# Strix

> Open-source AI agents that hack your app to find and prove real vulnerabilities

- Category: Evaluation & Production Ops / Evaluation & Red-Teaming
- Language: Python
- Licence: Apache-2.0
- Repository: https://github.com/usestrix/strix
- Website: https://strix.ai
- Canonical page: https://ai-tldr.dev/tools/strix/

## In short

Strix is an open-source security testing tool built around autonomous AI agents that behave like real hackers. Instead of only scanning code statically, the agents run your application dynamically, look for weaknesses, and confirm each finding with an actual proof-of-concept so you get fewer false positives. It sits in the Evaluation & Red-Teaming category of the Evaluation & Production Ops tools and is open-source, written in Python and licensed Apache-2.0.

## Overview

Strix is an open-source security testing tool built around autonomous AI agents that behave like real hackers. Instead of only scanning code statically, the agents run your application dynamically, look for weaknesses, and confirm each finding with an actual proof-of-concept so you get fewer false positives.

It is aimed at developers and security teams who want fast, accurate testing without the cost of manual pentesting. Strix ships as a developer-first CLI that produces actionable reports, can run teams of agents that collaborate, and plugs into CI/CD so insecure code can be caught before it reaches production.

## What it does

- Full hacker toolkit out of the box: HTTP proxy, browser automation, terminal shells, and a Python runtime for custom exploits
- Real validation with working proof-of-concepts instead of unverified false positives
- Detects a wide range of issues: access control (IDOR, privilege escalation), injection (SQL, NoSQL, command), SSRF/XXE, XSS, business-logic and auth flaws
- Graph of Agents: multiple specialized agents run in parallel and share discoveries for broad coverage
- Works with any supported LLM provider (OpenAI, Anthropic, Google, and others), set via environment variables
- Headless non-interactive mode and a GitHub Actions workflow for scanning pull requests in CI/CD

## Getting started

Strix needs Docker running and an LLM API key from a supported provider (OpenAI, Anthropic, Google, etc.). You install it with a single script, point it at your AI provider, and run a scan against a local directory, a GitHub repo, or a live URL.

1. Install Strix

   Install the CLI with the official install script.

```bash
curl -sSL https://strix.ai/install | bash
```

2. Configure your AI provider

   Set the model and API key as environment variables. Strix saves this configuration to ~/.strix/cli-config.json so you do not have to re-enter it each run.

```bash
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"
```

3. Run your first security assessment

   Point Strix at a local app directory. The first run automatically pulls the sandbox Docker image, and results are saved to strix_runs/<run-name>.

```bash
strix --target ./app-directory
```

4. Scan a repo or live app

   You can also target a GitHub repository or a deployed application for a black-box assessment.

```bash
strix --target https://github.com/org/repo
strix --target https://your-app.com
```

## When to use it

- Application security testing: detect and validate critical vulnerabilities in your applications
- Rapid penetration testing: get pentests done in hours instead of weeks, with compliance reports
- Bug bounty automation: automate research and generate proof-of-concepts for faster reporting
- CI/CD integration: run tests on pull requests to block vulnerabilities before they reach production