{
  "$schema": "https://readbeforerun.ai/schema/entry.schema.json",
  "entry": {
    "id": "hexstrike-ai",
    "name": "HexStrike AI",
    "summary": "MCP server that lets an agent drive more than 150 offensive security tools through a local API server, including arbitrary shell commands.",
    "draft": "review",
    "type": "mcp-server",
    "mission": [
      "offensive"
    ],
    "task": [
      "recon-attack-surface",
      "finding-validation"
    ],
    "domain": [
      "network-security",
      "application-security"
    ],
    "runtime": [
      "mcp-generic"
    ],
    "tier": "listed",
    "last_checked": "2026-10-21",
    "next_check": "2027-01-19",
    "freshness": "fresh",
    "superseded": false,
    "in_my_kit": null,
    "advice": {
      "rule": "verdict-v0.1",
      "word": "run-isolated",
      "label": "Run isolated",
      "reason": "On your machine it opens an API on all network interfaces with no login: anyone who reaches port 8888 can run shell commands and read or delete files anywhere on the host. The bind address is fixed in the code; no setting changes it.",
      "checked": "2026-10-24",
      "commit": "d689933ff579d839c676c82b231f8e98326c5f04",
      "steps": [
        "Run it only in a lab VM you can throw away.",
        "Firewall port 8888 on that VM.",
        "Or change the bind address at hexstrike_server.py line 17289 to 127.0.0.1.",
        "Keep every HexStrike tool on manual approval in your MCP client and add nothing to alwaysAllow."
      ]
    },
    "code_shows": "writes system paths · can tunnel or exfiltrate · runs shell commands or eval · Secrets: unknown · Approval: unknown",
    "source": {
      "repo": "https://github.com/0x4m4/hexstrike-ai",
      "subpath": null,
      "commit": "d689933ff579d839c676c82b231f8e98326c5f04",
      "version": null,
      "license": "MIT"
    },
    "install": {
      "skills_cli": null,
      "claude_code": null,
      "upstream": "git clone https://github.com/0x4m4/hexstrike-ai.git\ncd hexstrike-ai\npython3 -m venv hexstrike-env\nsource hexstrike-env/bin/activate  # Linux/Mac\npip3 install -r requirements.txt\npython3 hexstrike_server.py",
      "bundled": false
    },
    "scan": {
      "status": "static scan pending (not run)"
    },
    "reach": {
      "method": "reach-v0.1",
      "level": 3,
      "level_source": "static",
      "level_label": "privileged",
      "unknown_axes": 2,
      "verdict": "not-run",
      "badge": "reach 3 · not run yet",
      "long": "reach 3 from code (privileged); lab: not run yet",
      "declared": {
        "net": 1,
        "exec": 2,
        "hitl": 2
      },
      "static": {
        "level": 3,
        "fs": 3,
        "net": 3,
        "exec": 2,
        "cred": null,
        "persist": 1,
        "hitl": null,
        "unknown": [
          "cred",
          "hitl"
        ]
      },
      "observed": null,
      "surplus": null,
      "fit": null,
      "exports": {
        "aivss": {
          "fs": 1,
          "net": 1,
          "exec": 0.5,
          "cred": null,
          "persist": 0.5,
          "hitl": null
        },
        "usf_risk_tier": "L3"
      }
    },
    "profile": {
      "read_at": "d689933ff579d839c676c82b231f8e98326c5f04",
      "read_on": "2026-10-25",
      "overview": "An MCP framework for penetration testing that connects an AI agent to more than 150 security tools and 12 or more autonomous AI agents.",
      "purpose": [
        "Automate cybersecurity testing by letting AI agents drive security tools.",
        "Serve bug bounty, CTF, red team and security research work."
