Configure your AI coding agents for authorized cybersecurity work: pentesting methodology, persistent memory, curated skills, MCP tools, and reproducible workflows.
ciberbal-ai is a configuration platform for AI-assisted cybersecurity work. It takes the AI agents you already use and installs a consistent operating environment for authorized pentesting, lab work, security research, evidence handling, and technical reporting.
It configures agent prompts, skills, MCP servers, persistent memory, model routing, backups, and reproducible workflows so the agent behaves less like a generic chatbot and more like a disciplined security assistant.
Before: "I installed Claude Code / OpenCode / Cursor, but it's just a chatbot."
After: Your agent has scope-aware guardrails, repeatable methodology, persistent context, security skills, MCP tools, and reporting-oriented workflows for authorized engagements.
| Agent | Delegation Model | Key Feature |
|---|---|---|
| Claude Code | Full (Task tool) | Sub-agents, output styles |
| OpenCode | Full (multi-mode overlay) | Per-phase model routing |
| Gemini CLI | Full (experimental) | Custom agents in ~/.gemini/agents/ |
| Cursor | Full (native subagents) | 9 SDD agents in ~/.cursor/agents/ |
| VS Code Copilot | Full (runSubagent) | Parallel execution |
| Codex | Solo-agent | CLI-native, TOML config |
| Windsurf | Solo-agent | Plan Mode, Code Mode, native workflows |
| Antigravity | Solo-agent + Mission Control | Built-in Browser/Terminal sub-agents |
Scope:
ciberbal-aiis intended for authorized security work only: owned environments, labs, CTFs, training platforms, and engagements with written permission or a defined rules of engagement.
Recommended path: clone the repository and run the install script for your platform.
git clone https://github.com/Balthael/ciberbal-ai.git
cd ciberbal-ai
chmod +x scripts/install.sh
./scripts/install.shgit clone https://github.com/Balthael/ciberbal-ai.git
cd ciberbal-ai
.\scripts\install.ps1Or run it remotely: irm https://raw.githubusercontent.com/Balthael/ciberbal-ai/main/scripts/install.ps1 | iex
Once your agents are configured, open your AI agent in a project and run these two commands to register the project context:
| Command | What it does | When to re-run |
|---|---|---|
/sdd-init |
Detects stack, testing capabilities, activates Strict TDD Mode if available | When your project adds/removes test frameworks, or first time in a new project |
skill-registry |
Scans installed skills and project conventions, builds the registry | After installing/removing skills, or first time in a new project |
These are not required for basic usage. The SDD orchestrator runs /sdd-init automatically if it detects no context. But if something changed in your project (new test runner, new dependencies), re-running them manually ensures the agents have up-to-date context.
ciberbal-ai is designed to support a fast full-stack install for authorized cybersecurity and pentesting workflows:
- Quick install configures the full ecosystem by default
- no specialty prompt is required during the quick path
- Advanced install preserves granular configuration when you need it
- the long-term target is one setup usable across web, API, mobile, cloud, AD/internal, reporting, and general security workflows
The install flow does not split users into specialties. Instead, ciberbal-ai is moving toward a unified capability model where the default install provisions all major pentesting layers together:
- Web
- API
- Mobile
- AD/Internal
- WiFi/Wireless
- Cloud
- Recon
- Reporting
See Pentesting Domains for the canonical domain and engagement-phase mapping.
The full-pentest preset now bundles post-install capability packs for each canonical domain plus workflow packs for scoping, recon, enumeration, exploitation, post-exploitation, evidence, and reporting.
Important: the primary supported install flow is repository clone + platform install script. Release archives are optional, but package-manager distribution is not part of the current model.
go test ./...
go run ./cmd/ciberbal-aigit clone https://github.com/Balthael/ciberbal-ai.git
cd ciberbal-ai
chmod +x scripts/install.sh
./scripts/install.shgit clone https://github.com/Balthael/ciberbal-ai.git
cd ciberbal-ai
.\scripts\install.ps1curl -fsSL https://raw.githubusercontent.com/Balthael/ciberbal-ai/main/scripts/install.sh | bashirm https://raw.githubusercontent.com/Balthael/ciberbal-ai/main/scripts/install.ps1 | iex# Option 1: PowerShell installer (downloads binary from GitHub Releases)
irm https://raw.githubusercontent.com/Balthael/ciberbal-ai/main/scripts/install.ps1 | iexDownload the binary for your platform from GitHub Releases.
Every install, sync, and upgrade automatically snapshots your config files. Backups are compressed (tar.gz), deduplicated (identical configs are not re-backed up), and auto-pruned (keeps the 5 most recent). Pin important backups via the TUI (p key) to protect them from pruning.
See Backup & Rollback Guide for details.
| Topic | Description |
|---|---|
| Intended Usage | How ciberbal-ai is meant to be used — the mental model |
| Agents | Supported agents, feature matrix, config paths, and per-agent notes |
| Components, Skills & Presets | All components, GGA behavior, skill catalog, and preset definitions |
| Pentesting Domains | Canonical domains and engagement phases for the full-stack pentesting model |
| Usage | Persona modes, interactive TUI, CLI flags, and dependency management |
| Backup & Rollback | Backup retention, compression, dedup, pinning, and restore |
| Platforms | Supported platforms, Windows notes, security verification, config paths |
| Architecture & Development | Codebase layout, testing, and relationship to Gentleman.Dots |
ciberbal-ai is derived from an MIT-licensed AI agent configuration framework originally created by Gentleman Programming.
This project adapts that foundation for cybersecurity and pentesting workflows, preserving the original MIT license while extending the platform with a security-focused install flow, Ciberbal branding, domain-specific skills, and engagement workflow support.
This repository includes work derived from the original Gentleman Programming framework, Copyright (c) 2025 Gentleman Programming, used under the MIT License.
The original copyright notice and permission notice are preserved in LICENSE, as required by the license terms.