Skip to main content

Cyberstrike is now open source! AI-powered penetration testing for security professionals. Star on GitHub

Configuration

Cyberstrike is configured with a JSON file. This page is a quick introduction; for the full hierarchy, every option, and related guides, see the Configuration reference.

Configuration File

Create a cyberstrike.json in your project directory:

cyberstrike.json
{
"$schema": "https://cyberstrike.io/config.json",
"model": "anthropic/claude-sonnet-4-20250514",
"default_agent": "cyberstrike",
"theme": "cyberstrike"
}

The model is written as provider/model — there is no separate string provider field. default_agent must be a primary agent (cyberstrike is the built-in one; it delegates to specialized subagents automatically).

Common Options

OptionTypeDescription
modelstringDefault model, as provider/model
small_modelstringModel for lightweight tasks (title generation)
default_agentstringDefault primary agent (falls back to cyberstrike)
themestringInterface theme (default cyberstrike)
permissionobjectPer-tool permissions — see Permissions
providerobjectPer-provider settings, keyed by provider id
instructionsstring[]Files/globs appended to the system prompt

Environment Variables

Set your API keys as environment variables:

Terminal window
export ANTHROPIC_API_KEY="sk-ant-..."
export OPENAI_API_KEY="sk-..."
export GOOGLE_GENERATIVE_AI_API_KEY="AI..."

Permissions & Providers

Grant or restrict tools with permission, and tune a provider under provider:

cyberstrike.json
{
"permission": {
"read": "allow",
"bash": { "*": "ask", "rm -rf *": "deny" }
},
"provider": {
"anthropic": {
"options": { "apiKey": "{env:ANTHROPIC_API_KEY}" }
}
}
}

Caution

Never commit API keys to version control. Use environment variables or a .env file (added to .gitignore).

See the Configuration reference for the complete schema, precedence order, MCP, keybindings, and more.