# HexStrike AI

> Draft · awaiting review.

> MCP server that lets an agent drive more than 150 offensive security tools through a local API server, including arbitrary shell commands.

- Badge: `reach 3 · not run yet`
- Type: MCP server; tier: not run yet
- Tasks: Recon and attack surface, Finding validation; mission: Offensive; works with: Any MCP client
- Source: https://github.com/0x4m4/hexstrike-ai, pinned to `d689933`, licence MIT
- Last checked: 2026-10-21; next check: 2027-01-19; method v0.1, reach-v0.1

## At a glance

- **What it is:** An MCP framework for penetration testing that connects an AI agent to more than 150 security tools and 12 or more autonomous AI agents. An MCP server is a program that gives your AI client extra tools; the client's model decides when to call them.
- **Made for:** Automate cybersecurity testing by letting AI agents drive security tools. +1 more
- **Runs:** On your machine, as a service with a network port. Other modes: MCP stdio client (on your machine, started by your AI client); debug. Listens by default: The Flask API listens on all interfaces, default port 8888, with no sign-in (no sign-in); 2 listeners in all.
- **Sends data to:** NVD (nvd.nist.gov) (if you turn it on), GitHub API (if you turn it on), User-named target (by default), PyPI (pip) (if you turn it on). Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Changes, deletes, runs commands, according to the capabilities read. Partly listed: CTF/forensics, browser agent, process management, decision-engine and bug-bounty workflow tools, and API/JWT/GraphQL testing beyond listed groups
- **Needs:** Python 3.8 or later · The 150+ external security tools installed separately; Kali Linux includes most · Install guide shows a Linux/Mac venv activate command (a Windows activate line is also given on the next line) · +4 more

Profile read at commit `d689933` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

An MCP framework for penetration testing that connects an AI agent to more than 150 security tools and 12 or more autonomous AI agents. (README.md#L17)

Made for (the author says):

- Automate cybersecurity testing by letting AI agents drive security tools. (README.md#L6)
- Serve bug bounty, CTF, red team and security research work. (hexstrike_server.py#L6)

Documented uses:

- Run network reconnaissance and port scanning against a target [Recon and attack surface] (README.md#L269)
- Test web applications for vulnerabilities [Web and API testing] (README.md#L292)
- Develop exploits automatically (AIExploitGenerator) [Finding validation] (README.md#L483)
- Assess cloud and container security posture [Cloud and infrastructure-as-code (IaC) posture] (README.md#L393)

Not for (the author says):

- Do not use for unauthorized testing (README.md#L660)
- Not for malicious or illegal activities (README.md#L661)
- Not for unauthorized data access or exfiltration (README.md#L662)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| Network Reconnaissance & Scanning | Network reconnaissance and port scanning tools such as nmap, rustscan, masscan and amass. (README.md#L269) | reads, runs commands | yes |
| Web Application Security Testing | Web application testing tools such as gobuster, nuclei, sqlmap, ffuf and dalfox. (README.md#L292) | reads, runs commands | yes |
| Authentication & Password Security | Authentication and password cracking tools such as hydra, john and hashcat. (README.md#L345) | reads, runs commands | yes |
| Binary Analysis & Reverse Engineering | Binary analysis and reverse engineering tools such as gdb, radare2, ghidra and angr. (README.md#L363) | reads, runs commands | yes |
| Cloud & Container Security | Cloud and container security tools such as prowler, trivy, kube-hunter and checkov. (README.md#L393) | reads, runs commands | yes |
| Bug Bounty & OSINT Arsenal | Bug bounty and OSINT tools such as amass, sherlock, shodan and spiderfoot. (README.md#L450) | reads, runs commands | yes |
| File Operations & Payload Generation | File operations that create, modify, delete files and generate payloads on the server host. (hexstrike_server.py#L8984-8985) | reads, changes, deletes | yes |
| Python Environment Management | Python environment management that creates venvs, installs packages and executes scripts. (hexstrike_server.py#L5726) | runs commands, changes | yes |
| Advanced Vulnerability Intelligence MCP Tools | Vulnerability intelligence that monitors CVEs, searches exploits and correlates threat data. (hexstrike_server.py#L5969) | reads | yes |
| execute_command (/api/command) | A tool that executes an arbitrary command string on the server host. (hexstrike_mcp.py#L3971) | runs commands | yes |

