Project Configuration

Project configuration customizes Cyberstrike behavior for specific projects, overriding global settings when present.

File Location

Project configuration is stored in cyberstrike.json (or cyberstrike.jsonc) at the project root. Cyberstrike walks up from the working directory, so a config in any parent folder is picked up:

my-project/
├── cyberstrike.json     ← Project config
├── src/
├── package.json
└── ...

Creating Project Config

There is no init command — create the file manually:

{
  "$schema": "https://cyberstrike.io/config.json",
  "model": "anthropic/claude-sonnet-4-20250514"
}

Basic Settings

Model Selection

{
  "model": "anthropic/claude-opus-4-5-20251101"
}

Default Agent

{
  "default_agent": "cyberstrike"
}

default_agent must be a primary agent; it falls back to cyberstrike if unset or invalid.

Custom Instructions

instructions is a list of files or glob patterns whose contents are appended to the system prompt (it is not inline prose). Lists are union-merged with the global config:

{
  "instructions": [
    "SECURITY.md",
    "docs/security-guidelines.md",
    ".cursor/rules/*.md"
  ]
}

Provider Configuration

Configure providers under provider. There is no provider.default key — the active provider follows from model (provider/model):

{
  "provider": {
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    },
    "openai": {
      "options": {
        "apiKey": "{env:OPENAI_API_KEY}"
      }
    }
  }
}

See AI Providers for per-provider details.

Permissions

Permissions map a tool name to an action (ask, allow, deny) or to a glob → action map. There are no allow/deny arrays and no permission “modes”:

{
  "permission": {
    "read": "allow",
    "bash": {
      "npm test": "allow",
      "npm run lint": "allow",
      "rm -rf *": "deny"
    },
    "edit": {
      "reports/**": "allow",
      ".env*": "deny"
    }
  }
}

Only * and ? are supported as wildcards. See Permissions for the full model and the complete list of permission keys.

MCP Servers

MCP servers are declared as a flat map under mcp, keyed by server name. Local servers use type: "local" with a single command array:

{
  "mcp": {
    "project-tools": {
      "type": "local",
      "command": ["node", "./tools/mcp-server.js"],
      "enabled": true
    }
  }
}

Project mcp entries are merged on top of global ones. To turn off an inherited server, set its enabled to false:

{
  "mcp": {
    "some-global-server": { "enabled": false }
  }
}

Custom Agents

Define project agents as Markdown files under .cyberstrike/agents/ (see Custom Agents), then select one as the default:

{
  "default_agent": "project-scanner"
}

Full Example

{
  "$schema": "https://cyberstrike.io/config.json",
  "model": "anthropic/claude-sonnet-4-20250514",
  "default_agent": "cyberstrike",
  "instructions": ["docs/SECURITY.md"],

  "provider": {
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    }
  },

  "permission": {
    "read": "allow",
    "bash": { "npm *": "allow", "git status": "allow", "rm *": "deny" },
    "edit": { "reports/**": "allow", ".env*": "deny" }
  },

  "mcp": {
    "db-tools": {
      "type": "local",
      "command": ["node", "./tools/db-mcp.js"],
      "enabled": true
    }
  }
}

Configuration Inheritance

Project config is merged on top of global and remote config:

Remote / well-known config (base)
      ↓
Global config (~/.config/cyberstrike/)
      ↓
Custom config (CYBERSTRIKE_CONFIG)
      ↓
Project config (cyberstrike.json)
      ↓
.cyberstrike/ directory config
      ↓
CYBERSTRIKE_CONFIG_CONTENT / managed config / CLI args (override)

See the Configuration Reference for the complete priority order.

Merge Behavior

Schema Validation

Add the schema reference for IDE autocomplete and validation:

{
  "$schema": "https://cyberstrike.io/config.json"
}

Git Integration

Commit Project Config

git add cyberstrike.json
git commit -m "Add Cyberstrike project configuration"

Ignore Sensitive Data

# Ignore local session data
.cyberstrike/sessions/

Best Practices

1. Version control - Commit project config for team sharing
2. Use env references - Never hardcode API keys ({env:VAR})
3. Document instructions - Point instructions at your security docs
4. Minimal permissions - Only allow what’s needed
5. Personal overrides - Use CYBERSTRIKE_CONFIG for settings that shouldn’t be committed

Related Documentation

• Configuration Reference - Full guide
• Global Config - Global settings
• Environment Variables - Env var reference