CyberAgent

CyberAgent is a basic multi-agent server security auditing CLI tool. Powered by the Google Agent Development Kit (ADK) and the Gemini 2.5 Flash model, it helps system administrators and security engineers analyze their servers for vulnerabilities, misconfigurations, and anomalies.

Features

• Multi-Agent Architecture: Uses an Orchestrator agent to smartly delegate tasks to specialized sub-agents:
  • NetworkSecurityAgent: Audits open ports, listening services, and firewall rules (netstat, ss, ufw).
  • SystemAuditAgent: Analyzes system configurations and permissions (e.g., /etc/ssh/sshd_config, id).
  • LogAnalyzerAgent: Scans local authentication logs for brute-force attempts or anomalies (/var/log/auth.log).
• Interactive TUI: Terminal User Interface built with Bubble Tea.
• Security-First Execution:
  • Command Whitelisting: Only explicitly allowed commands can be executed by the agents (e.g., netstat, cat, grep).
  • Directory Sandboxing: Read access is strictly limited to relevant directories to prevent Path Traversal vulnerabilities.
  • User in the Loop: Sensitive actions trigger a prompt requiring explicit user approval (y/n) before execution.
• Detailed Logging: All actions and findings are securely logged to ~/.cyber_agent/audit.log.

Prerequisites

• Go 1.25 or higher
• A valid Google Gemini API Key

Installation & Setup

1. Clone the repository:

   git clone https://github.com/matinft7/cyber_agent.git
   cd cyber_agent

2. Set your Gemini API Key:

   export GEMINI_API_KEY="your_api_key_here"

3. Build the CLI:

   go build -o auditor ./cmd/auditor

4. Run the auditor:

   ./auditor

Usage 💡

Once you start the CLI, you will be greeted by the terminal interface. You can type instructions in natural language. For example:

• "Check if there are any suspicious SSH logins in the logs."
• "Audit the currently open ports and see if anything shouldn't be exposed."
• "Check my UFW firewall status."

When an agent needs to run a system command or read a file, it will ask for your permission in the interface. Press y to allow or n to deny.

Project Structure

• cmd/auditor/: The main entrypoint and application setup.
• internal/agent/: The Orchestrator and specialized sub-agents definitions.
• internal/tools/: Secure implementation of the tools (Command Executor and File Reader).
• internal/ui/: Bubble Tea TUI components and agent bridge logic.

Security Warning

While the agent tools have been sandboxed with strict whitelists, this tool is designed to run security diagnostics on servers. Please review the agent's planned commands in the approval prompt carefully before accepting.

License

MIT License.