system_status — Fast health check: worker readiness, active engagement scope and a capability summary.
capabilities_search — Find typed adapters and general capabilities, including host execution and installed-tool inventory; filter by pack, category, query or availability.
capabilities_describe — Get operation schemas, supported versions, risk labels and examples (optionally probing versions).
engagement_manage — Inspect, create, update or revoke an engagement scope: allowed/excluded targets, ports, protocols, rate/timeout/artifact budgets, concurrency, worker target and metadata-endpoint blocking. (max_risk_level is legacy and not enforced; risk labels never block execution.)
action_prepare — Validate a capability's arguments against its schema and return an immutable plan with an approval grant.
job_start — Start an authorized plan by plan_id, or prepare-and-start directly with capability_id + arguments, optionally with an idempotency key and inline wait.
job_status — Query bounded job status, structured output, findings and streaming events via a cursor.
job_cancel — Cancel one job or all active jobs, terminating the OS process group.
evidence_read — Paginated, redacted access to raw evidence artifacts by evidence_id or job_id, with method/status/URL filters.
memory_query — Bounded, engagement-scoped retrieval from local temporal memory and promoted lessons.
Supports optional isolated execution of tools and commands inside Docker containers when Docker is installed on the server, providing a sandboxed alternative to running directly on the host.
Supports optional isolated execution of tools and commands inside Podman containers when Podman is installed on the server, providing a sandboxed alternative to running directly on the host.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@HexStrike AI MCP run nmap against scanme.nmap.org and summarize open ports"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
HexStrike connects AI assistants to the tools, terminal, files and browser on your server through the Model Context Protocol (MCP). Your AI client requests work; HexStrike runs it, records output and evidence, and shows progress in a terminal dashboard.
Runs installed command-line tools and custom scripts without requiring an adapter for each program.
Supports persistent shells and REPLs, incremental input/output, terminal resizing, timeouts and cancellation.
Provides browser navigation, forms, screenshots, uploads/downloads and saved sessions.
Discovers server executables and offers optional typed adapters for structured arguments and results.
Retains jobs, paginated evidence and local memory for subsequent review.
Shows jobs, sessions, installed tools and connection settings in the server dashboard.
Ten MCP tools provide discovery, execution and result retrieval. Detailed capability schemas load when requested. Available software and the server account's OS permissions determine what can run.
Related MCP server: server-ops-mcp
Run on Linux, Kali or macOS:
curl -fsSL https://raw.githubusercontent.com/Lyrie-ai/hexstrike-ai-beta/main/install.sh | shOr install from a checkout:
git clone https://github.com/Lyrie-ai/hexstrike-ai-beta.git
cd hexstrike-ai-beta
./install.shThe installer handles Python, dependencies and browser setup, then starts the server and opens the dashboard without a setup questionnaire. You do not need to create a virtual environment or change your system Python. Internet access and curl or wget are required; installing a missing Linux browser may request sudo. Windows users can run the server in a Linux VM.
First startup detects a server IP, listens on port 8000, generates an authentication token and shows the connection details in Connect. Use that URL and token from an MCP client that can reach the server. No Tailscale installation is required. Direct-IP connections use HTTP; the token controls access but does not encrypt traffic. Configure HTTPS for internet access or use an encrypted network you manage. The AI-client machine does not need HexStrike installed.
Installation, platform requirements and troubleshooting
To install now and start later, use ./install.sh --no-start. HexStrike uses command-line tools installed on the host; an adapter is not required for each program.
Reopen the dashboard on the server:
~/.local/share/hexstrike/hexstrikeIf ~/.local/bin is on your PATH, use hexstrike. Open Connect for the MCP URL, token and copyable Cursor, Claude Code, Codex or VS Code configuration. Closing the dashboard with q leaves the server running. Clear view hides displayed history without deleting evidence; Refresh restores it.
For unattended operation, configure a service manager. The background launcher does not install a boot service automatically.
Server configuration and client connections
Guide | Contents |
One-command install, checkout install, platforms, upgrades and uninstall | |
Authentication, HTTPS, state paths, clients, service operation and optional integrations | |
Native tools, terminals, browsers, evidence, adapters and dashboard controls | |
Components, execution flow, storage and trust boundaries | |
Tests, benchmarks, builds and repository hygiene |
Authenticated native execution has the server account's filesystem and network access. Optional isolated execution uses Docker, Podman or Bubblewrap when installed. Scanner findings and intelligence metadata need review; they are not proof of exploitability. Local memory supports retrieval and provenance, not automatic code rewriting.
The server supports POSIX systems. Client configuration formats, container engines and external tool versions need testing in their actual deployment environment. See the development guide for the automated checks and opt-in integration tests.
Validate a capability-specific argument object against its schema and return an immutable plan and approval grant.
Inputs: capability_id (required), arguments, operation, engagement_id, +2 more. Returns: result
Return operation schemas, supported versions, informational risk labels, and examples. Risk labels do not restrict execution.
Inputs: capability_ids (required), probe_version. Returns: result
Find typed adapters and general capabilities. execution.host runs installed tools and scripts without registration; tools.inventory discovers server executables.
Inputs: pack, limit, query, category, +1 more. Returns: result
Inspect, create, update, or revoke an engagement scope, port/protocol rules, rate/timeout budgets, and worker target. Risk labels do not restrict execution; max_risk_level is a legacy compatibility field.
Inputs: name, action, valid_from, valid_until, +14 more. Returns: result
Paginated, redacted access to raw evidence artifacts by evidence_id or job_id.
Inputs: view, limit, job_id, method, +5 more. Returns: result
Cancel a running job (or all active jobs via cancel_all=True) and terminate its OS process group.
Inputs: job_id, cancel_all. Returns: result
Start an authorized plan (via plan_id) OR directly prepare-and-start a capability (via capability_id + arguments) with optional idempotency key.
Inputs: wait, plan_id, arguments, operation, +5 more. Returns: result
Query bounded job status, structured output, findings, and streaming events by job_id and cursor.
Inputs: job_id, cursor_seq, engagement_id. Returns: result
Bounded, engagement-scoped retrieval from local temporal memory and promoted lessons.
Inputs: limit, query, entity_type, engagement_id, +1 more. Returns: result
Fast core health, worker readiness, active engagement scope, and capability summary.
Inputs: engagement_id. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 10 tools
The job lifecycle tools are distinct, but action_prepare overlaps heavily with job_start, which can itself prepare-and-start a capability from capability_id + arguments, leaving two paths to the same end state. engagement_manage also multiplexes inspect/create/update/revoke behind one name, so its invocation semantics are less predictable than the single-purpose job_* tools.
Most names follow a resource_action pattern (job_start, job_status, job_cancel, evidence_read, memory_query, capabilities_search), with system_status and action_prepare as the only deviations. The convention is readable and predictable, but 'action_prepare' uses a vague resource noun and breaks the otherwise consistent scheme.
Ten tools is well-scoped for a security engagement orchestration server: discovery, planning, execution, monitoring, evidence, and memory each get representation. No obvious filler tools, and no critical concern is absent from the surface for count reasons.
The lifecycle is largely closed: discover capabilities, prepare a plan, start, poll, cancel, and read evidence plus memory. Minor gaps remain — there is no job enumeration tool (only cancel_all as a workaround) and no explicit approval/rejection operation for the approval grant produced by action_prepare, which may force agents into awkward paths.
Connect AI assistants to authorized Windows and macOS devices for files, commands, and management.
Connect AI assistants to your approved computer for files, commands, browser and desktop tasks.
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Secure AI access to Windows, macOS, Linux computers and a hosted Cloud Browser.
