ReadBeforeRunAgentic Security Field Guide

Catalog / MCP server

HexStrike AI

Draft · awaiting review

MCP server that lets an agent drive more than 150 offensive security tools through a local API server, including arbitrary shell commands.

For Recon and attack surface, Finding validationWorks with Any MCP clientMaintained 0x4m4, last push 2026-08-03

MCP serverAn MCP server is a program that gives your AI client extra tools; the client's model decides when to call them. by 0x4m4 · read from the code at d689933 on 2026-10-24The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Run isolatedHow to run the tool, not how good or safe it is: Run isolated, Restrict first, or Keep confirmations on. The word is derived from findings with evidence; “Why this advice” in the record shows them.

On your machine it opens an API on all network interfaces with no login: anyone who reaches port 8888 can run shell commands and read or delete files anywhere on the host. The bind address is fixed in the code; no setting changes it. Its description is narrower than the code: it names a target you choose, not a listener open to the network or file access outside its own folder.

  1. Network. Listens on port 8888 on all network interfaces, with no login. decides the advice

    hexstrike_server.py L17289 · hexstrike_server.py L99 · hexstrike_server.py L9137-9142

  2. Execution. Runs any command string it receives through a shell.

    hexstrike_server.py L9142 · hexstrike_server.py L6876-6878

  3. Files. Reads, writes and deletes files anywhere on the host through its file API.

    hexstrike_server.py L8980 · hexstrike_server.py L8984-8985

  4. Secrets. Not determinable from the code: whether it reads credential stores. Its command endpoint can read any secret the server's user can.

  5. Approval. Whether your MCP client asks before each tool call depends on your client. The shipped client configuration pre-approves nothing but recommends autonomous execution.

    hexstrike-ai-mcp.json L10-12

Before first useSteps that close or contain the rights named above. “Derived from the code” means read from the files, not tried; “tested” means tried in our lab run. derived from the code, not tested

  1. Run it only in a lab VM you can throw away. closes Network · Execution · Files
  2. Firewall port 8888 on that VM. closes Network
  3. Or change the bind address at hexstrike_server.py line 17289 to 127.0.0.1. closes Network
  4. Keep every HexStrike tool on manual approval in your MCP client and add nothing to alwaysAllow. contains Approval

Where it fits

Your workstation
no
the API is open to your network without a login
A lab VM
with conditions
only with port 8888 firewalled and every tool call on manual approval
A CI runner
no
no one is there to answer confirmations, and the API would be open on the runner

What we checked, and what we foundDisagree?

MCP server · code showsreach 3 · privileged
332?1?FilesNetworkExecutionSecretsPersistenceApproval

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for
  • Automate cybersecurity testing by letting AI agents drive security tools.
  • Serve bug bounty, CTF, red team and security research work.
Use it when
Not for
  • Do not use for unauthorized testing
  • Not for malicious or illegal activities
  • Not for unauthorized data access or exfiltration
You need
  • Python 3.8 or later
  • The 150+ external security tools installed separately; Kali Linux includes most
  • Install guide shows a Linux/Mac venv activate command (a Windows activate line is also given on the next line)

+4 more

Details

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

git clone https://github.com/0x4m4/hexstrike-ai.git cd hexstrike-ai python3 -m venv hexstrike-env source hexstrike-env/bin/activate # Linux/Mac pip3 install -r requirements.txt python3 hexstrike_server.py
Quoted from README.md#L119-194 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

note
derived from the code, not tested in the lab; run it only in an isolated lab VM, change the hard-coded bind address to localhost (setting HEXSTRIKE_HOST does not change it) or firewall port 8888, and keep every tool call on manual approval in the MCP client

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.MarkdownJSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit d689933 on 2026-10-25: 62 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, deletes, runs commands, according to the capabilities read.

