README

Strix

 The open-source AI pentesting tool. Autonomous AI hackers that find and fix your app’s vulnerabilities.


























 [!TIP]
 New! Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches production - Get started with no setup required.

---


 Strix Overview

Strix are autonomous AI penetration testing agents that act just like real hackers - they run your code dynamically, find vulnerabilities, and validate them through actual proofs-of-concept. Built for developers and security teams who need fast, accurate security testing without the overhead of manual pentesting or the false positives of static analysis tools.

Key Capabilities:

- Full pentesting toolkit - reconnaissance, exploitation, and validation out of the box
- Multi-agent orchestration - teams of AI pentesters that collaborate and scale
- Real exploit validation - working PoCs, not false positives like legacy vulnerability scanners
- Developer‑first CLI - actionable findings with remediation guidance
- Auto‑fix & reporting - generate patches and compliance-ready pentest reports






  
    
  



 Use Cases

- Application Security Testing - Detect and validate critical vulnerabilities in your applications
- Rapid Penetration Testing - Get penetration tests done in hours, not weeks, with compliance reports
- Bug Bounty Automation - Automate bug bounty research and generate PoCs for faster reporting
- CI/CD Integration - Run tests in CI/CD to block vulnerabilities before reaching production

 🚀 Quick Start

Prerequisites:
- Docker (running)
- An LLM API key from any supported provider (OpenAI, Anthropic, Google, etc.)

 Installation & First Scan

bash
 Install Strix
curl -sSL https://strix.ai/install | bash

 Configure your AI provider
export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"    Vercel AI Gateway
 export STRIX_LLM="openrouter/z-ai/glm-5.3"        OpenRouter
export LLM_API_KEY="your-api-key"

 Run your first security assessment
strix --target ./app-directory


 [!NOTE]
 First run automatically pulls the sandbox Docker image. Results are saved to strix_runs/

 Updating

bash
 Self-update the standalone binary to the latest release
strix --update

 ...or re-run the installer
curl -sSL https://strix.ai/install | bash


Installed with pipx, uv, or pip? strix --update prints the matching upgrade command instead (pipx upgrade strix-agent, uv tool upgrade strix-agent, pip install --upgrade strix-agent). Strix also shows a notice with the right command when a new version is available.

---

 Ways to Run Strix

- Open Source - free, runs locally with Docker and your own LLM key. Quick Start
- Strix Cloud - no setup, validated findings, one-click autofix, and PR reviews. Run a pentest →
- Enterprise - SSO, compliance-ready reports, VPC or self-hosted deployment. Try Strix Enterprise →

---

 ☁️ Strix Cloud

Try the Strix full-stack penetration testing p

Top issues

Latest release

What's Changed
 fix(models): frontier model check matches the model name only, never the provider route by @0xallam in https://github.com/usestrix/strix/pull/1280
 feat(reporting): link HTTP exchange evidence by @bearsyankees in https://github.com/usestrix/strix/pull/1281
 feat(prompts): require http_exchange_ids for proxy-validated findings by @0xallam in https://github.com/usestrix/strix/pull/1292
 docs: add Vercel AI Gateway provider guide by @erulkey in https://github.com/usestrix/strix/pull/1254
 fix(web_search): send only the agent's query to Exa search by @0xallam in https://github.com/