HexStrike AI

Lets AI agents drive about 150 security testing tools through an MCP server, for authorized pentesting.

Stars: 13.3k
Forks: 2.7k
Licence: MIT
Language: Python
Last update: 3 months ago
Type: AI model / agent

What it is

HexStrike AI is an MCP server that connects AI assistants such as Claude, GPT, and Copilot to a large set of existing cybersecurity tools, including scanners, subdomain finders, and password crackers. The README describes it as a way for an AI agent to run these tools and chain results together for penetration testing, vulnerability discovery, and security research. The project is owned by OTT Cybersecurity LLC and released under the MIT license.

Ask an AI client to run a port scan and summarize the open services on a lab machine you own
Run recon tools such as subdomain enumeration against an authorized target and collect the output
Use the CTF-oriented agent to work through a practice challenge
Query the analyze-target API endpoint to get an automated assessment plan for a target

Great for

Security professionals who want to script or speed up recon with an AI assistant
Students practicing on CTF challenges or lab machines they own
Researchers experimenting with how LLM agents use security tooling
Developers who already run Kali-style tool setups and want an MCP bridge

Not ideal for

Anyone testing systems they do not own or have written permission to test, since the tools are offensive and the README does not address legal scope
Beginners without Linux and security tool experience, because the setup assumes you can install and troubleshoup many external tools
Teams needing a polished, supported product, since no release is tagged and the README is largely promotional

Step-by-step guide: how to use HexStrike AIInstall, first run, examples, tips and FAQs

HexStrike AI alternatives HexStrike AI vs PentAGI HexStrike AI vs PentestGPT HexStrike AI vs Nuclei

How to get it

1
Clone and build from source
You'll need: Python 3.8 or newer · pip3 · Linux environment such as Kali (the README lists many Kali-oriented tools) · Chromium or Google Chrome for the Browser Agent
Clone the repository
git clone https://github.com/0x4m4/hexstrike-ai.git
Create and activate a virtual environment
python3 -m venv hexstrike-env && source hexstrike-env/bin/activate
Install Python dependencies
pip3 install -r requirements.txt
Start the MCP server
python3 hexstrike_server.py
2
Run it
- Install the Python dependencies from requirements.txt inside the virtual environment
- Start the server with python3 hexstrike_server.py and optionally pass --port 8888
- Check that the server responds with curl http://localhost:8888/health
- Add the hexstrike_mcp.py entry to your AI client's MCP configuration, pointing at http://localhost:8888
- Ask your AI client a question about a target you are authorized to test
3
Get the most out of it
- Install the core tool list from the README before relying on the agent, since missing tools will fail
- Use the --debug flag when troubleshooting server behavior
- Follow the linked installation video for client-specific setup in Cursor, Claude Desktop, or VS Code Copilot
- Review the API Reference section for the intelligence and tool endpoints

Downloads

Source code (.zip)master branch · straight from GitHub Official website & docswww.hexstrike.com/

Strengths

Connects several mainstream AI clients to a broad set of established security tools via MCP
Open-source under MIT, so the code can be read and modified
Active project with a large star count and recent pushes

Trade-offs

Requires installing many external security tools separately, and the README does not fully explain each one
Offensive tooling carries misuse risk and needs careful authorization and scoping by the user
No tagged release, and some README claims such as tool counts and agent counts are not independently verified here

How it compares

Project	Stars	Type	Level	Updated	Best for
hexstrike-ai (this)	13.3k	AI model / agent	advanced	3 months ago	Security professionals who want to script or speed up recon with an AI assistant
PentestGPT	16.2k	AI model / agent	advanced	4 months ago	Security students working through CTF challenges
nuclei	32.5k	CLI	intermediate	4 days ago	Security engineers who want to run community-maintained vulnerability checks against their own systems
awesome-ai-engineering	22.5k	Curated list	beginner	15 days ago	Developers who want an overview of the AI engineering topics covered in the description
pentagi	33k	AI model / agent	advanced	14 days ago	Security engineers and penetration testers who want an autonomous assistant on their own servers
Prompt-Engineering-Guide	79.8k	Learning resource	beginner	8 months ago	People who are new to prompting and want structured lessons with examples

Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.