      ],
      "use_cases": [
        {
          "text": "Run network reconnaissance and port scanning against a target",
          "task": "recon-attack-surface"
        },
        {
          "text": "Test web applications for vulnerabilities",
          "task": "web-api-testing"
        },
        {
          "text": "Develop exploits automatically (AIExploitGenerator)",
          "task": "finding-validation"
        },
        {
          "text": "Assess cloud and container security posture",
          "task": "cloud-iac-posture"
        }
      ],
      "maturity": null,
      "capabilities": [
        {
          "name": "Network Reconnaissance & Scanning",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default"
        },
        {
          "name": "Web Application Security Testing",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default"
        },
        {
          "name": "Authentication & Password Security",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default"
        },
        {
          "name": "Binary Analysis & Reverse Engineering",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default"
        },
        {
          "name": "Cloud & Container Security",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default"
        },
        {
          "name": "Bug Bounty & OSINT Arsenal",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default"
        },
        {
          "name": "File Operations & Payload Generation",
          "effects": [
            "reads",
            "changes",
            "deletes"
          ],
          "enabled": "default"
        },
        {
          "name": "Python Environment Management",
          "effects": [
            "runs-commands",
            "changes"
          ],
          "enabled": "default"
        },
        {
          "name": "Advanced Vulnerability Intelligence MCP Tools",
          "effects": [
            "reads"
          ],
          "enabled": "default"
        },
        {
          "name": "execute_command (/api/command)",
          "effects": [
            "runs-commands"
          ],
          "enabled": "default"
        }
      ],
      "effects": [
        "reads",
        "changes",
        "deletes",
        "runs-commands"
      ],
      "runs": "local-service",
      "listens": [
        {
          "mode": "default",
          "bind": "all-interfaces",
          "sign_in": "none"
        },
        {
          "mode": "optional",
          "bind": "all-interfaces",
          "sign_in": "optional"
        }
      ],
      "sends_to": [
        {
          "to": "NVD (nvd.nist.gov)",
          "kind": "other",
          "when": "optional"
        },
        {
          "to": "GitHub API",
          "kind": "other",
          "when": "optional"
        },
        {
          "to": "User-named target",
          "kind": "target",
          "when": "default"
        },
        {
          "to": "PyPI (pip)",
          "kind": "download",
          "when": "optional"
        }
      ],
      "model": "client",
      "needs": [
        {
          "kind": "runtime",
          "text": "Python 3.8 or later."
        },
        {
          "kind": "tools",
          "text": "The 150+ external security tools installed separately; Kali Linux includes most."
        },
        {
          "kind": "os",
          "text": "Install guide shows a Linux/Mac venv activate command (a Windows activate line is also given on the next line)"
        },
        {
          "kind": "setting",
          "text": "An MCP client configured to launch hexstrike_mcp.py pointing at the server URL."
        },
        {
          "kind": "authorization",
          "text": "Written authorization to test the target systems."
        },
        {
          "kind": "credentials",
          "text": "API keys for cloud tools when those are used."
        },
        {
          "kind": "setting",
          "text": "The shipped client configuration hexstrike-ai-mcp.json is a template whose script path and server address are placeholders the user fills in."
