Skip to main content

Cyberstrike is now open source! AI-powered penetration testing for security professionals. Star on GitHub

On this page

Local MCP Servers

Local MCP servers run on your machine as child processes, communicating over stdio. This is an alternative to Bolt for users who prefer to run tools directly on their system.

Tip

Prefer Bolt for security tools. Local MCP requires installing each tool yourself. See Bolt for the recommended approach with pre-installed security-tool plugins.

📸 SCREENSHOT: local-mcp-config.png

Local MCP server configuration in cyberstrike.json

When to Use Local MCP

  • Offline environments — no network access required
  • Low latency — direct process communication over stdio
  • Custom tools — your own MCP servers
  • Privacy — data never leaves your machine

Cyberstrike also ships a few local MCP servers enabled by default: github-security, cve, and osint. Your config is merged on top of these.

Configuration Schema

A local server is one entry in the flat mcp map, keyed by server name:

~/.config/cyberstrike/cyberstrike.json
{
  "mcp": {
    "my-tools": {
      "type": "local",
      "command": ["npx", "-y", "my-mcp-server"],
      "environment": { "API_KEY": "{env:MY_API_KEY}" },
      "enabled": true,
      "timeout": 5000
    }
  }
}
FieldTypeDescription
type"local"Required. Selects a stdio child-process server.
commandstring[]Required. The command and its arguments as one array.
environmentobjectOptional. Extra environment variables for the process.
enabledbooleanOptional. Start the server on launch (default: true).
timeoutnumberOptional. Request timeout in ms (default: 5000).

Caution

The mcp object is a flat map keyed by server name — there is no servers wrapper. command is a single array (command + args together); there is no separate args, cwd, autoStart, or restart field. Unknown keys are rejected.

Adding via the TUI

The easiest way to add a local server is from the TUI with the /mcps command.

Type /mcps to open the MCP manager. It lists configured servers with their status (✓ enabled / ○ disabled). Press space to toggle a server, a to add one, Enter to act on the selection.

To add a local server: press a → choose Local → enter the command (e.g. npx my-mcp-server) → optionally add environment variables (KEY=VALUE, KEY2=VALUE2) → confirm the auto-derived name. Cyberstrike tests the connection before saving; if it fails, the server is not added.

The TUI writes exactly the schema shown above.

Examples

Node.js server 

{
  "mcp": {
    "filesystem": {
      "type": "local",
      "command": ["npx", "-y", "@modelcontextprotocol/server-filesystem", "/path/to/allow"]
    }
  }
}

Python server 

{
  "mcp": {
    "python-tools": {
      "type": "local",
      "command": ["python", "-m", "mcp_server"]
    }
  }
}

Binary or Docker

Because command is the full argv, you can run a binary directly or wrap it in Docker — no special fields needed:

{
  "mcp": {
    "docker-tools": {
      "type": "local",
      "command": ["docker", "run", "-i", "--rm", "--network=none", "mcp-tools:latest"]
    }
  }
}

Environment Variables

Pass variables to the server process with environment. Use {env:VAR} to reference a variable from your shell instead of hard-coding secrets:

{
  "mcp": {
    "api-tools": {
      "type": "local",
      "command": ["node", "server.js"],
      "environment": {
        "API_KEY": "{env:MY_API_KEY}",
        "DEBUG": "mcp:*"
      }
    }
  }
}

Enabling & Disabling

Set enabled: false to keep a server configured but inactive (or toggle it in the /mcps dialog):

{
  "mcp": {
    "heavy-tools": {
      "type": "local",
      "command": ["node", "server.js"],
      "enabled": false
    }
  }
}

Slow-Starting Servers

Raise timeout (milliseconds) for servers that take longer than the 5-second default to respond:

{
  "mcp": {
    "slow-tools": {
      "type": "local",
      "command": ["node", "server.js"],
      "timeout": 30000
    }
  }
}

Troubleshooting

  • Server won’t start — verify the first element of command exists and is executable, and that its dependencies are installed. Inspect the connection with cyberstrike mcp debug <name>.
  • Connection timeout — increase timeout, or check that the server responds to tools/list quickly.
  • Config rejected — the mcp schema is strict; make sure you used the flat map with type + command (array) and no unknown keys.

Related Documentation