Strix
Open-source AI pentest agents that run real attacks to find, validate, and fix vulnerabilities in your apps.
Strix is an open-source AI penetration testing tool built around autonomous agents that behave like real hackers: they run reconnaissance against your target, exploit it dynamically, and validate every finding with a working proof-of-concept instead of a static-analysis guess. A single scan covers the OWASP Top 10 and beyond — SQL injection, XSS, IDOR, auth flaws, misconfigurations — across web apps, APIs, mobile backends, networks, and local source code.
Agents run inside a Docker sandbox and come with a full pentesting toolkit out of the box, with multi-agent orchestration to scale scans. Findings include reproduction steps, exploit evidence, and remediation guidance, and Strix can auto-generate patches. It integrates with GitHub Actions and CI/CD pipelines to block vulnerable code before it merges, and there is an agents SKILL.md so coding agents like Claude Code or Cursor can run pentests directly.
Compared to Burp Suite, Strix automates agent-driven exploitation rather than providing a manual interception proxy; compared to pentest-as-a-service platforms like Cobalt or HackerOne, it runs continuously and locally with your own LLM API key at no subscription cost. Strix Cloud and an Enterprise tier add managed scans, one-click autofix PRs, SSO, and compliance-ready reporting, but the core tool is fully free to run yourself.