        }
      ]
    },
    "urls": {
      "page": "/catalog/hexstrike-ai/",
      "json": "/entries/hexstrike-ai.json",
      "md": "/catalog/hexstrike-ai.md",
      "badge": "/badge/hexstrike-ai.svg"
    }
  },
  "data": {
    "schema_version": "0.5",
    "slug": "hexstrike-ai",
    "name": "HexStrike AI",
    "summary": "MCP server that lets an agent drive more than 150 offensive security tools through a local API server, including arbitrary shell commands.",
    "draft": "review",
    "in_my_kit": null,
    "type": "mcp-server",
    "mission": [
      "offensive"
    ],
    "task": [
      "recon-attack-surface",
      "finding-validation"
    ],
    "domain": [
      "network-security",
      "application-security"
    ],
    "phase": [
      "off:recon",
      "off:discovery",
      "off:validation"
    ],
    "role": [
      "pentest"
    ],
    "runtime": [
      "mcp-generic"
    ],
    "auth": "none",
    "autonomy": null,
    "addresses": [],
    "frameworks": {
      "owasp_ast": [],
      "owasp_asi": [],
      "attack_tactic": [],
      "atlas": []
    },
    "source": {
      "repo": "https://github.com/0x4m4/hexstrike-ai",
      "commit": "d689933ff579d839c676c82b231f8e98326c5f04",
      "license": "MIT",
      "manifest": "requirements.txt",
      "also_listed": {}
    },
    "upstream": {
      "checked_at": "2026-10-21",
      "updated_at": "2026-08-03",
      "current_release": null,
      "archived": false,
      "stars": 12986,
      "commit_history": {},
      "releases_since_pin": 0
    },
    "install": {
      "upstream": "git clone https://github.com/0x4m4/hexstrike-ai.git\ncd hexstrike-ai\npython3 -m venv hexstrike-env\nsource hexstrike-env/bin/activate  # Linux/Mac\npip3 install -r requirements.txt\npython3 hexstrike_server.py",
      "upstream_evidence": "README.md#L119-194",
      "bundled": false
    },
    "scan": [
      {
        "tool": "cisco-skill-scanner",
        "version": "not-run",
        "llm_judge": false,
        "date": "2026-10-21",
        "result": "pending"
      }
    ],
    "privileges": {
      "method": "reach-v0.1",
      "declared": {
        "axes": {
          "net": 1,
          "exec": 2,
          "hitl": 2
        },
        "evidence": {
          "net": "README.md#L563 the documented use is a penetration test against a target the user names",
          "exec": "README.md#L648 the author states that AI agents can execute arbitrary security tools",
          "hitl": "hexstrike-ai-mcp.json#L10 the shipped client configuration describes autonomous execution through alwaysAllow and asks users to turn it off only if they do not want that"
        }
      },
      "static": {
        "level": 3,
        "axes": {
          "fs": 3,
          "net": 3,
          "exec": 2,
          "cred": null,
          "persist": 1,
          "hitl": null
        },
        "evidence": {
          "fs": "hexstrike_server.py#L8939 the file API joins its temp folder with a caller-supplied name without a containment check, so absolute or parent paths reach any host path, and delete_file removes whole directories",
          "net": "hexstrike_server.py#L17289 the API server listens on all interfaces without authentication, which exposes its command execution to the network; hexstrike_server.py#L99 HEXSTRIKE_HOST is read into API_HOST but used only for the startup banner (L198), not for binding",
          "exec": "hexstrike_server.py#L9139 the /api/command endpoint runs any command sent in the request through a shell",
          "cred": "no evidence: no code path reads a credential store, but the command endpoint can read any secret the server user can, and the search patterns for secrets match many lines",
          "persist": "hexstrike_server.py#L8931 files go under /tmp/hexstrike_files and Python environments under /tmp/hexstrike_envs, outside the working directory",
          "hitl": "no evidence: the shipped client configuration pre-approves no tool, but the search patterns for approvals match several lines, so a zero cannot be written"
        },
        "unknown": [
          "cred",
          "hitl"
        ]
      },
      "min_config": {
        "status": "derived",
        "note": "derived from the code, not tested in the lab; run it only in an isolated lab VM, change the hard-coded bind address to localhost (setting HEXSTRIKE_HOST does not change it) or firewall port 8888, and keep every tool call on manual approval in the MCP client"
      },
      "override": null,
      "reviews": []
    },
    "status": {
      "tier": "listed",
      "last_checked": "2026-10-21",
      "next_check": "2027-01-19",
      "freshness": "fresh",
      "superseded": false,
      "superseded_by": null,
