Strix

Overview

Strix is an open-source AI penetration testing tool and a full-stack security platform. Its autonomous AI agents run targets dynamically, find vulnerabilities, and validate findings with working proofs-of-concept. Strix combines a pentesting toolkit, multi-agent orchestration, auto-fix, reporting, and coverage for code, APIs, web apps, infrastructure, and cloud.

Key Features

• Autonomous AI penetration testing agents that run targets dynamically, find vulnerabilities, and validate them with actual proofs-of-concept.
• Full pentesting toolkit including reconnaissance, exploitation, validation, HTTP interception proxy, browser exploitation, shell execution, custom exploit runtime, and OSINT.
• Multi-agent orchestration with specialized agents for recon, exploitation, and post-exploitation that share discoveries and chain vulnerabilities.
• Auto-fix and reporting with generated patches and compliance-ready pentest reports.
• Coverage across code and pull requests, APIs and web apps, and infrastructure and cloud.
• Developer-first CLI with actionable findings and remediation guidance.

Use Cases

• Application security testing to detect and validate critical vulnerabilities in applications.
• Rapid penetration testing with compliance reports in hours rather than weeks.
• Bug bounty automation to generate proofs-of-concept for faster reporting.
• CI/CD integration to block vulnerabilities before they reach production.

Getting Started

• Install Strix with the official install script.
• Set STRIX_LLM to a supported model provider identifier and set LLM_API_KEY to your API key.
• Run strix --target ./app-directory to scan a local codebase; --target also accepts a repository or web application URL.
• The first run automatically pulls the sandbox Docker image, and results are saved to the strix_runs directory.

Deployment & Requirements

• Local open-source use requires Docker to be running.
• Local runs require an LLM API key from a supported provider such as OpenAI, Anthropic, or Google.
• Enterprise deployment can be self-hosted in a VPC, on-premise, or air-gapped environment.
• Strix Cloud is a managed option that does not require local Docker or an LLM key for terminal scans.

Before You Adopt

• License: Apache-2.0. Review its terms before using, modifying, or distributing the project.
• Strix is intended only for authorized testing; the source warns that unauthorized testing is illegal in most jurisdictions.
• Local Strix runs require Docker to be running.
• Local runs depend on an external LLM provider through an API key.
• The enterprise offering states that source code is not stored or used for model training and that model providers operate under zero data retention agreements.