Bolt / MCP Overview

Cyberstrike uses the Model Context Protocol (MCP) to integrate external tools. Bolt is our containerized tool server that ships a large set of security tools; you can also connect any local or remote MCP server.

Two Ways to Add Tools

Cyberstrike also ships three MCP servers enabled by default: github-security, cve, and osint. Your own config is merged on top of these.

Bolt

Bolt runs security tools inside a Docker container (Ubuntu 24.04, port 3001). It exposes 7 native plugins (subfinder, nmap, nuclei, httpx, ffuf, run-command, wordlist) plus ~26 aggregated MCP servers (dnsx, amass, katana, sqlmap, wpscan, hydra, hashcat, and more). Every tool is directly callable — the agent invokes it in one turn.

Bolt is configured under its own top-level bolt key (not mcp) and authenticated by Ed25519 pairing:

{
  "bolt": {
    "local": { "url": "http://localhost:3001" }
  }
}

See the Bolt page for setup and pairing.

Local / Remote MCP

Any other MCP server goes under the flat mcp map, keyed by name:

{
  "mcp": {
    "my-tools": {
      "type": "local",
      "command": ["your-mcp-server"]
    }
  }
}

• Local Servers — stdio child processes
• Remote Servers — StreamableHTTP/SSE, with optional OAuth

TUI Management

Two separate dialogs:

• /bolt — manage Bolt servers (add & pair, toggle, remove).
• /mcps — manage local/remote MCP servers.

In both: a to add, space to toggle a server, esc to close.

Model Compatibility

Direct-API models (e.g. anthropic/claude-sonnet-4-20250514, openai/gpt-4o) run inside Cyberstrike and have full MCP access. Models that shell out to a separate CLI process do not.

Configuration Precedence

MCP and Bolt entries follow the standard configuration hierarchy: a project’s .cyberstrike/ directory overrides the project cyberstrike.json, which overrides the global ~/.config/cyberstrike/ config, which overrides the built-in servers.

Documentation