      "added": "2026-10-21",
      "added_by": "scout"
    },
    "evidence": {
      "runs": [],
      "badge": "/badge/hexstrike-ai.svg"
    },
    "changes": []
  },
  "profile": {
    "schema_version": "0.1",
    "entry": "hexstrike-ai",
    "draft": "review",
    "commit": "d689933ff579d839c676c82b231f8e98326c5f04",
    "read_on": "2026-10-25",
    "check": {
      "date": "2026-10-25",
      "facts": 62,
      "confirmed": 62,
      "verified": 54
    },
    "overview": {
      "text": "An MCP framework for penetration testing that connects an AI agent to more than 150 security tools and 12 or more autonomous AI agents.",
      "ev": "README.md#L17 author's one-line description of the project"
    },
    "purpose": [
      {
        "text": "Automate cybersecurity testing by letting AI agents drive security tools.",
        "ev": "README.md#L6 subtitle stating what it is"
      },
      {
        "text": "Serve bug bounty, CTF, red team and security research work.",
        "ev": "hexstrike_server.py#L6 server docstring naming its uses"
      }
    ],
    "use_cases": [
      {
        "text": "Run network reconnaissance and port scanning against a target",
        "task": "recon-attack-surface",
        "ev": "README.md#L269 network recon tool category"
      },
      {
        "text": "Test web applications for vulnerabilities",
        "task": "web-api-testing",
        "ev": "README.md#L292 web app tool category"
      },
      {
        "text": "Develop exploits automatically (AIExploitGenerator)",
        "task": "finding-validation",
        "ev": "README.md#L483 exploit generation agent"
      },
      {
        "text": "Assess cloud and container security posture",
        "task": "cloud-iac-posture",
        "ev": "README.md#L393 cloud tool category"
      }
    ],
    "not_for": [
      {
        "text": "Do not use for unauthorized testing",
        "ev": "README.md#L660 ethical-use list"
      },
      {
        "text": "Not for malicious or illegal activities",
        "ev": "README.md#L661 ethical-use list"
      },
      {
        "text": "Not for unauthorized data access or exfiltration",
        "ev": "README.md#L662 ethical-use list"
      }
    ],
    "capabilities": {
      "coverage": "partial",
      "missing": "CTF/forensics, browser agent, process management, decision-engine and bug-bounty workflow tools, and API/JWT/GraphQL testing beyond listed groups",
      "count": {
        "n": 150,
        "unit": "tools",
        "by": "author",
        "text": "Author states 150+ security tools and 12+ AI agents.",
        "ev": "README.md#L17 stated tool and agent counts"
      },
      "groups": [
        {
          "name": "Network Reconnaissance & Scanning",
          "does": "Network reconnaissance and port scanning tools such as nmap, rustscan, masscan and amass.",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default",
          "ev": "README.md#L269 network recon category header"
        },
        {
          "name": "Web Application Security Testing",
          "does": "Web application testing tools such as gobuster, nuclei, sqlmap, ffuf and dalfox.",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default",
          "ev": "README.md#L292 web app category header"
        },
        {
          "name": "Authentication & Password Security",
          "does": "Authentication and password cracking tools such as hydra, john and hashcat.",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default",
          "ev": "README.md#L345 auth/password category header"
        },
        {
          "name": "Binary Analysis & Reverse Engineering",
          "does": "Binary analysis and reverse engineering tools such as gdb, radare2, ghidra and angr.",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default",
          "ev": "README.md#L363 binary analysis category header"
        },
        {
          "name": "Cloud & Container Security",
          "does": "Cloud and container security tools such as prowler, trivy, kube-hunter and checkov.",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default",
          "ev": "README.md#L393 cloud category header"
        },
        {
          "name": "Bug Bounty & OSINT Arsenal",
          "does": "Bug bounty and OSINT tools such as amass, sherlock, shodan and spiderfoot.",
          "effects": [
            "reads",
            "runs-commands"
          ],
          "enabled": "default",
          "ev": "README.md#L450 bug bounty/OSINT category header"
        },
        {
          "name": "File Operations & Payload Generation",
          "does": "File operations that create, modify, delete files and generate payloads on the server host.",
          "effects": [
