One open-source MCP server that hands an AI agent the keys to a full offensive toolkit — nmap to sqlmap to hashcat — and lets it plan and run the engagement on its own. Powerful in authorized hands. A liability in sloppy ones. Five questions below check your guardrails.
| Fact | Value |
|---|---|
| Repository | github.com/0x4m4/hexstrike-ai |
| Popularity | ~12,900 stars, ~2,700 forks (live count, Oct 2026) |
| Language / license | Python · MIT (permissive open source) |
| Activity | Created July 2025; commits as recently as Oct 17, 2026 |
| What it claims | 150+ integrated security tools, 12+ autonomous AI agents, FastMCP protocol |
| Agent clients | Claude Desktop, VS Code Copilot, Cursor, Roo Code, 5ire, any MCP-compatible agent |
| Maintainer | OTT Cybersecurity LLC |
Sources: repo metadata via GitHub; README (v6.0). Community coverage: mcp.directory, mcpmarket, and a dev.to comparison of MCP offensive-security approaches.
The pattern is the story here — HexStrike is one of its biggest open-source examples:
nmap or sqlmap, the agent sees 150+ tools as callable functions with descriptions.The key idea: the LLM supplies judgment about what to try next; the tools supply the actual capability. Neither half is new — the combination is.
| Category | Share of the 150+ | Example tools (from the README) |
|---|---|---|
| Web application | 40+ | gobuster, ffuf, nikto, sqlmap, wpscan, dalfox |
| Network & recon | 25+ | nmap, masscan, rustscan, amass, subfinder, nuclei |
| Binary analysis | 25+ | gdb, radare2, binwalk, ghidra, volatility3 |
| Cloud security | 20+ | prowler, scout-suite, trivy, kube-hunter |
| CTF tooling | 20+ | steghide, exiftool, hash-identifier, john |
| OSINT | 20+ | theHarvester, fierce, dnsenum |
These are mature, real-world offensive tools — the same ones human pentesters use. The agent just drives them faster, and at machine scale.
A sibling open-source project, Watchtower, works on the same problem but sits at a different layer:
In plain terms: HexStrike gives agents hands; Watchtower is a pair of hands. Teams evaluating agentic pentesting should look at both layers — the tool surface and the agent driving it.
Both — that is the honest answer. HexStrike AI is an open-source cybersecurity tool: an MCP server that lets AI agents run 150+ real pentest tools autonomously. In the wrong hands the same capability automates attacks, which is why this page exists: to give defenders a readiness check before the tool shows up in their logs.
None of this is a flaw in the code — it's the inherent shape of autonomous offensive tooling. The README itself draws the line: authorized testing, bug bounties within program scope, CTFs, research on owned systems, red teams with approval. Unauthorized testing and data theft are explicitly off-limits.
Answer honestly. "Yes" isn't always the right answer — two of these are traps.
An open-source MCP (Model Context Protocol) server - github.com/0x4m4/hexstrike-ai, MIT-licensed, about 12,900 stars - that lets MCP-compatible agents like Claude, GPT, and Copilot autonomously call 150+ real security tools for reconnaissance, scanning, and exploitation workflows.
The agent connects over MCP, sees 150+ tools as callable functions, a decision layer picks tools and chains steps (recon, scanning, exploitation), specialist agents take roles, and results come back as dashboards and risk summaries.
Autonomy without a leash (noisy or out-of-scope tests), hallucinated tradecraft sending tool calls down damaging paths, scope being a human job, and credential sprawl when agent logs are not handled like evidence.
HexStrike is the tool server: it exposes 150+ tools over MCP and waits for an agent to call in. Watchtower is the agent itself: it runs its own LangGraph loop (Planner, Worker, Analyst) and drives a smaller toolset.
Only with written authorization - the project's README draws the line at authorized testing, bug bounties within program scope, CTFs, and research on owned systems. This page gives no installation or run instructions by design.