# strix

> Autonomous AI agents that pentest your app and prove each bug with a working exploit

- Repository: https://github.com/usestrix/strix
- Category: Infrastructure & security
- Stars: 71,211 · Forks: 7,920 · Language: Python · License: Apache-2.0
- Experience: Some experience
- Page: https://ir.adyog.com/repos/usestrix/strix/

Traditional scanners often flag issues that are not really exploitable, and manual pentests are slow and costly. Strix takes a different route. AI agents run your app, poke at it the way a human tester would, and try to build a working proof-of-concept for each suspected flaw.

Each agent gets a toolkit inside a Docker sandbox: an HTTP proxy (Caido), a browser, a shell, a Python runtime for writing exploits, and recon tools. Several agents can work together, sharing what they find and chaining weaknesses. You supply an LLM API key from a provider such as OpenAI or Anthropic, or point it at a local model.

You aim it at a folder, a GitHub repo, a live URL or an API spec. Results are saved to disk, and a local web viewer shows findings and the agent team. The README also describes a hosted Strix Cloud and an Enterprise tier. The open-source version runs locally and is free apart from your LLM costs.

## What it does

- **Exploit-validated findings**: Agents try to produce a working proof-of-concept for each issue, with remediation guidance, rather than only listing suspicious patterns.
- **Multi-agent teamwork**: Specialised agents handle recon, exploitation and post-exploitation in parallel, sharing discoveries and chaining vulnerabilities.
- **Many target types**: Scan local code, a GitHub repo, a live site, or an OpenAPI, Swagger or Postman spec. Authenticated grey-box tests and multiple targets are supported.
- **CI/CD and headless mode**: A non-interactive flag exits non-zero when vulnerabilities are found, and a sample GitHub Actions workflow scans pull requests.
- **Local web viewer**: The strix view command opens a dashboard of findings, a live map of the agents, and past runs, all on your machine.

## What you could build

- Scan your own web app or codebase for OWASP Top 10 issues before release.
- Run a quick security check on every pull request through GitHub Actions.
- Test every endpoint of an API by feeding it an OpenAPI or Postman file.
- Automate bug bounty research and draft proof-of-concepts for reports.
- Give a coding agent such as Claude Code the ability to run pentests through the installable skills.

## Who it's for

Developers and security engineers who can run Docker and manage an LLM API key, and who only test systems they own or are authorised to test.

## Get started

Make sure Docker is running and you have an LLM API key. Install Strix, set your model and key, then point it at a project folder. The first run pulls the sandbox image, and results land in strix_runs/<run-name>.

```
curl -sSL https://strix.ai/install | bash
```
```
export STRIX_LLM="openrouter/z-ai/glm-5.3"
export LLM_API_KEY="your-api-key"
```
```
strix --target ./app-directory
```

Tags: pentesting, security, ai-agents, cli, ci-cd