Bolt

Bolt provides access to 100+ Kali Linux security tools through a remote MCP server running in a Docker container. It features Ed25519 authentication and optional port knocking for secure remote access.

Why Bolt?

Bolt solves the problem of running security tools that require a Linux environment. Instead of installing dozens of tools locally, Bolt runs them in an isolated Docker container.

Architecture

flowchart TB
    subgraph Client["Cyberstrike CLI"]
        Agent[AI Agent]
        MCPClient[MCP Client]
        Auth[Ed25519 Auth]
    end

    subgraph Network["Network Layer"]
        HTTP[HTTP/MCP Transport]
        Knock[Port Knocking]
    end

    subgraph Bolt["Bolt Container"]
        Server[HTTP Server]
        Session[Session Manager]
        Registry[Tool Registry]
        Executor[Tool Executor]
    end

    subgraph Kali["Kali Tools"]
        Recon[Reconnaissance]
        Web[Web Application]
        AD[Active Directory]
        Pass[Password Attacks]
    end

    Agent --> MCPClient
    MCPClient --> Auth
    Auth --> Knock
    Knock --> HTTP
    HTTP --> Server
    Server --> Session
    Session --> Registry
    Registry --> Executor
    Executor --> Recon
    Executor --> Web
    Executor --> AD
    Executor --> Pass

    style Client fill:#3b82f6,color:#fff
    style Network fill:#8b5cf6,color:#fff
    style Bolt fill:#10b981,color:#fff
    style Kali fill:#f59e0b,color:#fff

Component Details

Quick Start

1. Start Bolt Server

# One-liner install (pulls from ghcr.io)
curl -sSL https://bolt.cyberstrike.io/install.sh | bash

Or manually with Docker:

docker run -d \
  --name bolt \
  -p 3001:3001 \
  -e MCP_ADMIN_TOKEN=$(openssl rand -hex 32) \
  ghcr.io/cyberstrike/bolt:latest

2. Get the Admin Token

docker logs bolt | grep "Admin token"

3. Add to Cyberstrike

Use the /bolt command in the TUI:

1. Press / and type bolt
2. Press a to add a new server
3. Enter URL: http://localhost:3001
4. Enter the admin token
5. Give it a name (e.g., “local”)

Or add manually to config:

{
  "mcp": {
    "bolt": {
      "type": "remote",
      "url": "http://localhost:3001/mcp",
      "bolt": true,
      "headers": {
        "Authorization": "Bearer YOUR_ADMIN_TOKEN"
      }
    }
  }
}

4. Use Bolt Tools

> Search for reconnaissance tools on bolt
> Load nmap and scan 192.168.1.1

Installation Methods

Docker (Recommended)

The official Docker image includes all Kali tools pre-installed:

# Using docker run
docker run -d \
  --name bolt \
  --restart unless-stopped \
  -p 3001:3001 \
  -v bolt-data:/data \
  -e MCP_ADMIN_TOKEN=$(openssl rand -hex 32) \
  --cap-add NET_RAW \
  --cap-add NET_ADMIN \
  ghcr.io/cyberstrike/bolt:latest

# View the admin token
docker logs bolt

Docker Compose

services:
  bolt:
    image: ghcr.io/cyberstrike/bolt:latest
    ports:
      - "3001:3001"
    environment:
      - MCP_ADMIN_TOKEN=${MCP_ADMIN_TOKEN}
    cap_add:
      - NET_RAW
      - NET_ADMIN
    volumes:
      - bolt-data:/data
    restart: unless-stopped

volumes:
  bolt-data:

export MCP_ADMIN_TOKEN=$(openssl rand -hex 32)
docker compose up -d

Local Installation (Without Docker)

If you have Kali tools installed locally:

{
  "mcp": {
    "bolt-local": {
      "type": "local",
      "command": ["npx", "@cyberstrike/mcp-kali"]
    }
  }
}

TUI Management

The /bolt command is the unified interface for managing all MCP servers - both the Bolt Kali container and your custom local/remote MCP servers.

