usestrix /
strix
Autonomous AI agents that pentest your app and prove each bug with a working exploit
- 71.2k stars
- 5.2k stars since 3 Oct
- Python
- Updated today
- Some experience
- Infrastructure & security
Traditional scanners often flag issues that are not really exploitable, and manual pentests are slow and costly. Strix takes a different route. AI agents run your app, poke at it the way a human tester would, and try to build a working proof-of-concept for each suspected flaw.
Each agent gets a toolkit inside a Docker sandbox: an HTTP proxy (Caido), a browser, a shell, a Python runtime for writing exploits, and recon tools. Several agents can work together, sharing what they find and chaining weaknesses. You supply an LLM API key from a provider such as OpenAI or Anthropic, or point it at a local model.
You aim it at a folder, a GitHub repo, a live URL or an API spec. Results are saved to disk, and a local web viewer shows findings and the agent team. The README also describes a hosted Strix Cloud and an Enterprise tier. The open-source version runs locally and is free apart from your LLM costs.
What it does
Exploit-validated findings
Agents try to produce a working proof-of-concept for each issue, with remediation guidance, rather than only listing suspicious patterns.
Multi-agent teamwork
Specialised agents handle recon, exploitation and post-exploitation in parallel, sharing discoveries and chaining vulnerabilities.
Many target types
Scan local code, a GitHub repo, a live site, or an OpenAPI, Swagger or Postman spec. Authenticated grey-box tests and multiple targets are supported.
CI/CD and headless mode
A non-interactive flag exits non-zero when vulnerabilities are found, and a sample GitHub Actions workflow scans pull requests.
Local web viewer
The strix view command opens a dashboard of findings, a live map of the agents, and past runs, all on your machine.
What you could build
- Scan your own web app or codebase for OWASP Top 10 issues before release.
- Run a quick security check on every pull request through GitHub Actions.
- Test every endpoint of an API by feeding it an OpenAPI or Postman file.
- Automate bug bounty research and draft proof-of-concepts for reports.
- Give a coding agent such as Claude Code the ability to run pentests through the installable skills.
Get started
Make sure Docker is running and you have an LLM API key. Install Strix, set your model and key, then point it at a project folder. The first run pulls the sandbox image, and results land in strix_runs/<run-name>.
curl -sSL https://strix.ai/install | bashexport STRIX_LLM="openrouter/z-ai/glm-5.3"
export LLM_API_KEY="your-api-key"strix --target ./app-directoryCommands are copied from the project's README. Read it on GitHub for the full setup.
More in Infrastructure & security
litellm
One OpenAI-style API and proxy server for calling 100+ LLM providers
NemoClaw
Reference stack for running AI agents inside NVIDIA OpenShell sandboxes
SkillSpector
Scans AI agent skills for security risks before you install them
CubeSandbox
Self-hosted MicroVM sandboxes for running AI agent code, compatible with the E2B SDK