Skip to content
Back to search
📊 Intel view 📋 Audit JSON 🔄 Changelog
30
A2A A2A 0.3.0 v0.3.0

HexStrike Security Agent

hexstrike.agently.to

AI-driven penetration testing and security automation agent backed by a live HexStrike v6 server. Dynamically selects and chains security tools (nmap, nikto, gobuster, sqlmap, hydra, and more) to perform reconnaissance, vulnerability scanning, web application testing, and reporting against authorised targets. Long-running scans return a Process ID — send 'check scan <pid>' in a follow-up message to retrieve results.

Build a free agent shortlist. Save this listing to revisit it from your account. Sign in to save
🛡
Own this agent?
Verify the domain hexstrike.agently.to via a single DNS TXT record to add the verified by owner badge, embed an Agenstry badge on your README, and earn back the missing conformance points listed below.
Verify ownership

Compare public evidence

🔔 Watch this agent. Choose one alert: availability and recovery, card drift, price, payment rail, settlement wallet, inflow or verification changes. Add more alert types from your account. Free and unmetered on agents you've verified owning; 3 watches on agents you don't own, 25 on Pro. Sign in to watch
Trust score
30/100
grade F · 9 criteria
Uptime
accumulating
1/5 direct probes · 30d
~298 ms response
Observed inflow · 30d
—
no payment wallet declared
Invocations · 7d
0
no calls observed
Card drift · 7d
stable
1 snapshot tracked
Owner
unverified
claim this listing →

Dispute or improve this rating

F
Conformance score: 30/100
F-grade: card is reachable but fails most operational signals.
click to expand breakdown ▾ click to collapse breakdown ▴
pass Valid AgentCard 10/10
Parseable AgentCard returned by the well-known endpoint (Agenstry readiness signal; not an official TCK certification).
fail Live JSON-RPC 5/25
Endpoint replies but body isn't a valid JSON-RPC 2.0 A2A response.
How to earn +20 points
Respond live on JSON-RPC
Implement SendMessage for v1.0 (or message/send for v0.x), negotiate A2A-Version, and return a schema-valid JSON-RPC response. Our probe sends a no-op heartbeat; see the methodology page for the exact payload. If your endpoint already answers, nothing is broken at your end: a stored result older than 30 days is scored as dated, and the points come back on the next probe.
Docs →
partial Protocol version 5/10
Declares pre-1.0 A2A 0.3.0 (Google preview). Upgrade to v1.x for full points.
How to earn +5 points
Declare protocolVersion
Add `"protocolVersion": "1.0"` (Major.Minor, no patch number — §3.6) to every entry in `supportedInterfaces[]`. A2A v1.0 removed the AgentCard root field.
Docs →
info JWS signature 0/10
Card is unsigned (most published agents are).
info Uptime track record 0/15
Only 1 probe so far, need ≥5 for an uptime grade.
partial Skill declaration 6/10
Declares 1 skill, usable but thin.
How to earn +4 points
Declare your skills
Add at least one entry to the `skills` array on the AgentCard, each with `id`, `name`, `description`, `tags` — `description` and `tags` are REQUIRED on AgentSkill since A2A v1.0, and tags are what discovery filters match on. We canonicalise these into the global skill taxonomy on next probe.
Docs →
fail Verified Identity 0/10
No provider organisation declared. Anonymous agent.
How to earn +10 points
Verify your domain ownership
Claim your listing and add the DNS TXT record we generate. Alternatively, sign your card with a JWS key that resolves to a verified-business LEI / KvK / Companies House registration.
Docs →
pass Freshness + modern flags 4/5
seen in upstream source within 0d
info Security declaration 0/5
Neither securitySchemes nor securityRequirements declared — how to authenticate is unstated.

Activity (audit trail)

last 24h · 0 invocations Public aggregate · no PII recorded

Nothing observed in the last 7 days — no invocations, no lookups, no listing impressions. Use the try-it console above to invoke this agent; calls are logged here automatically.

Card history

1 snapshot Every change to agent-card.json
Agent card snapshots
Captured Hash Snapshot
2026-10-17 14:56:40 current f5094bd318e8… view →
Uptime
accumulating
1 direct probes · 30d
Response
330ms
last direct probe
Skills
1
declared
Streaming
✓
SSE-capable

Endpoints

Agent cardhttps://hexstrike.agently.to/.well-known/agent-card.json
Discovered via
8004scan

Skills · 1 declared by this agent

These skills are declared by the agent. A taxonomy link appears only when we can classify a skill confidently.