The /bolt Command

Access MCP server management with /bolt in the TUI:

Server Type Indicators

Connection States

Available Tools

Bolt provides 100+ tools organized by category:

Reconnaissance

Web Application

Active Directory

Password Attacks

Exploitation

Meta-Tools

Bolt uses a dynamic tool loading system. These meta-tools manage which Kali tools are available:

list_tools

List all available tools or filter by category:

{
  "category": "reconnaissance",
  "limit": 20
}

search_tools

Search tools by name or description:

{
  "query": "sql injection",
  "limit": 10
}

load_tool

Load a tool into the current session:

{
  "tool": "nmap"
}

execute

Execute a loaded tool:

{
  "tool": "nmap",
  "args": ["-sV", "-sC", "192.168.1.1"]
}

list_loaded_tools

Show currently loaded tools and token usage:

{
  "loaded": ["nmap", "nikto"],
  "estimatedTokens": 2500,
  "budgetRemaining": 17500
}

unload_tool

Free up token budget by unloading tools:

{
  "tool": "nmap"
}

Usage Examples

Network Reconnaissance

> Use bolt to scan 192.168.1.0/24 for open ports and services

The agent will:

1. Load nmap via bolt_load_tool
2. Execute scan via bolt_execute
3. Parse and present results

Subdomain Enumeration

> Find all subdomains of example.com using bolt

Uses subfinder, amass, or similar tools.

SQL Injection Testing

> Test https://target.com/page?id=1 for SQL injection via bolt

Loads sqlmap and runs automated testing.

Active Directory Assessment

> Enumerate the AD environment at 192.168.1.10 using bolt

Uses netexec, enum4linux-ng, and related tools.

Security Features

Authentication Methods

flowchart LR
    subgraph Simple["Admin Token (Simple)"]
        Token[Bearer Token]
        Header[Authorization Header]
        Token --> Header
    end

    subgraph Advanced["Ed25519 (Advanced)"]
        KeyPair[Key Pair]
        Sign[Sign Request]
        Verify[Server Verify]
        KeyPair --> Sign
        Sign --> Verify
    end

    style Simple fill:#3b82f6,color:#fff
    style Advanced fill:#10b981,color:#fff

Admin Token (Simple)

Use a bearer token for authentication:

{
  "headers": {
    "Authorization": "Bearer YOUR_ADMIN_TOKEN"
  }
}

Ed25519 Keys (Advanced)

For production deployments, use asymmetric key authentication:

1. Generate client keys
2. Pair with the server via /pair endpoint
3. Sign requests with your private key

Port Knocking (SPA)

Enable port knocking to hide the server from port scans:

docker run -d \
  --name bolt \
  -p 3001:3001 \
  -p 49152-65535:49152-65535/udp \
  -e KNOCK_ENABLED=true \
  ghcr.io/cyberstrike/bolt:latest node dist/http.js --knock

How it works:

sequenceDiagram
    participant Client as Cyberstrike
    participant FW as Firewall
    participant Bolt as Bolt Server

    Note over FW: Port 3001 blocked
    Client->>FW: UDP knock to port X
    Note over FW: HMAC(key, time/60) = X
    FW->>FW: Verify knock
    FW->>FW: Open port 3001 (60s)
    Client->>Bolt: HTTP/MCP request
    Bolt-->>Client: Response

With knock enabled:

• Port 3001 is blocked by iptables
• Clients must send a UDP knock packet first
• Knock ports rotate every 60 seconds
• Port is derived from: HMAC-SHA256(boltKey, timestamp/60)

Configuration

Environment Variables

Docker Capabilities

For full functionality, Bolt needs:

Volumes

Comparison: Local vs Remote

Troubleshooting

Connection Refused

Error: Connection refused

1. Check Docker is running: docker ps
2. Verify port mapping: docker port bolt
3. Test health endpoint: curl http://localhost:3001/health

Tools Not Loading

> Agent says "tool not found"

1. Verify MCP is connected: /bolt in TUI
2. Check model supports MCP (not subprocess models like claude-cli)
3. Restart Cyberstrike after adding Bolt

Subprocess Models

Use direct API models:

• anthropic/claude-sonnet-4
• anthropic/claude-opus-4
• openai/gpt-4o

Port Knocking Issues

If knock is enabled but connection fails:

1. Ensure UDP ports are forwarded: -p 49152-65535:49152-65535/udp
2. Check bolt key is correct
3. Verify system clocks are synchronized

API Reference

Health Check

curl http://localhost:3001/health

Response:

{
  "status": "ok",
  "version": "1.0.0",
  "tools": 100,
  "sessions": 2
}

MCP Endpoint

POST /mcp

Standard MCP JSON-RPC endpoint for tool calls.

Pairing (Ed25519)

POST /pair          # Start pairing with code
POST /pair/exchange # Exchange public keys
GET  /pair/clients  # List paired clients (admin only)

Related Documentation

• Bolt / MCP Overview - Architecture and concepts
• Remote Servers - Remote MCP configuration
• Local Servers - Alternative local setup
• Permissions - Tool permissions