            "reads",
            "changes",
            "deletes"
          ],
          "enabled": "default",
          "ev": "hexstrike_server.py#L8984-8985 file API deletes directories recursively"
        },
        {
          "name": "Python Environment Management",
          "does": "Python environment management that creates venvs, installs packages and executes scripts.",
          "effects": [
            "runs-commands",
            "changes"
          ],
          "enabled": "default",
          "ev": "hexstrike_server.py#L5726 installs a named pip package in a venv"
        },
        {
          "name": "Advanced Vulnerability Intelligence MCP Tools",
          "does": "Vulnerability intelligence that monitors CVEs, searches exploits and correlates threat data.",
          "effects": [
            "reads"
          ],
          "enabled": "default",
          "ev": "hexstrike_server.py#L5969 queries the external NVD CVE API"
        },
        {
          "name": "execute_command (/api/command)",
          "does": "A tool that executes an arbitrary command string on the server host.",
          "effects": [
            "runs-commands"
          ],
          "enabled": "default",
          "ev": "hexstrike_mcp.py#L3971 execute_command tool docstring"
        }
      ]
    },
    "architecture": {
      "summary": {
        "text": "Two scripts: hexstrike_server.py runs a Flask REST API (default port 8888) that executes the security tools as subprocesses; hexstrike_mcp.py is a FastMCP client the AI client starts and reaches the server over HTTP.",
        "ev": "hexstrike_server.py#L17 docstring naming the two-script design"
      },
      "runs": {
        "where": "local-service",
        "text": "You run python3 hexstrike_server.py; it serves a Flask API on a TCP port (default 8888).",
        "ev": "hexstrike_server.py#L17289 Flask app binds a TCP port"
      },
      "modes": [
        {
          "where": "local-process",
          "mode": "MCP stdio client",
          "switch": null,
          "text": "The AI client launches hexstrike_mcp.py over stdio, which forwards tool calls to the API server over HTTP.",
          "ev": "hexstrike-ai-mcp.json#L5-8 client config launches the MCP client script"
        },
        {
          "where": "local-service",
          "mode": "debug",
          "switch": "--debug",
          "text": "A --debug flag enables Flask debug mode and verbose logging.",
          "ev": "hexstrike_server.py#L17261 debug argument"
        }
      ],
      "parts": [
        {
          "name": "AI client / model",
          "zone": "client",
          "does": "The AI client and its model issue MCP tool calls.",
          "ev": "README.md#L64 diagram node for the AI agent"
        },
        {
          "name": "hexstrike_mcp.py (FastMCP client)",
          "zone": "machine",
          "does": "hexstrike_mcp.py: FastMCP client the AI client starts; forwards calls to the API server over HTTP.",
          "ev": "README.md#L228 MCP client script path in config"
        },
        {
          "name": "hexstrike_server.py (Flask API)",
          "zone": "machine",
          "does": "hexstrike_server.py: Flask REST API that executes tools and listens on a TCP port.",
          "ev": "hexstrike_server.py#L17289 Flask server start"
        },
        {
          "name": "Security tool subprocesses",
          "zone": "machine",
          "does": "External security tools run as shell subprocesses on the host.",
          "ev": "hexstrike_server.py#L6876 command executor spawns subprocesses"
        },
        {
          "name": "Target systems",
          "zone": "outside",
          "does": "Target hosts, URLs or cloud accounts under test.",
          "ev": "hexstrike_server.py#L10352 target appended to the tool command"
        },
        {
          "name": "External intelligence services",
          "zone": "outside",
          "does": "Third-party data sources (NVD, GitHub) queried for CVE and exploit data.",
          "ev": "hexstrike_server.py#L5969 NVD API endpoint"
        }
      ],
      "listens": [
        {
          "what": "The Flask API listens on all interfaces, default port 8888, with no sign-in.",
          "mode": "default",
          "bind": "all-interfaces",
          "sign_in": "none",
          "ev": "hexstrike_server.py#L17289 app.run bound to 0.0.0.0"
        },
        {
          "what": "The ZAP daemon tool binds a host (default 0.0.0.0) and port 8090 when run in daemon mode.",
          "mode": "optional",
          "bind": "all-interfaces",
          "sign_in": "optional",
          "ev": "hexstrike_server.py#L14328 default ZAP host parameter"
        }
      ],
      "connections": [
