Bolt / MCP Overview

Cyberstrike uses the Model Context Protocol (MCP) to integrate with external security tools. Bolt is our recommended way to access 100+ Kali Linux tools through a Docker container.

Architecture Overview

Cyberstrike provides two approaches to access security tools:

flowchart TB
    subgraph User["Your Machine"]
        CS[Cyberstrike CLI]
        Agent[AI Agent]
    end

    subgraph Bolt["Bolt (Recommended)"]
        Docker[Docker Container]
        Kali[100+ Kali Tools]
        HTTP[HTTP/MCP Transport]
    end

    subgraph Local["Local MCP"]
        Stdio[Stdio Transport]
        LocalTools[Locally Installed Tools]
    end

    Agent --> CS
    CS -->|"HTTP (Remote)"| HTTP
    HTTP --> Docker
    Docker --> Kali

    CS -->|"Stdio (Local)"| Stdio
    Stdio --> LocalTools

    style Bolt fill:#10b981,color:#fff
    style Local fill:#6b7280,color:#fff

Quick Comparison

Bolt (Recommended)

# One command to start
curl -sSL https://bolt.cyberstrike.io/install.sh | bash

• 100+ pre-installed Kali tools
• Docker-based isolation
• Ed25519 authentication
• Optional port knocking
• Works on any platform

Local MCP

{
  "mcp": {
    "kali": {
      "type": "local",
      "command": ["npx", "@cyberstrike/mcp-kali"]
    }
  }
}

• Requires tools installed locally
• Direct system access
• Zero network latency
• Best for offline use

How It Works

1. Tool Discovery

The AI agent searches for needed capabilities:

sequenceDiagram
    participant Agent as AI Agent
    participant CS as Cyberstrike
    participant MCP as MCP Server
    participant Tool as Kali Tool

    Agent->>CS: "I need to scan ports"
    CS->>MCP: tool_search("port scanner")
    MCP-->>CS: [nmap, masscan, ...]
    CS-->>Agent: Available: nmap, masscan

2. Tool Loading

Selected tools are loaded into the agent’s context:

sequenceDiagram
    participant Agent as AI Agent
    participant CS as Cyberstrike
    participant MCP as MCP Server

    Agent->>CS: load_tool("nmap")
    CS->>MCP: tools/list
    MCP-->>CS: nmap schema + description
    CS-->>Agent: nmap ready (350 tokens)

3. Tool Execution

The agent calls tools with appropriate arguments:

sequenceDiagram
    participant Agent as AI Agent
    participant CS as Cyberstrike
    participant MCP as MCP Server
    participant Tool as nmap

    Agent->>CS: bolt_execute(nmap, ["-sV", "target"])
    CS->>MCP: tools/call
    MCP->>Tool: spawn process
    Tool-->>MCP: scan results
    MCP-->>CS: JSON output
    CS-->>Agent: Formatted results

Dynamic Tool Loading

Cyberstrike uses a dynamic loading system to manage 100+ tools without overwhelming the AI context window.

Token Budget System

Each tool consumes context tokens based on its schema complexity:

Default budget: 20,000 tokens for MCP tools

Meta-Tools

These tools manage the dynamic loading system:

TUI Management

Use the /bolt command to manage all MCP servers (both local and remote) in the TUI:

Keyboard Shortcuts

Status Indicators

Connection States:

• Green = Connected
• Gray = Disabled
• Red = Failed
• Yellow = Needs Auth

Model Compatibility

Supported Models (Direct API)

These models run within Cyberstrike and have full MCP access:

• anthropic/claude-sonnet-4
• anthropic/claude-opus-4
• openai/gpt-4o
• openai/gpt-4o-mini

Unsupported Models (Subprocess)

These models run as separate processes and cannot access MCP:

• claude-cli/opus (runs claude CLI as subprocess)
• claude-cli/sonnet
• Any subprocess-based model

flowchart LR
    subgraph Supported["✅ Direct API Models"]
        API[anthropic/claude-*]
        MCP1[MCP Access]
        API --> MCP1
    end

    subgraph Unsupported["❌ Subprocess Models"]
        Sub[claude-cli/*]
        Sep[Separate Process]
        Sub --> Sep
        Sep -. No Access .-> MCP2[MCP]
    end

    style Supported fill:#10b981,color:#fff
    style Unsupported fill:#ef4444,color:#fff

Configuration Locations

MCP servers can be configured at multiple levels:

Project configuration overrides global configuration.

Getting Started

Option 1: Bolt (Recommended)

1. Start Bolt server:

   curl -sSL https://bolt.cyberstrike.io/install.sh | bash

2. Get admin token:

   docker logs bolt | grep "Admin token"

3. Add in TUI: Press /bolt → a → Enter URL and token

See Bolt documentation for full details.

Option 2: Local MCP

1. Install tools locally (nmap, sqlmap, etc.)

2. Configure MCP:

   {
     "mcp": {
       "kali": {
         "type": "local",
         "command": ["npx", "@cyberstrike/mcp-kali"]
       }
     }
   }

See Local Servers for details.

Documentation Structure