README.md
<a href="https://docs.strix.ai"></a> <a href="https://strix.ai"></a>
<a href="https://deepwiki.com/usestrix/strix"></a> <a href="https://github.com/usestrix/strix"></a> <a href="LICENSE"></a> <a href="https://pypi.org/project/strix-agent/"></a>
<a href="https://discord.gg/strix-ai"></a> <a href="https://x.com/strix_ai"></a>
<a href="https://trendshift.io/repositories/15362" target="_blank"></a>
</div>[!TIP] New! Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches production!
Strix are autonomous AI agents that act just like real hackers - they run your code dynamically, find vulnerabilities, and validate them through actual proof-of-concepts. Built for developers and security teams who need fast, accurate security testing without the overhead of manual pentesting or the false positives of static analysis tools.
Key Capabilities:
Prerequisites:
# Install Strix
curl -sSL https://strix.ai/install | bash
# Configure your AI provider
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"
# Run your first security assessment
strix --target ./app-directory
[!NOTE] First run automatically pulls the sandbox Docker image. Results are saved to
strix_runs/<run-name>
Try the Strix full-stack security platform at app.strix.ai — sign up for free, connect your repos and domains, and launch a pentest in minutes.
Strix agents come equipped with a comprehensive security testing toolkit:
Strix can identify and validate a wide range of security vulnerabilities:
Advanced multi-agent orchestration for comprehensive security testing:
# Scan a local codebase
strix --target ./app-directory
# Security review of a GitHub repository
strix --target https://github.com/org/repo
# Black-box web application assessment
strix --target https://your-app.com
# Grey-box authenticated testing
strix --target https://your-app.com --instruction "Perform authenticated testing using credentials: user:pass"
# Multi-target testing (source code + deployed app)
strix -t https://github.com/org/app -t https://your-app.com
# Focused testing with custom instructions
strix --target api.your-app.com --instruction "Focus on business logic flaws and IDOR vulnerabilities"
# Provide detailed instructions through file (e.g., rules of engagement, scope, exclusions)
strix --target api.your-app.com --instruction-file ./instruction.md
Run Strix programmatically without interactive UI using the -n/--non-interactive flag—perfect for servers and automated jobs. The CLI prints real-time vulnerability findings, and the final report before exiting. Exits with non-zero code when vulnerabilities are found.
strix -n --target https://your-app.com
Strix can be added to your pipeline to run a security test on pull requests with a lightweight GitHub Actions workflow:
name: strix-penetration-test
on:
pull_request:
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install Strix
run: curl -sSL https://strix.ai/install | bash
- name: Run Strix
env:
STRIX_LLM: ${{ secrets.STRIX_LLM }}
LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
run: strix -n -t ./ --scan-mode quick
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"
# Optional
export LLM_API_BASE="your-api-base-url" # if using a local model, e.g. Ollama, LMStudio
export PERPLEXITY_API_KEY="your-api-key" # for search capabilities
export STRIX_REASONING_EFFORT="high" # control thinking effort (default: high, quick scan: medium)
[!NOTE] Strix automatically saves your configuration to
~/.strix/cli-config.json, so you don't have to re-enter it on every run.
Recommended models for best results:
openai/gpt-5.4anthropic/claude-sonnet-4-6vertex_ai/gemini-3-pro-previewSee the LLM Providers documentation for all supported providers including Vertex AI, Bedrock, Azure, and local models.
Get the same Strix experience with enterprise-grade controls: SSO (SAML/OIDC), custom compliance reports, dedicated support & SLA, custom deployment options (VPC/self-hosted), BYOK model support, and tailored agents optimized for your environment. Learn more.
Full documentation is available at docs.strix.ai — including detailed guides for usage, CI/CD integrations, skills, and advanced configuration.
We welcome contributions of code, docs, and new skills - check out our Contributing Guide to get started or open a pull request/issue.
Have questions? Found a bug? Want to contribute? Join our Discord!
Love Strix? Give us a ⭐ on GitHub!
Strix builds on the incredible work of open-source projects like LiteLLM, Caido, Nuclei, Playwright, and Textual. Huge thanks to their maintainers!
</div>[!WARNING] Only test apps you own or have permission to test. You are responsible for using Strix ethically and legally.