        {
          "to": "NVD (nvd.nist.gov)",
          "kind": "other",
          "when": "optional",
          "what": "Fetches CVE records from the NVD API when CVE features run.",
          "ev": "hexstrike_server.py#L5969 NVD REST endpoint"
        },
        {
          "to": "GitHub API",
          "kind": "other",
          "when": "optional",
          "what": "Searches the GitHub API for exploits and PoCs when a CVE is analyzed.",
          "ev": "hexstrike_server.py#L6410 GitHub search endpoint"
        },
        {
          "to": "User-named target",
          "kind": "target",
          "when": "default",
          "what": "Runs security tools against the target host or URL you name.",
          "ev": "hexstrike_server.py#L10352 target placed into the tool command"
        },
        {
          "to": "PyPI (pip)",
          "kind": "download",
          "when": "optional",
          "what": "Downloads named Python packages via pip into a venv.",
          "ev": "hexstrike_server.py#L5726 pip install subprocess"
        }
      ],
      "model": {
        "who": "client",
        "text": "The AI client's own model drives the MCP tools.",
        "ev": "README.md#L105 MCP-compatible agents connect via FastMCP"
      }
    },
    "needs": [
      {
        "kind": "runtime",
        "text": "Python 3.8 or later.",
        "ev": "README.md#L8 Python version badge"
      },
      {
        "kind": "tools",
        "text": "The 150+ external security tools installed separately; Kali Linux includes most.",
        "ev": "requirements.txt#L78 installation note on Kali"
      },
      {
        "kind": "os",
        "text": "Install guide shows a Linux/Mac venv activate command (a Windows activate line is also given on the next line)",
        "ev": "README.md#L124 activate command marked Linux/Mac"
      },
      {
        "kind": "setting",
        "text": "An MCP client configured to launch hexstrike_mcp.py pointing at the server URL.",
        "ev": "README.md#L228 client config references the MCP script"
      },
      {
        "kind": "authorization",
        "text": "Written authorization to test the target systems.",
        "ev": "README.md#L654 authorized-use statement"
      },
      {
        "kind": "credentials",
        "text": "API keys for cloud tools when those are used.",
        "ev": "requirements.txt#L81 cloud tools need API keys"
      },
      {
        "kind": "setting",
        "text": "The shipped client configuration hexstrike-ai-mcp.json is a template whose script path and server address are placeholders the user fills in.",
        "ev": "hexstrike-ai-mcp.json#L6-8 placeholder script path and placeholder server IP address"
      }
    ],
    "installer": [
      {
        "text": "Documented install: git clone the repo (not pinned to a commit), create a Python venv, and pip3 install -r requirements.txt; the 150+ tools are installed separately.",
        "ev": "README.md#L128 dependency install command"
      },
      {
        "text": "Optional browser-agent setup pipes a signing key into sudo apt-key and adds a Google Chrome apt repository.",
        "ev": "README.md#L185 Chrome key piped to sudo apt-key"
      }
    ],
    "limits": [
      {
        "text": "app.run is bound to 0.0.0.0, so the API listens on every network interface even though API_HOST defaults to 127.0.0.1.",
        "ev": "hexstrike_server.py#L17289 hardcoded 0.0.0.0 bind"
      },
      {
        "text": "The author recommends implementing authentication for production deployments.",
        "ev": "README.md#L650 security note on authentication"
      },
      {
        "text": "The /api/command endpoint executes any command string sent in the request.",
        "ev": "hexstrike_server.py#L9139 generic command endpoint docstring"
      },
      {
        "text": "Commands run through a shell (subprocess.Popen with shell=True).",
        "ev": "hexstrike_server.py#L6876-6878 executor uses shell=True"
      },
      {
        "text": "The file API joins the request filename onto its base directory, so absolute or parent paths reach outside the temp folder.",
        "ev": "hexstrike_server.py#L8939 filename joined to base_dir without traversal check"
      },
      {
        "text": "Deleting a directory through the file API removes it recursively via shutil.rmtree.",
        "ev": "hexstrike_server.py#L8985 recursive directory delete"
      },
      {
        "text": "The /api/python/install endpoint installs any named package into a venv via pip.",
        "ev": "hexstrike_server.py#L5726 installs arbitrary pip package"
      },
      {
        "text": "README.md#L648 warns AI agents can execute arbitrary security tools and ensure oversight; the isolated-VM advice is the adjacent L647",
