Tools Reference

Cyberstrike provides a comprehensive set of built-in tools for security assessments. These tools enable file operations, command execution, web automation, and persistent memory across sessions.

Tool Categories

File Operations

Read

Reads file contents with line numbers. Supports text files, images, and PDFs.

Parameters

Example

{
  "filePath": "/path/to/file.txt",
  "offset": 100,
  "limit": 500
}

Output Format

00001| First line of content
00002| Second line of content
00003| Third line of content

(End of file - total 3 lines)

Features

• Automatic binary file detection
• Image and PDF support (returns base64 encoded content)
• Line truncation at 2000 characters
• Maximum 50KB per read operation
• Smart file suggestions on not found errors

Write

Creates or overwrites a file with new content.

Parameters

Example

{
  "filePath": "/path/to/new-file.txt",
  "content": "File contents here"
}

Features

• Creates parent directories if needed
• Generates unified diff for review
• LSP diagnostics after write
• File time tracking for conflict detection

Edit

Performs find-and-replace operations on files with smart matching.

Parameters

Example

{
  "filePath": "/path/to/file.ts",
  "oldString": "function oldName(",
  "newString": "function newName(",
  "replaceAll": false
}

Smart Matching

The Edit tool uses multiple matching strategies:

1. Simple Replacement: Exact string match
2. Line Trimmed: Ignores leading/trailing whitespace per line
3. Block Anchor: Matches first and last lines, fuzzy middle
4. Whitespace Normalized: Collapses multiple spaces
5. Indentation Flexible: Ignores indentation differences
6. Escape Normalized: Handles escape sequences
7. Context Aware: Uses surrounding context for matching

Features

• Unified diff generation
• LSP diagnostics after edit
• Multiple occurrence detection
• Conflict prevention via file time tracking

Glob

Finds files matching a glob pattern.

Parameters

Example

{
  "pattern": "**/*.{ts,tsx}",
  "path": "/path/to/project"
}

Output

Returns file paths sorted by modification time (newest first), limited to 100 results.

Pattern Examples

Grep

Searches file contents using regex patterns. Built on ripgrep.

Parameters

Example

{
  "pattern": "password|secret|api_key",
  "path": "/path/to/project",
  "include": "*.{js,ts,py}"
}

Output Format

Found 5 matches

/path/to/file.ts:
  Line 42: const apiKey = process.env.API_KEY
  Line 85: // TODO: remove hardcoded secret

/path/to/config.js:
  Line 12: password: "changeme"

Features

• Regex support (ripgrep syntax)
• Hidden file search
• Symlink following
• Results sorted by modification time
• Maximum 100 results

Command Execution

Bash

Executes shell commands with timeout and output capture.

Parameters

Example

{
  "command": "nmap -sV -sC target.com",
  "timeout": 300000,
  "workdir": "/path/to/project",
  "description": "Scan target for open ports and services"
}

Features

• Shell detection (bash/zsh/sh)
• Process tree killing on timeout
• Permission system integration
• Real-time output streaming
• External directory access control

Security Considerations

Commands are parsed with tree-sitter to detect:

• Directory access outside project
• Dangerous command patterns
• File system modifications

Web Testing

There is no low-level Browser tool. Browser-based web testing is driven by the Hacker Browser — an autonomous crawler that logs in, walks the application, and captures traffic for the proxy testing pipeline.

Launch it with cyberstrike hackbrowser <target> or the hackbrowser tool. See Hacker Browser for the full workflow, and Web Testing for how the captured traffic is tested.

Memory System

Cyberstrike includes a persistent memory system for storing context across sessions.

Memory Write

Stores information to persistent memory.

Parameters

Example

{
  "content": "Target uses PostgreSQL 14.2 on port 5432",
  "type": "long_term",
  "title": "Database Configuration"
}

Memory Types

Memory Search

Searches through stored memory.

Parameters

Example

{
  "query": "database credentials"
}

Memory Read

Reads specific memory files.

Parameters

File Identifiers

Memory Context

Retrieves full memory context for the session.

Parameters

None required.

Example

{}

Returns combined long-term memory and recent daily notes.

Dynamic Tool Loading

Cyberstrike supports dynamic tool loading for MCP (Model Context Protocol) servers. This enables access to hundreds of tools without overwhelming the context window.

Tool Search

Searches available MCP tools by capability.

Parameters

Example

{
  "query": "sql injection testing",
  "limit": 10
}

Output

Found 3 tools:

1. sqlmap_scan
   SQL injection scanner using sqlmap
   Estimated tokens: ~500

2. nuclei_sqli
   Nuclei templates for SQL injection
   Estimated tokens: ~300

3. manual_sqli
   Manual SQL injection payloads
   Estimated tokens: ~200

Load Tools

Loads tools into context for use.

Parameters

Example

{
  "tool_ids": ["sqlmap_scan", "nuclei_sqli"]
}

Unload Tools

Removes tools from context to free budget.

Parameters

List Loaded Tools

Shows currently loaded tools and token usage.

Parameters

None required.

Task Management

Task

Delegates work to a subagent. This is how the primary agent dispatches specialized subagents (see Agents).

Parameters

TodoWrite

Writes task items to a todo list.

Parameters

Task Object

{
  "id": "1",
  "content": "Scan for open ports",
  "status": "pending",
  "priority": "high"
}

Web Tools

WebFetch

Fetches and processes web content.

Parameters

Example

{
  "url": "https://target.com/robots.txt",
  "format": "text"
}

WebSearch

Performs web searches for information gathering.

Parameters

CodeSearch

Searches code repositories and documentation.

Parameters

Tool Permissions

Each tool requires specific permissions that can be configured:

Configuration

{
  "permission": {
    "bash": "ask",
    "edit": "allow",
    "read": "allow",
    "glob": "allow",
    "grep": "allow"
  }
}

Permission Actions

See Permissions for the full model and glob patterns.

Creating Custom Tools

Add custom tools by creating files in .cyberstrike/tools/:

import { z } from "zod"

export default {
  description: "Custom vulnerability scanner",
  args: {
    target: z.string().describe("Target URL to scan"),
    depth: z.number().default(3).describe("Scan depth"),
  },
  async execute(args, ctx): Promise<string> {
    const { target, depth } = args
    // Custom scanning logic
    return `Scanned ${target} to depth ${depth}`
  },
}

Files in a tool/ or tools/ directory inside any .cyberstrike/ folder are loaded automatically.

Tool Definition Schema

MCP Server Tools

Cyberstrike can load tools from MCP servers. The recommended approach is Bolt, which provides security tools through a Docker container with a plugin system:

{
  "bolt": {
    "local": {
      "url": "http://localhost:3001",
      "enabled": true
    }
  }
}

MCP tools become available as direct tool calls — each plugin is called directly by name (e.g., nmap, nuclei, ffuf).