Architecture

中文

CyberStrikeAI is a single Go Web application with a static frontend, SQLite persistence, Agent orchestration, MCP tooling, workflow graphs, knowledge retrieval, and optional C2/WebShell subsystems.

Overview

flowchart LR
    U["Web / Robot / API"] --> R["Gin Router"]
    R --> H["Handlers"]
    H --> DB["SQLite"]
    H --> A["Agent / Multi-Agent"]
    A --> M["MCP Server"]
    M --> T["Built-in / YAML / Skill tools"]
    M --> EM["External MCP"]
    A --> K["Knowledge Retrieval"]
    H --> W["Workflow Runtime"]
    H --> C2["C2"]
    H --> WS["WebShell"]
    H --> AU["Audit / Monitor"]

Request Path

For /api/eino-agent/stream:

Gin route enters auth middleware.
Handler parses message, conversation, role, uploads, and WebShell context.
Agent builds model input: history, role prompt, project facts, tools.
Eino Runner calls the model.
Tool requests go through MCP.
HITL may interrupt before execution.
Tool results are saved to process details and monitoring.
Model continues and produces final text.
SSE streams progress and deltas to the browser.
Conversation and process details persist to SQLite.

This explains why a failure may live in auth, config, model, MCP, HITL, DB, SSE, or frontend rendering.

Cross-Cutting Modules

Project facts are injected into Agent context.
HITL sits before tool execution.
Monitor records tool execution and supports cancellation/review.
Audit records platform management actions.
Tool search controls what tools the model can currently see.

These are not just pages; they affect many runtime paths.

Complexity Hotspots

internal/app/app.go: service construction and route wiring.
internal/handler/config.go: hot application of config across model, KB, C2, robot, MCP.
internal/multiagent/: streaming, retry, summarization, middleware, tools.
internal/security/: auth and shell execution boundary.
internal/database/: SQLite schema compatibility.

Design Trade-Offs

The project uses a single Go service, static frontend, and SQLite to keep deployment simple. The trade-offs:

multi-instance scale is not automatic;
runtime files must be backed up carefully;
high-privilege tools and admin UI live in one process, so deployment isolation matters.

Source Anchors

App wiring: internal/app/app.go
Handlers: internal/handler/
Multi-agent: internal/multiagent/
MCP: internal/mcp/
DB: internal/database/

2.5 KiB Raw Blame History