        "ev": "README.md#L648 security note on agent system access"
      },
      {
        "text": "A bundled tool, Responder, poisons LLMNR, NBT-NS and MDNS on the local network to harvest credentials, an active attack beyond passive scanning.",
        "ev": "README.md#L286 Responder listed as a poisoner for credential harvesting"
      },
      {
        "text": "The /api/python/execute endpoint runs an arbitrary Python script sent in the request on the server host, a code-execution path beyond /api/command.",
        "ev": "hexstrike_server.py#L14500 execute_python_script docstring"
      },
      {
        "text": "The shipped client config template points the MCP client at http://IPADDRESS:8888, i.e. plaintext HTTP to a possibly remote API that carries no authentication.",
        "ev": "hexstrike-ai-mcp.json#L8 server URL placeholder in the client config args"
      },
      {
        "text": "The client config description notes an alwaysAllow list that, when populated, lets the agent run tools without per-call approval (autonomous execution).",
        "ev": "hexstrike-ai-mcp.json#L10 description field on alwaysAllow"
      },
      {
        "text": "The usage guide tells users to state their role and ownership of the target first because models tend to refuse a bare request to test a site.",
        "ev": "README.md#L560 usage-examples guidance on prompt framing"
      },
      {
        "text": "The usage guide states that models often decline a bare request to penetration test a site and tells users to open the prompt with their role and their relation to the target.",
        "ev": "README.md#L560 usage guide on how to frame prompts so the model does not decline"
      },
      {
        "text": "The startup banner reports the server as starting on API_HOST (default 127.0.0.1), although app.run binds 0.0.0.0.",
        "ev": "hexstrike_server.py#L198 banner prints API_HOST as the start address"
      }
    ],
    "not_found": [
      {
        "field": "maturity",
        "searched": "README.md and requirements.txt for words like preview/alpha/beta/experimental/stable/deprecated (only version numbers v6.0 and 'v7.0 coming soon' found)"
      }
    ]
  },
  "verdict": {
    "rule": "verdict-v0.1",
    "entry": "hexstrike-ai",
    "draft": "review",
    "commit": "d689933ff579d839c676c82b231f8e98326c5f04",
    "checked": "2026-10-24",
    "basis": "Isolated read of the pinned commit on 2026-10-24; every evidence line below was confirmed against the file by script. Not run in the lab.",
    "publisher": {
      "name": "0x4m4",
      "official": false
    },
    "catalog_reason": "Its API listens on all network interfaces with no login and runs any shell command it receives.",
    "reason": "On your machine it opens an API on all network interfaces with no login: anyone who reaches port 8888 can run shell commands and read or delete files anywhere on the host. The bind address is fixed in the code; no setting changes it.",
    "findings": [
      {
        "id": "listener",
        "right": "net",
        "level": 3,
        "mode": "default",
        "place": "machine",
        "gate": "none",
        "trigger": 1,
        "sentence": "Listens on port 8888 on all network interfaces, with no login.",
        "evidence": "hexstrike_server.py#L17289 app.run binds host 0.0.0.0; hexstrike_server.py#L99 HEXSTRIKE_HOST is read but used only in the startup banner (L198); hexstrike_server.py#L9137-9142 the command route checks no token or header"
      },
      {
        "id": "shell",
        "right": "exec",
        "level": 2,
        "mode": "default",
        "place": "machine",
        "gate": "none",
        "trigger": null,
        "sentence": "Runs any command string it receives through a shell.",
        "evidence": "hexstrike_server.py#L9142 the command string is taken from the request body; hexstrike_server.py#L6876-6878 it is started with subprocess.Popen and shell=True"
      },
      {
        "id": "files",
        "right": "fs",
        "level": 3,
        "mode": "default",
        "place": "machine",
        "gate": "none",
        "trigger": null,
        "sentence": "Reads, writes and deletes files anywhere on the host through its file API.",
        "evidence": "hexstrike_server.py#L8980 caller-supplied paths are joined to the base folder without a containment check; hexstrike_server.py#L8984-8985 directories are deleted recursively"
      }
    ],
    "unknowns": [
      {
        "right": "cred",
        "sentence": "Not determinable from the code: whether it reads credential stores. Its command endpoint can read any secret the server's user can."