Partly listed: CTF/forensics, browser agent, process management, decision-engine and bug-bounty workflow tools, and API/JWT/GraphQL testing beyond listed groups

## How it runs

Two scripts: hexstrike_server.py runs a Flask REST API (default port 8888) that executes the security tools as subprocesses; hexstrike_mcp.py is a FastMCP client the AI client starts and reaches the server over HTTP. (hexstrike_server.py#L17)

- Starts: On your machine, as a service with a network port. You run python3 hexstrike_server.py; it serves a Flask API on a TCP port (default 8888). (hexstrike_server.py#L17289)
- Can also run: On your machine, started by your AI client (MCP stdio client). The AI client launches hexstrike_mcp.py over stdio, which forwards tool calls to the API server over HTTP. (hexstrike-ai-mcp.json#L5-8)
- Can also run: On your machine, as a service with a network port (debug, switch `--debug`). A --debug flag enables Flask debug mode and verbose logging. (hexstrike_server.py#L17261)
- Your AI client: **AI client / model**: The AI client and its model issue MCP tool calls. (README.md#L64)
- Your machine: **hexstrike_mcp.py (FastMCP client)**: hexstrike_mcp.py: FastMCP client the AI client starts; forwards calls to the API server over HTTP. (README.md#L228)
- Your machine: **hexstrike_server.py (Flask API)**: hexstrike_server.py: Flask REST API that executes tools and listens on a TCP port. (hexstrike_server.py#L17289)
- Your machine: **Security tool subprocesses**: External security tools run as shell subprocesses on the host. (hexstrike_server.py#L6876)
- Outside your machine: **Target systems**: Target hosts, URLs or cloud accounts under test. (hexstrike_server.py#L10352)
- Outside your machine: **External intelligence services**: Third-party data sources (NVD, GitHub) queried for CVE and exploit data. (hexstrike_server.py#L5969)
- Listens: The Flask API listens on all interfaces, default port 8888, with no sign-in.: all network interfaces, no sign-in, by default (hexstrike_server.py#L17289)
- Listens: The ZAP daemon tool binds a host (default 0.0.0.0) and port 8090 when run in daemon mode.: all network interfaces, sign-in optional, in an optional mode (hexstrike_server.py#L14328)
- Sends data to NVD (nvd.nist.gov) (other, if you turn it on): Fetches CVE records from the NVD API when CVE features run. (hexstrike_server.py#L5969)
- Sends data to GitHub API (other, if you turn it on): Searches the GitHub API for exploits and PoCs when a CVE is analyzed. (hexstrike_server.py#L6410)
- Sends data to User-named target (your targets, by default): Runs security tools against the target host or URL you name. (hexstrike_server.py#L10352)
- Sends data to PyPI (pip) (download, if you turn it on): Downloads named Python packages via pip into a venv. (hexstrike_server.py#L5726)

## What you need

- Runtime: Python 3.8 or later. (README.md#L8)
- Other tools: The 150+ external security tools installed separately; Kali Linux includes most. (requirements.txt#L78)
- Operating system: Install guide shows a Linux/Mac venv activate command (a Windows activate line is also given on the next line) (README.md#L124)
- Setting: An MCP client configured to launch hexstrike_mcp.py pointing at the server URL. (README.md#L228)
- Authorisation: Written authorization to test the target systems. (README.md#L654)
- Credentials: API keys for cloud tools when those are used. (requirements.txt#L81)
- Setting: The shipped client configuration hexstrike-ai-mcp.json is a template whose script path and server address are placeholders the user fills in. (hexstrike-ai-mcp.json#L6-8)
- Installer: Documented install: git clone the repo (not pinned to a commit), create a Python venv, and pip3 install -r requirements.txt; the 150+ tools are installed separately. (README.md#L128)
- Installer: Optional browser-agent setup pipes a signing key into sudo apt-key and adds a Google Chrome apt repository. (README.md#L185)