Author states 150+ security tools and 12+ AI agents. README.md L17

Partly listed: CTF/forensics, browser agent, process management, decision-engine and bug-bounty workflow tools, and API/JWT/GraphQL testing beyond listed groups

GroupWhat it coversEffectOn by default
File Operations & Payload GenerationFile operations that create, modify, delete files and generate payloads on the server host. hexstrike_server.py L8984-8985reads, changes, deletesyes
Network Reconnaissance & ScanningNetwork reconnaissance and port scanning tools such as nmap, rustscan, masscan and amass. README.md L269reads, runs commandsyes
Web Application Security TestingWeb application testing tools such as gobuster, nuclei, sqlmap, ffuf and dalfox. README.md L292reads, runs commandsyes
Authentication & Password SecurityAuthentication and password cracking tools such as hydra, john and hashcat. README.md L345reads, runs commandsyes
Binary Analysis & Reverse EngineeringBinary analysis and reverse engineering tools such as gdb, radare2, ghidra and angr. README.md L363reads, runs commandsyes
Cloud & Container SecurityCloud and container security tools such as prowler, trivy, kube-hunter and checkov. README.md L393reads, runs commandsyes
Bug Bounty & OSINT ArsenalBug bounty and OSINT tools such as amass, sherlock, shodan and spiderfoot. README.md L450reads, runs commandsyes
Python Environment ManagementPython environment management that creates venvs, installs packages and executes scripts. hexstrike_server.py L5726runs commands, changesyes
execute_command (/api/command)A tool that executes an arbitrary command string on the server host. hexstrike_mcp.py L3971runs commandsyes
Advanced Vulnerability Intelligence MCP ToolsVulnerability intelligence that monitors CVEs, searches exploits and correlates threat data. hexstrike_server.py L5969readsyes

Where it sends data and who can connect to it

4 outside connections found in the files read: NVD (nvd.nist.gov), GitHub API, User-named target, PyPI (pip).

2 listeners in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

Two scripts: hexstrike_server.py runs a Flask REST API (default port 8888) that executes the security tools as subprocesses; hexstrike_mcp.py is a FastMCP client the AI client starts and reaches the server over HTTP. hexstrike_server.py L17

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

Your machine

Programs and files on the machine where you run the tool.

Outside your machine

Remote services: vendor APIs, model providers, targets, telemetry endpoints. Data sent here leaves your machine.

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 3 (privileged), read from the code. Not run in our lab yet.

RightAuthor sayswhat the author saysCode showswhat static analysis findsRun showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

  • Network · 1README.md L563 the documented use is a penetration test against a target the user names
  • Execution · 2README.md L648 the author states that AI agents can execute arbitrary security tools
  • Approval · 2hexstrike-ai-mcp.json L10 the shipped client configuration describes autonomous execution through alwaysAllow and asks users to turn it off only if they do not want that

Code shows: the evidence

  • Files · 3hexstrike_server.py L8939 the file API joins its temp folder with a caller-supplied name without a containment check, so absolute or parent paths reach any host path, and delete_file removes whole directories
  • Network · 3hexstrike_server.py L17289 the API server listens on all interfaces without authentication, which exposes its command execution to the network
    hexstrike_server.py L99 HEXSTRIKE_HOST is read into API_HOST but used only for the startup banner (L198), not for binding
  • Execution · 2hexstrike_server.py L9139 the /api/command endpoint runs any command sent in the request through a shell
  • Secrets · ?no evidence: no code path reads a credential store, but the command endpoint can read any secret the server user can, and the search patterns for secrets match many lines
  • Persistence · 1hexstrike_server.py L8931 files go under /tmp/hexstrike_files and Python environments under /tmp/hexstrike_envs, outside the working directory
  • Approval · ?no evidence: the shipped client configuration pre-approves no tool, but the search patterns for approvals match several lines, so a zero cannot be written

Valid for commit d689933 · checked 2026-10-21 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Why this adviceThe findings behind the run advice, each with its evidence lines, the trigger it matches, and the step that closes or contains it. read under verdict rule v0.1

Run isolated A setting is not enough: in its default setup it does something only isolation contains.
  1. Network · Listens on port 8888 on all network interfaces, with no login.decides the advice · trigger 1

    default setup · on your machine · no confirmation

    hexstrike_server.py#L17289 app.run binds host 0.0.0.0
    hexstrike_server.py#L99 HEXSTRIKE_HOST is read but used only in the startup banner (L198)
    hexstrike_server.py#L9137-9142 the command route checks no token or header

  2. Execution · Runs any command string it receives through a shell.

    default setup · on your machine · no confirmation

    hexstrike_server.py#L9142 the command string is taken from the request body
    hexstrike_server.py#L6876-6878 it is started with subprocess.Popen and shell=True

