HexStrike AI

Overview

From the repository's own README, as read at the audited commit.

<div align="center"><img src="assets/hexstrike-logo.png" alt="HexStrike AI Logo" width="220" style="margin-bottom: 20px;"/># HexStrike AI MCP Agents v6.0### AI-Powered MCP Cybersecurity Automation Platform[![Python](https://img.shields.io/badge/Python-3.8%2B-blue.svg)](https://www.python.org/)[![License](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)[![Security](https://img.shields.io/badge/Security-Penetration%20Testing-red.svg)](https://github.com/0x4m4/hexstrike-ai)[![MCP](https://img.shields.io/badge/MCP-Compatible-purple.svg)](https://github.com/0x4m4/hexstrike-ai)[![Version](https://img.shields.io/badge/Version-6.0.0-orange.svg)](https://github.com/0x4m4/hexstrike-ai/releases)[![Tools](https://img.shields.io/badge/Security%20Tools-150%2B-brightgreen.svg)](https://github.com/0x4m4/hexstrike-ai)[![Agents](https://img.shields.io/badge/AI%20Agents-12%2B-purple.svg)](https://github.com/0x4m4/hexstrike-ai)[![Stars](https://img.shields.io/github/stars/0x4m4/hexstrike-ai?style=social)](https://github.com/0x4m4/hexstrike-ai)**Advanced AI-powered penetration testing MCP framework with 150+ security tools and 12+ autonomous AI agents****Owned & developed by [OTT Cybersecurity LLC](https://overthetop.ae/)**[📋 What's New](#whats-new-in-v60) • [🏗️ Architecture](#architecture-overview) • [🚀 Installation](#installation) • [🛠️ Features](#features) • [🤖 AI Agents](#ai-agents) • [📡 API Reference](#api-reference)</div>---<div align="center">## Follow Our Social Accounts<p align="center">  <a href="https://discord.gg/BWnmrrSHbA">    <img src="https://img.shields.io/badge/Discord-Join-7289DA?logo=discord&logoColor=white&style=for-the-badge" alt="Join our Discord" />  </a>  &nbsp;&nbsp;  <a href="https://www.linkedin.com/company/hexstrike-ai">    <img src="https://img.shields.io/badge/LinkedIn-Follow%20us-0A66C2?logo=linkedin&logoColor=white&style=for-the-badge" alt="Follow us on LinkedIn" />  </a></p></div>---## Architecture OverviewHexStrike AI MCP v6.0 features a m

Exposed tools (150) 134 read · 13 write · 3 destructive

Blast radius: 3 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one.

Details

Source

0x4m4/hexstrike-ai

License

MIT

Stars

11,850 · pushed 40d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

UNDECLARED (12 observation(s))

Network

declared (19 observation(s))

Shell

declared (2 observation(s))

Dependencies

not all pinned

Secrets in source

none-found

Findings (25)

b64decode( ... exec(

{"name": "Cloud Metadata", "payloads": ["http://169.254.169.254/latest/meta-data/"]},

resp = requests.get(page_info.get('url',''), timeout=10, verify=False)

r = requests.get(test_url, timeout=8, verify=False)

shutil.rmtree(file_path)

os.remove(command_file)

os.remove(resource_file)

os.remove("/tmp/gdb_commands.txt")

os.remove("/tmp/r2_commands.txt")

valid_attack_types = ["rce", "privilege_escalation", "persistence", "exfiltration", "xss", "sqli", "lfi", "ssrf"]

"Data exfiltration indicators"

"Data staging and exfiltration"

{"name": "DNS Exfiltration", "payloads": ["http://burpcollaborator.net"]}

DEFAULT_HEXSTRIKE_SERVER = "http://127.0.0.1:8888"  # Default HexStrike server URL

{"name": "Internal Network", "payloads": ["http://127.0.0.1:80", "http://localhost:22"]},

{"name": "Cloud Metadata", "payloads": ["http://169.254.169.254/latest/meta-data/"]},

'http': f'http://127.0.0.1:{proxy_port}',

'https': f'http://127.0.0.1:{proxy_port}'

clear_cache, delete_file, terminate_process

return hashlib.md5(key_data.encode()).hexdigest()

"basic": ["../../../etc/passwd", "..\\..\\..\\windows\\system32\\drivers\\etc\\hosts"],

header = json.loads(base64.b64decode(header_b64))

payload = json.loads(base64.b64decode(payload_b64))

flask, requests, psutil, fastmcp, beautifulsoup4, selenium, webdriver-manager, aiohttp

assets/leaksapi-logo.png

Gates applied: critical_finding, no_behavioural_pass.

Audited 2026-09-13 · audit v0.4.0 · source sha 876657bfe240 · full audit: observations/trust-audit/mcp-server/0x4m4__hexstrike-ai.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions