities. All code is TypeScript."
}

Provider Configuration

Default Provider

{
  "provider": {
    "default": "anthropic",
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    }
  }
}

Multiple Providers

{
  "provider": {
    "default": "anthropic",
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    },
    "openai": {
      "options": {
        "apiKey": "{env:OPENAI_API_KEY}"
      }
    }
  }
}

Permissions

Allow Patterns

{
  "permissions": {
    "allow": [
      "Read(**)",
      "Bash(npm test)",
      "Bash(npm run lint)",
      "Write(reports/**)"
    ]
  }
}

Deny Patterns

{
  "permissions": {
    "deny": [
      "Bash(rm -rf *)",
      "Write(.env*)",
      "Read(secrets/**)"
    ]
  }
}

Permission Mode

{
  "permissions": {
    "mode": "default"
  }
}

Options: default, plan, auto

MCP Servers

Project-Specific Servers

{
  "mcp": {
    "servers": {
      "project-tools": {
        "command": "node",
        "args": ["./tools/mcp-server.js"]
      }
    }
  }
}

Disable Global Servers

{
  "mcp": {
    "inheritGlobal": false,
    "servers": {
      "local-only": {
        "command": "./mcp-server"
      }
    }
  }
}

Hooks

Project Hooks

{
  "hooks": {
    "preToolUse": [
      {
        "matcher": "Bash",
        "command": "./scripts/validate-command.sh"
      }
    ],
    "postToolUse": [
      {
        "matcher": "Write(*)",
        "command": "npm run lint --fix"
      }
    ]
  }
}

Context Files

Include Files

{
  "context": {
    "include": [
      "README.md",
      "ARCHITECTURE.md",
      "docs/security-guidelines.md"
    ]
  }
}

Exclude Patterns

{
  "context": {
    "exclude": [
      "node_modules/**",
      "dist/**",
      "*.log"
    ]
  }
}

Custom Agents

Define Project Agent

{
  "agents": [
    {
      "name": "project-scanner",
      "path": ".cyberstrike/agents/scanner.md"
    }
  ]
}

Set Default Agent

{
  "agent": "project-scanner"
}

Output Settings

Output Directory

{
  "output": {
    "directory": "./security-reports",
    "format": "markdown"
  }
}

Auto-Save Sessions

{
  "output": {
    "autoSave": true,
    "sessionDir": "./.cyberstrike/sessions"
  }
}

Security Settings

Sensitive File Protection

{
  "security": {
    "protectedFiles": [
      ".env*",
      "*.pem",
      "*.key",
      "credentials.*"
    ]
  }
}

Command Restrictions

{
  "security": {
    "allowedCommands": [
      "npm",
      "git",
      "nmap",
      "nuclei"
    ],
    "blockedCommands": [
      "rm",
      "dd",
      "curl | bash"
    ]
  }
}

Full Example

{
  "$schema": "https://cyberstrike.io/schema/config.json",
  "model": "anthropic/claude-sonnet-4-20250514",
  "agent": "web-application",
  "instructions": "This is an e-commerce application built with Next.js and PostgreSQL. Focus on authentication, payment processing, and data validation security.",
  "provider": {
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    }
  },
  "permissions": {
    "mode": "default",
    "allow": [
      "Read(**)",
      "Bash(npm *)",
      "Bash(git status)",
      "Write(reports/**)"
    ],
    "deny": [
      "Write(.env*)",
      "Bash(rm *)"
    ]
  },
  "context": {
    "include": [
      "README.md",
      "docs/SECURITY.md"
    ],
    "exclude": [
      "node_modules/**",
      ".next/**"
    ]
  },
  "mcp": {
    "servers": {
      "db-tools": {
        "command": "node",
        "args": ["./tools/db-mcp.js"]
      }
    }
  },
  "output": {
    "directory": "./security-reports",
    "autoSave": true
  }
}

Configuration Inheritance

Project config inherits from global config:

Global Config (base)
      ↓
Project Config (override)
      ↓
Environment Variables (override)
      ↓
Command Line Args (override)

Override Behavior

Setting	Behavior
Scalars	Replaced
Objects	Merged
Arrays	Replaced (unless `+` prefix)

Array Append

{
  "permissions": {
    "allow": [
      "+Bash(project-specific)"
    ]
  }
}

The + prefix appends to global array instead of replacing.

Validation

Validate Config

cyberstrike config validate

Schema Validation

Add schema reference for IDE support:

{
  "$schema": "https://cyberstrike.io/schema/config.json"
}

Git Integration

Commit Project Config

git add cyberstrike.json
git commit -m "Add Cyberstrike project configuration"

Ignore Sensitive Data

# Ignore local overrides
cyberstrike.local.json

# Ignore session data
.cyberstrike/sessions/

Best Practices

Version control - Commit project config for team sharing
Use env references - Never hardcode API keys
Document instructions - Help team understand context
Minimal permissions - Only allow what’s needed
Include context files - Help AI understand project

Tip

Use cyberstrike.local.json for personal settings that shouldn’t be committed.

Global Config - Global settings
Environment Variables - Env var reference
Configuration Overview - Full guide