Tools Reference

Cyberstrike provides a comprehensive set of built-in tools for security assessments. These tools enable file operations, command execution, web automation, and persistent memory across sessions.

Tool Categories

File Operations

Read

Reads file contents with line numbers. Supports text files, images, and PDFs.

Parameters

Example

{
  "filePath": "/path/to/file.txt",
  "offset": 100,
  "limit": 500
}

Output Format

00001| First line of content
00002| Second line of content
00003| Third line of content

(End of file - total 3 lines)

Features

• Automatic binary file detection
• Image and PDF support (returns base64 encoded content)
• Line truncation at 2000 characters
• Maximum 50KB per read operation
• Smart file suggestions on not found errors

Write

Creates or overwrites a file with new content.

Parameters

Example

{
  "filePath": "/path/to/new-file.txt",
  "content": "File contents here"
}

Features

• Creates parent directories if needed
• Generates unified diff for review
• LSP diagnostics after write
• File time tracking for conflict detection

Edit

Performs find-and-replace operations on files with smart matching.

Parameters

Example

{
  "filePath": "/path/to/file.ts",
  "oldString": "function oldName(",
  "newString": "function newName(",
  "replaceAll": false
}

Smart Matching

The Edit tool uses multiple matching strategies:

1. Simple Replacement: Exact string match
2. Line Trimmed: Ignores leading/trailing whitespace per line
3. Block Anchor: Matches first and last lines, fuzzy middle
4. Whitespace Normalized: Collapses multiple spaces
5. Indentation Flexible: Ignores indentation differences
6. Escape Normalized: Handles escape sequences
7. Context Aware: Uses surrounding context for matching

Features

• Unified diff generation
• LSP diagnostics after edit
• Multiple occurrence detection
• Conflict prevention via file time tracking

Glob

Finds files matching a glob pattern.

Parameters

Example

{
  "pattern": "**/*.{ts,tsx}",
  "path": "/path/to/project"
}

Output

Returns file paths sorted by modification time (newest first), limited to 100 results.

Pattern Examples

Grep

Searches file contents using regex patterns. Built on ripgrep.

Parameters

Example

{
  "pattern": "password|secret|api_key",
  "path": "/path/to/project",
  "include": "*.{js,ts,py}"
}

Output Format

Found 5 matches

/path/to/file.ts:
  Line 42: const apiKey = process.env.API_KEY
  Line 85: // TODO: remove hardcoded secret

/path/to/config.js:
  Line 12: password: "changeme"

Features

• Regex support (ripgrep syntax)
• Hidden file search
• Symlink following
• Results sorted by modification time
• Maximum 100 results

Command Execution

Bash

Executes shell commands with timeout and output capture.

Parameters

Example

{
  "command": "nmap -sV -sC target.com",
  "timeout": 300000,
  "workdir": "/path/to/project",
  "description": "Scan target for open ports and services"
}

Features

• Shell detection (bash/zsh/sh)
• Process tree killing on timeout
• Permission system integration
• Real-time output streaming
• External directory access control

Security Considerations

Commands are parsed with tree-sitter to detect:

• Directory access outside project
• Dangerous command patterns
• File system modifications

Web Automation

Browser

Playwright-based browser automation with full traffic capture for security testing.

Parameters

Actions

Example Session

// Launch browser
{ "action": "launch" }

// Navigate to target
{ "action": "navigate", "url": "https://target.com/login" }

// Fill login form
{ "action": "fill", "selector": "#username", "value": "admin" }
{ "action": "fill", "selector": "#password", "value": "test123" }

// Click submit
{ "action": "click", "selector": "button[type=submit]" }

// Check network traffic for credentials
{ "action": "network", "filter": { "method": "POST" } }

// Export HAR for analysis
{ "action": "har" }

// Close browser
{ "action": "close" }

Network Filter Options

{
  "filter": {
    "urlPattern": "/api/",
    "method": "POST",
    "statusCode": 200,
    "resourceType": "xhr"
  }
}

Features

• Full HTTP traffic capture
• HAR file export
• Console log capture
• JavaScript execution
• Form interaction
• Screenshot capture
• Cyberstrike banner injection for identification

Memory System

Cyberstrike includes a persistent memory system for storing context across sessions.

Memory Write

Stores information to persistent memory.

Parameters

Example

{
  "content": "Target uses PostgreSQL 14.2 on port 5432",
  "type": "long_term",
  "title": "Database Configuration"
}

Memory Types

Memory Search

Searches through stored memory.

Parameters

Example

{
  "query": "database credentials"
}

Memory Read

Reads specific memory files.

Parameters

File Identifiers

Memory Context

Retrieves full memory context for the session.

Parameters

None required.

Example

{}

Returns combined long-term memory and recent daily notes.

Dynamic Tool Loading

Cyberstrike supports dynamic tool loading for MCP (Model Context Protocol) servers. This enables access to hundreds of tools without overwhelming the context window.

Tool Search

Searches available MCP tools by capability.

Parameters

Example

{
  "query": "sql injection testing",
  "limit": 10
}

Output

Found 3 tools:

1. sqlmap_scan
   SQL injection scanner using sqlmap
   Estimated tokens: ~500

2. nuclei_sqli
   Nuclei templates for SQL injection
   Estimated tokens: ~300

3. manual_sqli
   Manual SQL injection payloads
   Estimated tokens: ~200

Load Tools

Loads tools into context for use.

Parameters

Example

{
  "tool_ids": ["sqlmap_scan", "nuclei_sqli"]
}

Unload Tools

Removes tools from context to free budget.

Parameters

List Loaded Tools

Shows currently loaded tools and token usage.

Parameters

None required.

Task Management

Task

Creates and manages sub-tasks for complex operations.

Parameters

TodoWrite

Writes task items to a todo list.

Parameters

Task Object

{
  "id": "1",
  "content": "Scan for open ports",
  "status": "pending",
  "priority": "high"
}

TodoRead

Reads current todo list.

Parameters

None required.

Web Tools

WebFetch

Fetches and processes web content.

Parameters

Example

{
  "url": "https://target.com/robots.txt",
  "prompt": "Extract all disallowed paths"
}

WebSearch

Performs web searches for information gathering.

Parameters

CodeSearch

Searches code repositories and documentation.

Parameters

Tool Permissions

Each tool requires specific permissions that can be configured:

Configuration

{
  "permission": {
    "bash": "ask",
    "edit": "allow",
    "read": "allow",
    "glob": "allow",
    "grep": "allow",
    "browser": "ask"
  }
}

Permission Modes

Creating Custom Tools

Add custom tools by creating files in .cyberstrike/tools/:

export default {
  description: "Custom vulnerability scanner",
  args: {
    target: {
      type: "string",
      description: "Target URL to scan"
    },
    depth: {
      type: "number",
      description: "Scan depth",
      default: 3
    }
  },
  async execute(args, ctx) {
    const { target, depth } = args
    // Custom scanning logic
    return `Scanned ${target} to depth ${depth}`
  }
}

Tool Definition Schema

MCP Server Tools

Cyberstrike can load tools from MCP servers. Configure servers in cyberstrike.json:

{
  "mcp": {
    "kali-tools": {
      "type": "local",
      "command": ["npx", "@cyberstrike/mcp-kali"],
      "enabled": true
    }
  }
}

MCP tools become available through the Tool Search system.