cyberstrike run

Run CyberStrike non-interactively with a message.

cyberstrike run sends a prompt to an agent and streams the response to your terminal. It is the main entry point for scripting, CI pipelines, and headless automation.

cyberstrike run [message..] [flags]

The message positional argument accepts one or more words that are joined into a single prompt. You can also pipe text via stdin.

Flags

--command · string

Run a named command instead of a free-form prompt. The message positional arguments are passed as the command’s arguments.

--continue, -c · boolean

Continue the most recent session instead of starting a new one.

--session, -s · string

Session ID to continue. Takes precedence over --continue when both are provided.

--fork · boolean

Fork the session before continuing. Creates a new branch from the existing session history. Requires --continue or --session.

--share · boolean

Share the session and print the share URL after the run completes.

--model, -m · string

Model to use, specified as provider/model (e.g. anthropic/claude-sonnet-4-5). Overrides the default model for this run only.

--agent · string

Name of the agent to use (e.g. web-application). If the agent is not found or is a subagent, the default agent is used.

--format · string · default: "default"

Output format. Choose default for human-readable formatted output or json for newline-delimited JSON events suitable for piping to other tools.

--file, -f · string[]

One or more file paths to attach to the message. May be specified multiple times. Directories are attached as application/x-directory.

--title · string

Title for the session. If the flag is present but no value is given, the first 50 characters of the message are used.

--attach · string

Base URL of a running CyberStrike server to attach to (e.g. http://localhost:4096). When set, no local server is started.

--dir · string

Directory to run in. When using --attach, this is the directory on the remote server.

--port · number

Port for the local server that run starts internally. Defaults to a random port when omitted. Use this to expose the local server for external inspection or --attach from another process.

--variant · string

Model variant controlling provider-specific reasoning effort (e.g. high, max, minimal).

--thinking · boolean · default: "false"

Show thinking blocks in the output when the model supports extended reasoning.

Examples

Basic prompt

cyberstrike run "test example.com for SQL injection"

JSON events

When --format json is set, each event is a newline-delimited JSON object containing a type field and a timestamp (Unix milliseconds). Common event types:

Type	When
text	The model produced a text block
reasoning	The model produced a thinking block (requires --thinking)
tool_use	A tool was invoked and completed
step_start	A reasoning step began
step_finish	A reasoning step finished
error	The session encountered an error

cyberstrike run --format json "scan target" | jq 'select(.type == "text") | .part.text'

Permission requests are automatically rejected in run mode. If an agent needs interactive permission, switch to the TUI or configure permission rules in your cyberstrike.json.