✨ Open-source AI hackers for your apps 👨🏻‍💻

⭐ Love Strix? Give us a star to help other developers discover it!

Strix are autonomous AI agents that act just like real hackers - they run your code dynamically, find vulnerabilities, and validate them through actual proof-of-concepts. Built for developers and security teams who need fast, accurate security testing without the overhead of manual pentesting or the false positives of static analysis tools.

• Full hacker toolkit out of the box
• Teams of agents that collaborate and scale
• Real validation with PoCs, not false positives
• Developer‑first CLI with actionable reports
• Auto‑fix & reporting to accelerate remediation

• Detect and validate critical vulnerabilities in your applications.
• Get penetration tests done in hours, not weeks, with compliance reports.
• Automate bug bounty research and generate PoCs for faster reporting.
• Run tests in CI/CD to block vulnerabilities before reaching production.

Prerequisites:

• Docker (running)
• Python 3.12+
• An LLM provider key (or a local LLM)

# Install
pipx install strix-agent

# Configure AI provider
export STRIX_LLM="openai/gpt-5"
export LLM_API_KEY="your-api-key"

# Run security assessment
strix --target ./app-directory

First run pulls the sandbox Docker image. Results are saved under agent_runs/<run-name>.

Want to skip the setup? Try our cloud-hosted version: usestrix.com

• 🔌 Full HTTP Proxy - Full request/response manipulation and analysis
• 🌐 Browser Automation - Multi-tab browser for testing of XSS, CSRF, auth flows
• 💻 Terminal Environments - Interactive shells for command execution and testing
• 🐍 Python Runtime - Custom exploit development and validation
• 🔍 Reconnaissance - Automated OSINT and attack surface mapping
• 📁 Code Analysis - Static and dynamic analysis capabilities
• 📝 Knowledge Management - Structured findings and attack documentation

• Access Control - IDOR, privilege escalation, auth bypass
• Injection Attacks - SQL, NoSQL, command injection
• Server-Side - SSRF, XXE, deserialization flaws
• Client-Side - XSS, prototype pollution, DOM vulnerabilities
• Business Logic - Race conditions, workflow manipulation
• Authentication - JWT vulnerabilities, session management
• Infrastructure - Misconfigurations, exposed services

• Distributed Workflows - Specialized agents for different attacks and assets
• Scalable Testing - Parallel execution for fast comprehensive coverage
• Dynamic Coordination - Agents collaborate and share discoveries

# Local codebase analysis
strix --target ./app-directory

# Repository security review
strix --target https://github.com/org/repo

# Web application assessment
strix --target https://your-app.com

# Multi-target white-box testing (source code + deployed app)
strix -t https://github.com/org/app -t https://your-app.com

# Test multiple environments simultaneously
strix -t https://dev.your-app.com -t https://staging.your-app.com -t https://prod.your-app.com

# Focused testing with instructions
strix --target api.your-app.com --instruction "Prioritize authentication and authorization testing"

# Testing with credentials
strix --target https://your-app.com --instruction "Test with credentials: testuser/testpass. Focus on privilege escalation and access control bypasses."

export STRIX_LLM="openai/gpt-5"
export LLM_API_KEY="your-api-key"

# Optional
export LLM_API_BASE="your-api-base-url"  # if using a local model, e.g. Ollama, LMStudio
export PERPLEXITY_API_KEY="your-api-key"  # for search capabilities

📚 View supported AI models

Run Strix programmatically without interactive UI using the -n/--non-interactive flag—perfect for servers and automated jobs. The CLI prints real-time vulnerability findings, and the final report before exiting. Exits with non-zero code when vulnerabilities are found.

strix -n --target https://your-app.com --instruction "Focus on authentication and authorization vulnerabilities"

Strix can be added to your pipeline to run a security test on pull requests with a lightweight GitHub Actions workflow:

name: strix-penetration-test

on:
  pull_request:

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Strix
        run: pipx install strix-agent

      - name: Run Strix
        env:
          STRIX_LLM: ${{ secrets.STRIX_LLM }}
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}

        run: strix -n -t ./

Our managed platform provides:

• 📈 Executive Dashboards
• 🧠 Custom Fine-Tuned Models
• ⚙️ CI/CD Integration
• 🔍 Large-Scale Scanning
• 🔌 Third-Party Integrations
• 🎯 Enterprise Support

Get Enterprise Demo →

• Container Isolation - All testing in sandboxed Docker environments
• Local Processing - Testing runs locally, no data sent to external services

We welcome contributions from the community! There are several ways to contribute:

See our Contributing Guide for details on:

• Setting up your development environment
• Running tests and quality checks
• Submitting pull requests
• Code style guidelines

Help expand our collection of specialized prompt modules for AI agents:

• Advanced testing techniques for vulnerabilities, frameworks, and technologies
• See Prompt Modules Documentation for guidelines
• Submit via pull requests or issues

Love Strix? Give us a ⭐ on GitHub!

Have questions? Found a bug? Want to contribute? Join our Discord!