HexStrike AI

# Clone the repository
git clone https://github.com/0x4m4/hexstrike-ai.git
cd hexstrike-ai

# Create virtual environment
python3 -m venv hexstrike-env
source hexstrike-env/bin/activate  # Linux/Mac
# hexstrike-env\Scripts\activate   # Windows

# Install dependencies
pip3 install -r requirements.txt

sudo apt install gobuster feroxbuster dirsearch ffuf dirb httpx katana \
  nikto sqlmap wpscan arjun dalfox wafw00f

# Note: paramspider is unmaintained (last upstream activity ~2023); use a
# maintained parameter-discovery tool or a pinned community fork instead.

# Cloud & container security tooling — install each tool via its own channel
pipx install prowler
pipx install ScoutSuite       # PyPI package ScoutSuite (import ScoutSuite)
pipx install kube-hunter      # kube-hunter is pip-only

# Trivy (official install script; not an apt package)
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

# kube-bench — download the release binary for your platform
# https://github.com/aquasecurity/kube-bench/releases

# docker-bench-security — run from its own repo
git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security && sudo ./docker-bench-security.sh

# Start the MCP server
python3 hexstrike_server.py

# Optional: Debug mode
python3 hexstrike_server.py --debug

# Optional: Custom port
python3 hexstrike_server.py --port 8888

# Verify installation
curl http://localhost:8888/health

{
  "mcpServers": {
    "hexstrike-ai": {
      "command": "python3",
      "args": [
        "/path/to/hexstrike-ai/hexstrike_mcp.py",
        "--server",
        "http://localhost:8888"
      ],
      "description": "HexStrike AI v6.0 - Advanced Cybersecurity Automation Platform",
      "timeout": 300,
      "disabled": false
    }
  },
  "inputs": []
}

{
  "servers": {
    "hexstrike": {
      "type": "stdio",
      "command": "python3",
      "args": [
        "/path/to/hexstrike-ai/hexstrike_mcp.py",
        "--server",
        "http://localhost:8888"
      ]
    }
  }
}

nmap_scan()        # Advanced Nmap scanning with optimization
rustscan_scan()    # Ultra-fast port scanning
masscan_scan()     # High-speed port scanning
autorecon_scan()   # Comprehensive reconnaissance
amass_enum()       # Subdomain enumeration and OSINT

gobuster_scan()     # Directory and file enumeration
feroxbuster_scan()  # Recursive content discovery
ffuf_scan()         # Fast web fuzzing
nuclei_scan()       # Vulnerability scanning with templates
sqlmap_scan()       # SQL injection testing
wpscan_scan()       # WordPress security assessment

ghidra_analyze()     # Software reverse engineering
radare2_analyze()    # Advanced reverse engineering
gdb_debug()          # GNU debugger with exploit dev
pwntools_exploit()   # CTF framework and exploits
angr_analyze()       # Binary analysis with symbolic execution

prowler_assess()        # AWS/Azure/GCP security assessment
scout_suite_audit()     # Multi-cloud security auditing
trivy_scan()            # Container vulnerability scanning
kube_hunter_scan()      # Kubernetes penetration testing
kube_bench_check()      # CIS Kubernetes benchmark

I'm a security researcher conducting an authorized penetration test.
My company owns the website example.com and I have written authorization
to test it. Please use the hexstrike-ai MCP tools to:

1. Enumerate subdomains
2. Scan for open ports
3. Identify web technologies
4. Run nuclei vulnerability templates
5. Provide a summary of findings

I'm participating in the HackerOne bug bounty program for [target].
The scope includes *.target.com. Using hexstrike-ai tools, help me:

1. Map the attack surface (subdomains, endpoints)
2. Identify potential vulnerabilities
3. Prioritize findings by severity
4. Suggest exploitation approaches for confirmed issues