      }
    ],
    "approval": {
      "gate": "client",
      "sentence": "Whether your MCP client asks before each tool call depends on your client. The shipped client configuration pre-approves nothing but recommends autonomous execution.",
      "evidence": "hexstrike-ai-mcp.json#L10-12 empty alwaysAllow, with a description that recommends autonomous execution"
    },
    "steps": {
      "status": "derived",
      "items": [
        {
          "id": "vm",
          "kind": "isolation",
          "closes": [
            "net",
            "exec",
            "fs"
          ],
          "text": "Run it only in a lab VM you can throw away."
        },
        {
          "id": "firewall",
          "kind": "isolation",
          "closes": [
            "net"
          ],
          "text": "Firewall port 8888 on that VM."
        },
        {
          "id": "bind",
          "kind": "code-change",
          "closes": [
            "net"
          ],
          "text": "Or change the bind address at hexstrike_server.py line 17289 to 127.0.0.1."
        },
        {
          "id": "approvals",
          "kind": "setting",
          "closes": [
            "hitl"
          ],
          "text": "Keep every HexStrike tool on manual approval in your MCP client and add nothing to alwaysAllow."
        }
      ]
    },
    "description_gap": "Its description is narrower than the code: it names a target you choose, not a listener open to the network or file access outside its own folder.",
    "what_would_change": "Bind to localhost by default (the code already reads HEXSTRIKE_HOST, but ignores it for binding) and require a token.",
    "facts": [
      {
        "text": "Its startup banner prints 127.0.0.1 while the server listens on all interfaces: HEXSTRIKE_HOST changes only the banner.",
        "evidence": "hexstrike_server.py#L198 the banner prints API_HOST; hexstrike_server.py#L17289 the server binds 0.0.0.0"
      },
      {
        "text": "The port can be changed with HEXSTRIKE_PORT or --port; there is no option for authentication.",
        "evidence": "hexstrike_server.py#L98 HEXSTRIKE_PORT sets the port; hexstrike_server.py#L17261 the only flags are --debug and --port"
      },
      {
        "text": "The README advises isolated environments and suggests adding authentication for production, without saying how.",
        "evidence": "README.md#L650 authentication is mentioned only as a suggestion"
      }
    ],
    "approvers": {
      "acts_as": "the operating-system user that runs hexstrike_server.py, for anyone who can reach port 8888",
      "fits": [
        {
          "where": "Your workstation",
          "answer": "no",
          "why": "the API is open to your network without a login"
        },
        {
          "where": "A lab VM",
          "answer": "with conditions",
          "why": "only with port 8888 firewalled and every tool call on manual approval"
        },
        {
          "where": "A CI runner",
          "answer": "no",
          "why": "no one is there to answer confirmations, and the API would be open on the runner"
        }
      ]
    }
  },
  "runs": []
}