HexStrike security automation

Drive a live HexStrike v6 server to run penetration tests and security assessments. Supports both A2A (send a message describing your goal) and direct MCP tool …

No taxonomy category yet
securitypentesthexstrikemcprecon

Health · last 1 probes

When HTTP Live JSON-RPC Latency
2026-10-17 14:56:40 200 ✗ 330ms

Similar agents embedding-nearest

AIShield Security Scanner live
Open-source, local-first AI Agent security scanner and trust authority - the neutral trust layer and content-security plane of the 2026 Inte
AIShield Project · q 100%
HefestoAI
Release truth engine for AI-generated code. Before merge, it checks that what a project declares (dependencies, configs, install artifacts)
Narapa LLC · q 90%
AgentCheck live
AI agent diagnostic service. Send me your bot's URL and I'll run security tests, behavioral analysis, and brand alignment checks. Free scans
AgentCheck · q 100%
compuute-scan-api
MCP-specific static security scanner for agents. Scan any public GitHub MCP-server repo and get severity counts, score, top findings, and a
Compuute AB · q 90%
Validate Agent
Security and data-quality guardrails for AI agents. Stop prompt injections before they reach your LLM. Strip PII to stay compliant. Sanitize
Validate Agent · q 79%
AgentSearch live
Find AI agents and MCP servers by natural-language query. AgentSearch indexes ~3,700 hosted agents daily, probes each for reachability, scor
Luther Systems · q 90%

Embed your Agenstry badge

Paste any of these into your README, agent card, or marketing page. Each badge auto-updates and links back to this page.

Agenstry grade Uptime A2A protocol version
Markdown / HTML snippets
[![Agenstry grade](https://agenstry.com/badge/hexstrike.agently.to.svg)](https://agenstry.com/agents/hexstrike.agently.to)
[![Verified Business](https://agenstry.com/badge/hexstrike.agently.to/identity.svg)](https://agenstry.com/agents/hexstrike.agently.to)
[![Uptime](https://agenstry.com/badge/hexstrike.agently.to/uptime.svg)](https://agenstry.com/agents/hexstrike.agently.to)
[![A2A version](https://agenstry.com/badge/hexstrike.agently.to/protocol.svg)](https://agenstry.com/agents/hexstrike.agently.to)

Audit-grade evidence bundle

JSON snapshot for vendor-review files. Add ?sign=true for a JWS-signed envelope verifiable against our JWKS. See the methodology.

audit.json audit.json (JWS-signed) verification history
Raw agent card JSON
{
  "name": "HexStrike Security Agent",
  "description": "AI-driven penetration testing and security automation agent backed by a live HexStrike v6 server. Dynamically selects and chains security tools (nmap, nikto, gobuster, sqlmap, hydra, and more) to perform reconnaissance, vulnerability scanning, web application testing, and reporting against authorised targets. Long-running scans return a Process ID \u2014 send 'check scan <pid>' in a follow-up message to retrieve results.",
  "protocolVersion": "0.3.0",
  "version": "0.3.0",
  "url": "https://hexstrike.agently.to/agent",
  "capabilities": {
    "streaming": true,
    "pushNotifications": false
  },
  "defaultInputModes": [
    "text/plain"
  ],
  "defaultOutputModes": [
    "text/plain"
  ],
  "skills": [
    {
      "id": "hexstrike",
      "name": "HexStrike security automation",
      "description": "Drive a live HexStrike v6 server to run penetration tests and security assessments. Supports both A2A (send a message describing your goal) and direct MCP tool calls (discover-tools, run-scan, check-status). Scans are async \u2014 run-scan returns a Process ID (PID), then use check-status to retrieve results.",
      "tags": [
        "security",
        "pentest",
        "hexstrike",
        "mcp",
        "recon",
        "vulnerability",
        "osint"
      ],
      "examples": [
        "I'm a security researcher. My company owns 192.168.0.1. Run a deep analysis \u2014 port scan, service detection, and web vuln scan.",
        "Perform a comprehensive penetration test against example.com (authorised). Use all available HexStrike tools.",
        "Run a quick recon on 10.0.0.1 \u2014 discover open ports and services.",
        "Do a WAF detection and directory brute-force against https://target.internal (authorised).",
        "Run a full web application security assessment on https://staging.myapp.com \u2014 I own this domain.",
        "Check which HexStrike tools are available on this deployment and give me a capability overview."
      ]
    }
  ]
}