CLI

CyberStrike CLI defaults to launching the TUI when run without arguments. It also accepts commands for non-interactive and programmatic use.

cyberstrike [global-options] <command> [command-options] [arguments]

Global Flags

Commands

Interactive Mode

# Launch TUI
cyberstrike

# Start with specific model
cyberstrike --model anthropic/claude-sonnet-4-20250514

# Continue previous session
cyberstrike --continue

run

Execute a single prompt without entering interactive mode. In this mode there is nobody to answer permission prompts, so any tool that would prompt is auto-rejected (see Automation).

cyberstrike run [message..] [options]

Options

Examples

# Run a security scan
cyberstrike run "scan example.com for XSS vulnerabilities"

# Attach files for review
cyberstrike run "analyze this config for misconfigurations" -f nginx.conf

# JSON output for scripting
cyberstrike run "list all open ports" --format json > report.json

# Continue or fork a session
cyberstrike run "now check for SQLi" --continue
cyberstrike run "try a different payload" --session <id> --fork

Piping Input

echo "analyze this code for vulnerabilities" | cyberstrike run
nmap -sV target.local | cyberstrike run "analyze these scan results"

Permissions in run

Pre-approve tools for non-interactive use with the CYBERSTRIKE_PERMISSION env var:

CYBERSTRIKE_PERMISSION='{"bash":"allow","read":"allow"}' \
  cyberstrike run "enumerate services on the host" --format json

See Automation for CI patterns.

serve

Start a headless HTTP API server without a UI.

cyberstrike serve [options]

CYBERSTRIKE_SERVER_PASSWORD=secret cyberstrike serve --port 4096

attach

Connect a TUI to an already-running CyberStrike server.

cyberstrike attach <url>

# Start server in one terminal
cyberstrike web --port 4096

# Attach from another terminal
cyberstrike attach http://localhost:4096

auth

Manage authentication credentials for AI providers. Three subcommands — login, logout, list — all interactive (no flags).

auth login

cyberstrike auth login [url]

Shows a provider list and prompts for an API key or OAuth flow. The optional url pre-selects a well-known provider URL. Credentials are stored in ~/.local/share/cyberstrike/auth.json.

auth list

cyberstrike auth list   # alias: ls

auth logout

cyberstrike auth logout

Interactively select a stored credential to remove.

mcp

Manage Model Context Protocol servers. Five subcommands: list, add, auth, logout, debug.

mcp list

cyberstrike mcp list   # alias: ls

mcp add

cyberstrike mcp add

Fully interactive — prompts for local vs remote, command or URL, and name. Tests the connection before saving. No positional args or flags; to script server setup, write the entry into cyberstrike.json directly.

mcp auth

cyberstrike mcp auth [name]        # authorize an OAuth server
cyberstrike mcp auth list          # list OAuth-authorized servers

Authorizes a remote server that uses OAuth. See OAuth.

mcp logout

cyberstrike mcp logout [name]

mcp debug

cyberstrike mcp debug <name>

Inspects a server’s connection — useful when a server fails to load or tools don’t appear.

session

Manage conversation sessions.

cyberstrike session list [options]

agent

cyberstrike agent [name]

Without a name, lists available agents. With a name, shows agent details and prompt.

models

cyberstrike models

Lists all available models organized by provider.

github

github install

cyberstrike github install

Install the Cyberstrike GitHub App into a repository.

github run

cyberstrike github run

Run Cyberstrike against a GitHub event (used by the CI workflow).

pr

cyberstrike pr <number>

Review a pull request by number.

export / import

cyberstrike export [sessionID]     # export session as JSON to stdout
cyberstrike import <file>          # import session data

stats

cyberstrike stats

Shows token usage, session counts, and cost estimates.

upgrade

cyberstrike upgrade [version]

Update to the latest stable version or a specific target. Supported methods: curl, npm, pnpm, bun, brew, choco, scoop.

completion

cyberstrike completion >> ~/.bashrc    # Bash
cyberstrike completion >> ~/.zshrc     # Zsh
cyberstrike completion | source        # Fish

Environment Variables

Exit Codes