#66th of 6 in Security
hexstrike-ai
MCP server that lets AI clients drive 150+ pentesting tools
- Stars
- 13k
- License
- MIT
- Last commit
- Aug 2026
- Language
- Python
7,622 on 31 Mar 202612,985 on 20 Oct 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
HexStrike AI runs a Python Flask-style server (hexstrike_server.py, default port 8888) and an MCP bridge (hexstrike_mcp.py) that lets clients such as Claude Desktop, Cursor, VS Code Copilot and Roo Code call security tools like nmap, nuclei, sqlmap, hydra, ghidra and prowler. It adds a decision engine for tool selection and 12+ named agent workflows for bug bounty, CTF and CVE work. The tools themselves must be installed separately.
Who it is for: Pentesters and bug bounty hunters wiring LLM clients to security tooling
Strengths
- Covers network, web, cloud, binary, CTF and OSINT tooling behind one MCP interface
- Works with any MCP client; configs shown for Claude Desktop and VS Code Copilot
- Includes a headless Chrome browser agent for screenshots, DOM and header analysis
- MIT license; plain Python setup with requirements.txt
Weaknesses
- Most of the 150+ tools are not bundled and must be installed by hand
- No Docker image or compose file; no tagged release
- Can run offensive tools like hydra and sqlmap, so it needs strict scoping and isolation
- README tool and agent counts are marketing figures; the wrappers are not independently verified
What it needs
- GPU optional
- Needs Python 3.8+, nmap, nuclei, sqlmap and other security tools, Chrome/Chromium with chromedriver, MCP-compatible client
- Models: Claude, GPT, Copilot, any MCP-compatible client
- port 8888
Also in Security
See all 6| Rank | Project | Score |
|---|---|---|
| 1 | shannonAutonomous pentester that exploits web apps and APIs using source code analysis | 77 out of 100 |
| 2 | StrixAutonomous AI pentesting agents that validate vulnerabilities with working exploits | 75 out of 100 |
| 3 | pentagiAutonomous multi-agent penetration testing system with sandboxed security tools | 73 out of 100 |
| #4 | ifixaiPython CLI that audits AI agents for policy, access and reliability failures | 62 out of 100 |
| #5 | pentestgptAutonomous pentest agent that drives Claude Code or Codex against a target | 41 out of 100 |