Bolt

Bolt is a containerized MCP server that provides security tools. It runs in a Docker container (Ubuntu 24.04) and exposes each tool directly — no meta-tools, no dynamic loading, just call the tool you need.

Why Bolt?

What’s Inside

Bolt exposes tools two ways:

• 7 native plugins — subfinder, nmap, nuclei, httpx, ffuf, run-command, wordlist
• ~26 aggregated stdio MCP servers — dnsx, amass, katana, sqlmap, wpscan, gobuster, masscan, hydra, hashcat, john, impacket, and more

Each is a directly callable tool — the agent calls it in a single turn.

Quick Start

1. Start the Bolt container

docker run -d \
  --name bolt \
  --restart unless-stopped \
  -p 3001:3001 \
  -v bolt-data:/data \
  -e MCP_ADMIN_TOKEN=$(openssl rand -hex 32) \
  --cap-add NET_RAW \
  --cap-add NET_ADMIN \
  ghcr.io/cyberstrikeus/bolt:latest

docker logs bolt | grep -i token

2. Pair it with Cyberstrike

Run /bolt in the TUI, press a to add, enter the URL http://localhost:3001, and provide the admin token.

3. Use the tools

Type your task directly — the agent calls Bolt tools automatically:

> Run nmap against 192.168.1.1 with service detection
> Use subfinder to enumerate subdomains of example.com
> Scan https://target.com with nuclei

Configuration

Bolt servers are configured under the bolt key — not under mcp:

{
  "bolt": {
    "local": {
      "url": "http://localhost:3001",
      "enabled": true,
      "timeout": 30000
    }
  }
}

Authentication

Bolt uses Ed25519 request signing, bootstrapped by a one-time pairing:

1. POST /pair with the admin token → a pairing code
2. Cyberstrike generates an Ed25519 keypair
3. POST /pair/exchange with the code + client public key → server public key + client ID
4. Every subsequent request is signed with the client’s private key

The admin token is used only during step 1 — it is never stored in config.

TUI Management

• /bolt — manages Bolt servers (add/pair, toggle, remove)
• /mcps — manages regular MCP servers

Usage Examples

> Use bolt to scan 192.168.1.0/24 for open ports and services   # nmap
> Find all subdomains of example.com                            # subfinder
> Scan https://target.com with nuclei                           # nuclei
> Fuzz directories on https://target.com                        # ffuf
> Run "dig +short example.com"                                  # run-command

Troubleshooting

• Connection refused — check the container is up (docker ps) and curl http://localhost:3001/health responds.
• Re-pairing required — if the Bolt URL changes, pair again via /bolt.
• Tools not available — confirm the server is connected in /bolt, use a direct-API model.