## Limits and risks

- app.run is bound to 0.0.0.0, so the API listens on every network interface even though API_HOST defaults to 127.0.0.1. (hexstrike_server.py#L17289)
- The author recommends implementing authentication for production deployments. (README.md#L650)
- The /api/command endpoint executes any command string sent in the request. (hexstrike_server.py#L9139)
- Commands run through a shell (subprocess.Popen with shell=True). (hexstrike_server.py#L6876-6878)
- The file API joins the request filename onto its base directory, so absolute or parent paths reach outside the temp folder. (hexstrike_server.py#L8939)
- Deleting a directory through the file API removes it recursively via shutil.rmtree. (hexstrike_server.py#L8985)
- The /api/python/install endpoint installs any named package into a venv via pip. (hexstrike_server.py#L5726)
- README.md#L648 warns AI agents can execute arbitrary security tools and ensure oversight; the isolated-VM advice is the adjacent L647 (README.md#L648)
- A bundled tool, Responder, poisons LLMNR, NBT-NS and MDNS on the local network to harvest credentials, an active attack beyond passive scanning. (README.md#L286)
- The /api/python/execute endpoint runs an arbitrary Python script sent in the request on the server host, a code-execution path beyond /api/command. (hexstrike_server.py#L14500)
- The shipped client config template points the MCP client at http://IPADDRESS:8888, i.e. plaintext HTTP to a possibly remote API that carries no authentication. (hexstrike-ai-mcp.json#L8)
- The client config description notes an alwaysAllow list that, when populated, lets the agent run tools without per-call approval (autonomous execution). (hexstrike-ai-mcp.json#L10)
- The usage guide tells users to state their role and ownership of the target first because models tend to refuse a bare request to test a site. (README.md#L560)
- The usage guide states that models often decline a bare request to penetration test a site and tells users to open the prompt with their role and their relation to the target. (README.md#L560)
- The startup banner reports the server as starting on API_HOST (default 127.0.0.1), although app.run binds 0.0.0.0. (hexstrike_server.py#L198)

## Rights in plain language

- Declared: network 1 (talks only to declared hosts), execution 2 (runs shell commands or eval), approval 2 (has broad pre-approvals).
- Code: reach 3 (privileged): files 3 (writes system paths), network 3 (can tunnel or exfiltrate), execution 2 (runs shell commands or eval); unknown: secrets, approval.
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 3 (privileged).

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | not declared | 3 writes system paths | not run yet |
| Network: whom does it talk to? | 1 talks only to declared hosts | 3 can tunnel or exfiltrate | not run yet |
| Execution: what does it run? | 2 runs shell commands or eval | 2 runs shell commands or eval | not run yet |
| Secrets: which credentials does it touch? | not declared | ? unknown | not run yet |
| Persistence: what survives the run? | not declared | 1 leaves cache or temp files | not run yet |
| Approval: does it ask before acting? | 2 has broad pre-approvals | ? unknown | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `README.md#L119-194` at the pinned commit (not a command to copy): `git clone https://github.com/0x4m4/hexstrike-ai.git
cd hexstrike-ai
python3 -m venv hexstrike-env
source hexstrike-env/bin/activate  # Linux/Mac
pip3 install -r requirements.txt
python3 hexstrike_server.py`


### Run it with least privilege

- note: `derived from the code, not tested in the lab; run it only in an isolated lab VM, change the hard-coded bind address to localhost (setting HEXSTRIKE_HOST does not change it) or firewall port 8888, and keep every tool call on manual approval in the MCP client`

- derived, not tested: proposed from the code analysis

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does HexStrike AI declare?**

network 1 (talks only to declared hosts), execution 2 (runs shell commands or eval), approval 2 (has broad pre-approvals).

**What does its code suggest?**

reach 3 (privileged): files 3 (writes system paths), network 3 (can tunnel or exfiltrate), execution 2 (runs shell commands or eval); unknown: secrets, approval.

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-08-03; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: note: derived from the code, not tested in the lab; run it only in an isolated lab VM, change the hard-coded bind address to localhost (setting HEXSTRIKE_HOST does not change it) or firewall port 8888, and keep every tool call on manual approval in the MCP client

Method: https://readbeforerun.ai/method/