Appofficial publisher

Strix

App : A product you use directly

Open-source AI agent pentesting: agents run your application, find vulnerabilities, and prove each one with a PoC.

The most-watched autonomous pentesting tool right now, integrable into CI/CD. Only run it on a perimeter you own or for which you have written authorization.

Official site GitHub · 74,292 ★ Docs

Overall score

7.7 /10

Security: one caveat, see the card

Utility

8.0

Reliability

10.0

Security

One caveat

Ease

5 min · Technical

Security reflects where data goes, requested permissions and incidents on record at the verification date. It is not a guarantee of zero risk: check the deployment mode and the connections you enable.

What it does, concretely

Development and security teams struggle to test their applications thoroughly: static analysis tools generate many false positives, and manual pentests take weeks. Strix offers an autonomous alternative: AI agents run your application, explore its attack surfaces, and prove each vulnerability found with a working exploit.

In practice, Strix is installed via the command line and relies on Docker to isolate its offensive tools: an HTTP proxy, an automated browser, an interactive terminal, a Python environment for writing exploits, and attack surface mapping. Multiple specialized agents work in parallel, share their discoveries, and chain vulnerabilities together as a red team would. Each result includes a reproducible proof-of-concept and remediation guidance.

Strix is aimed at developers and security teams who want to integrate penetration testing into their development cycle, particularly via GitHub Actions or any CI/CD pipeline. The cloud version adds automatic fixes as merge-ready pull requests, continuous monitoring, and integrations with GitHub, GitLab, Jira, and Slack.

Strix is not suitable for those looking for a simple passive vulnerability scanner or who do not have rights over the systems being tested. The tool executes real attacks against the specified target: it should only be used on systems you own or for which you have explicit written authorization.

What it offers

·Detection and validation of vulnerabilities across the OWASP Top 10 and beyond, with a working proof-of-concept for each finding.
·Multi-agent orchestration: several specialized agents (reconnaissance, exploitation, post-exploitation) work in parallel and share their discoveries.
·Native CI/CD integration via GitHub Actions to block vulnerabilities before they reach production.
·Support for varied targets: local directory, GitHub repository, web URL, OpenAPI/Swagger file, or Postman collection.
·Local results viewer accessible via the strix view command, with no data leaving the machine.
·Automatic fix generation with merge-ready pull requests and retesting of the patched vulnerability. (paid)
·Continuous attack surface monitoring with new CVEs tested against your systems. (paid)
·Deployment in VPC, on-premise, or air-gapped environments with zero source data retention. (paid)

Our tips

In CI/CD mode, use --scan-mode quick with a full checkout (fetch-depth: 0): Strix will automatically limit analysis to files changed in the pull request, reducing execution time.
Use the -n (non-interactive) flag for automated environments: the CLI displays findings in real time and returns a non-zero exit code when vulnerabilities are found, allowing you to block the pipeline.
For authenticated testing, use the --instruction option to provide credentials or contextual instructions to the agent, for example: --instruction "Perform authenticated testing using credentials: user:pass".
Combine multiple targets with -t to test source code and the deployed application simultaneously, for example a GitHub repository and a staging URL.
If you have a ChatGPT Plus or Pro subscription, you can sign in via strix auth login chatgpt and use STRIX_LLM="chatgpt/gpt-5.4" to avoid metered API costs.

Watch out

LLM call costs are entirely your responsibility in the open-source version: depending on the model chosen and the size of the target, costs can vary significantly from one scan to another.
Strix executes real attacks against the specified target; using it on a system without explicit authorization carries serious legal consequences.

In practice

Price: Freemium
Commercial use: Commercial use: yes
Available on: cli, docker, cloud
Licence: Apache-2.0
FR interface: No

Security and data

Rating: Security: one caveat, see the card
Your data: Local or cloud depending on use
Maintenance: Active
Last release: 5 October 2026

Links and repository checked on 8 November 2026 · added on 23 September 2026

How to install Strix

1. Verify that Docker is installed and running on your machine. 2. Install Strix with the command: curl -sSL https://strix.ai/install | bash (review the script before running it if you wish to inspect its contents). 3. Obtain an API key from a supported LLM provider (OpenAI, Anthropic, Google, etc.). 4. Set the environment variables: export STRIX_LLM="openrouter/z-ai/glm-5.3" and export LLM_API_KEY="your-key". 5. Run your first scan only on an application you own or for which you have written authorization: strix --target ./your-app. 6. View results with strix view to open the local dashboard.

curl -sSL https://strix.ai/install | bash

Official documentation ↗

In the same category

Whole category Code →