Strix
Open-source AI pentest agents that run real attacks to find, validate, and fix vulnerabilities in your apps.
Open source alternative to:
Strix is an open-source AI penetration testing tool built around autonomous agents that behave like real hackers: they run reconnaissance against your target, exploit it dynamically, and validate every finding with a working proof-of-concept instead of a static-analysis guess. A single scan covers the OWASP Top 10 and beyond — SQL injection, XSS, IDOR, auth flaws, misconfigurations — across web apps, APIs, mobile backends, networks, and local source code.
Agents run inside a Docker sandbox and come with a full pentesting toolkit out of the box, with multi-agent orchestration to scale scans. Findings include reproduction steps, exploit evidence, and remediation guidance, and Strix can auto-generate patches. It integrates with GitHub Actions and CI/CD pipelines to block vulnerable code before it merges, and there is an agents SKILL.md so coding agents like Claude Code or Cursor can run pentests directly.
Compared to Burp Suite, Strix automates agent-driven exploitation rather than providing a manual interception proxy; compared to pentest-as-a-service platforms like Cobalt or HackerOne, it runs continuously and locally with your own LLM API key at no subscription cost. Strix Cloud and an Enterprise tier add managed scans, one-click autofix PRs, SSO, and compliance-ready reporting, but the core tool is fully free to run yourself.
Frequently Asked Questions
Which platforms does Strix run on?
Strix is a CLI tool you install on Linux, macOS, or Windows via an install script (or through pip/pipx/uv, distributed on PyPI as strix-agent). Scans execute inside a Docker sandbox, so Docker must be running on the host. There is also Strix Cloud, a hosted web platform, and a GitHub Action for CI/CD scans.
Do I need my own LLM API key to use Strix?
Yes for the open-source version — you supply an API key from any supported provider such as OpenAI, Anthropic, or Google, configured through environment variables like STRIX_LLM and LLM_API_KEY. Strix Cloud and Enterprise instead run the same engine for you as a managed service.
What targets can Strix scan?
You can point Strix at a local directory of source code, a web application or API by URL, or broader targets including mobile backends and network hosts. It covers injection flaws, broken access control, XSS, authentication issues, and misconfigurations, and validates findings with working exploits.
Does Strix integrate with CI/CD pipelines?
Yes. Strix ships GitHub Actions integration so scans run automatically on pull requests and can block insecure code before it merges, with no extra setup required for the cloud pipeline. It also documents generic CI/CD usage for other pipelines.
Can coding agents like Claude Code use Strix?
Yes. Strix is agent-ready and exposes a SKILL.md — running npx skills add usestrix/strix installs nine skills so Claude Code, Cursor, Codex, or any SKILL.md-compatible agent can launch pentests, fix findings, and set up CI scanning using the local CLI or Strix Cloud.
OpenAltFinder Score
Project Details
Repository details
Updated 10/14/2026, 7:00:16 AM
View Repository