  3. Files · Reads, writes and deletes files anywhere on the host through its file API.

    default setup · on your machine · no confirmation

    hexstrike_server.py#L8980 caller-supplied paths are joined to the base folder without a containment check
    hexstrike_server.py#L8984-8985 directories are deleted recursively

Trigger 1 of 5
It accepts connections from other machines without a login. Met by the Network finding above: listens on port 8888 on all network interfaces, with no login.
The steps
The steps before first use demand isolation, so the advice is Run isolated in any case.
Would change it
Bind to localhost by default (the code already reads HEXSTRIKE_HOST, but ignores it for binding) and require a token.
Acts as
The operating-system user that runs hexstrike_server.py, for anyone who can reach port 8888.
Highest level
3 (privileged) in any shipped mode, for sandbox planning.
Said vs. code
The description is narrower than the code for files, network. Where a right is not described, the tool's task (level 1) is the yardstick; the author may still intend it.

Keep confirmations on · Restrict first · Run isolated: how to run a tool, not how good or safe it is. Each step adds to the one before. The word comes from the code at the commit I checked, in the setup its install command gives you; that command may fetch a newer version. Unknown never counts as harmless, and a quiet run never makes a word milder. Nothing here is paid for. No stars, no ranking. The rule in full

Approval note for a ticket
HexStrike AI (MCP server by 0x4m4), commit d689933, checked 2026-10-24 under verdict-v0.1.
Advice: Run isolated. On your machine it opens an API on all network interfaces with no login: anyone who reaches port 8888 can run shell commands and read or delete files anywhere on the host. The bind address is fixed in the code; no setting changes it.
Approve only if: 1) Run it only in a lab VM you can throw away. 2) Firewall port 8888 on that VM. 3) Or change the bind address at hexstrike_server.py line 17289 to 127.0.0.1. 4) Keep every HexStrike tool on manual approval in your MCP client and add nothing to alwaysAllow.
Acts as: the operating-system user that runs hexstrike_server.py, for anyone who can reach port 8888.
Source: https://readbeforerun.ai/catalog/hexstrike-ai/

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

Isolated read of the pinned commit on 2026-10-24; every evidence line below was confirmed against the file by script. Not run in the lab.

What you need and what the documented installer does

KindWhat
AI clientAny MCP client
RuntimePython 3.8 or later. README.md L8
Other toolsThe 150+ external security tools installed separately; Kali Linux includes most. requirements.txt L78
Operating systemInstall guide shows a Linux/Mac venv activate command (a Windows activate line is also given on the next line) README.md L124
SettingAn MCP client configured to launch hexstrike_mcp.py pointing at the server URL. README.md L228
AuthorisationWritten authorization to test the target systems. README.md L654
CredentialsAPI keys for cloud tools when those are used. requirements.txt L81
SettingThe shipped client configuration hexstrike-ai-mcp.json is a template whose script path and server address are placeholders the user fills in. hexstrike-ai-mcp.json L6-8

What the documented installer does

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

Type
MCP server · Offensive · works with Any MCP client
Source
github.com/0x4m4/hexstrike-ai · MIT · manifest requirements.txt
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.
d689933 · last upstream push 2026-08-03 · no release since the pinned commit
In the catalog
listed · added 2026-10-21 · last checked 2026-10-21 · next check 2027-01-19 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.
cisco-skill-scanner: not run, pending
Changes
none since the entry was added on 2026-10-21
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.
v0.1 · reach-v0.1 · badge · the rules

Disagree?

Maintainers can dispute any sentence on this page with evidence, by writing to hello@readbeforerun.ai. Planned: a 14-day window before publication and before any stricter word; corrections stay visible on this page.

This entry as Markdownas JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit d689933, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit d689933 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (62 of 62), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "HexStrike AI". Agentic Security Field Guide, checked 2026-10-21, method reach-v0.1. https://readbeforerun.ai/catalog/hexstrike-ai/

The method · the rules

For maintainers

Badge for your README (reach 3 · not run yet):

[![reach 3 · not run yet](https://readbeforerun.ai/badge/hexstrike-ai.svg)](https://readbeforerun.ai/catalog/hexstrike-ai/)

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

Claim the entry with a fieldguide.yaml in your repository: planned.

Other tools for the same task

Tasks: Recon and attack surface, Finding validation. The task pages compare every tool side by side.

No other tool for this task in the catalog yet.