What is Strix?

Strix is an open-source AI penetration testing tool that uses autonomous agents to dynamically test your applications for security vulnerabilities. Unlike traditional SAST/DAST scanners that produce endless false positives, Strix agents behave like real hackers — they run your code, chain exploits, and validate every finding with a working proof-of-concept.

It is built for developers, security engineers, and DevOps teams who need fast, accurate security testing without the overhead of manual pentesting engagements.

Why It's Trending

Strix has exploded on GitHub with over 30,000 stars in under a year, landing as the #1 trending repository. Several factors drive this adoption:

• Traditional scanners are noisy — SAST tools like SonarQube and Snyk produce high false-positive rates that desensitize teams
• AI agents deliver real results — Strix agents dynamically interact with your app instead of pattern-matching against a ruleset
• Developer-first CLI — a beautiful terminal UI and headless mode for CI/CD pipelines
• Multi-agent orchestration — specialized agents for recon, exploitation, and post-exploitation that share discoveries
• Self-hosted or cloud — install locally with Docker or use the managed platform at app.strix.ai

Prerequisites

Before you start, make sure you have:

• Docker installed and running (the sandbox runs in a container)
• An LLM API key — Strix supports many providers: OpenAI (GPT-5.4), Anthropic (Claude Sonnet 4.6), Google (Gemini 3 Pro), local models via Ollama
• A target application to test — your own codebase, a deployed web app, or a GitHub repository you own

Architecture Overview

The diagram above shows Strix's internal architecture. The Strix CLI is your entry point — it accepts targets (local directories, GitHub repos, or live URLs) and dispatches work to the Agent Orchestrator, which manages a team of specialized AI agents.

Each agent has access to a Security Toolkit containing:

• HTTP Proxy (Caido-based) — for request/response manipulation
• Browser Automation (Playwright) — for XSS, CSRF, clickjacking testing
• Terminal — for command execution and exploit development
• Python Runtime — a sandboxed environment for writing and validating PoCs
• Reconnaissance Module — for OSINT, subdomain enumeration, and fingerprinting

The Vulnerability Engine orchestrates the attack pipeline:

• Recon Agent maps the attack surface
• Exploitation Agent attempts to exploit discovered weaknesses
• Validation Agent confirms each finding with a working PoC
• Reporting Agent generates structured findings with CVSS scores, OWASP classification, and remediation guidance

Results flow to the Report Generator, which outputs a compliance-ready pentest report and can automatically create pull requests with security patches.

Installation

Installing Strix is a one-liner:

curl -sSL https://strix.ai/install | bash

This downloads the CLI binary and sets up everything you need. Verify the installation:

strix --version

Configuration

Configure your LLM provider — Strix stores this in ~/.strix/cli-config.json so you only need to set it once:

export STRIX_LLM="anthropic/claude-sonnet-4-6"
export LLM_API_KEY="sk-ant-..."

Other optional configuration includes:

# Use a local model via Ollama
export LLM_API_BASE="http://localhost:11434"
export STRIX_LLM="ollama/llama-4"

# Enable search capabilities (improves recon)
export PERPLEXITY_API_KEY="pplx-..."

# Control reasoning effort
export STRIX_REASONING_EFFORT="high"

Basic Usage

Scan a Local Codebase

strix --target ./my-web-app

Strix launches an interactive TUI that shows real-time findings. The first run pulls the sandbox Docker image automatically.

Test a Deployed Web Application

strix --target https://staging.myapp.com

Scan a GitHub Repository

strix --target https://github.com/org/repo

Headless Mode (for CI/CD)

strix -n --target ./my-app --scan-mode quick

The -n flag disables the interactive UI. Strix exits with a non-zero code if vulnerabilities are found.

Authenticated Testing

strix --target https://myapp.com --instruction "Authenticated scan using credentials admin:password123"

CI/CD Integration

Add Strix to your GitHub Actions pipeline to automatically scan every pull request:

name: strix-pentest

on:
  pull_request:

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install Strix
        run: curl -sSL https://strix.ai/install | bash

      - name: Run Strix
        env:
          STRIX_LLM: ${{ secrets.STRIX_LLM }}
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
        run: strix -n -t ./ --scan-mode quick

In CI mode, Strix automatically scopes its review to changed files only.

Advanced Scanning Modes

Strix supports several scan modes:

Mode	Description	Use Case
quick	Fast scan focused on critical vulnerabilities	CI/CD, PR reviews
standard	Comprehensive scan of OWASP Top 10	Weekly security audits
deep	Full exploitation with multi-agent coordination	Pre-release pentesting

You can also target specific vulnerability categories:

strix --target api.myapp.com --instruction "Focus on SSRF, IDOR, and business logic flaws"

Verification Checklist

After deploying Strix:

• CLI installed — strix --version returns a version number
• Docker sandbox pulls — first scan downloads the sandbox image without errors
• LLM provider configured — cat ~/.strix/cli-config.json shows your provider and key
• Scan completes — a full scan of a small web app finishes without hanging
• Findings are real — review the PoC in strix_runs/<run-name> to confirm valid results
• CI/CD pipeline passes — GitHub Actions workflow runs and reports results

Resources

• GitHub Repository: github.com/usestrix/strix
• Documentation: docs.strix.ai
• Website: strix.ai
• Cloud Platform: app.strix.ai
• Discord Community: discord.gg/strix-ai
• LLM Providers Guide: docs.strix.ai/llm-providers/overview