Development · GitHub repo
Strix
Open-source AI pentesting agents that dynamically exploit and validate application vulnerabilities.
Strix is an open-source penetration testing tool that orchestrates autonomous AI agents to simulate real-world attacks. Unlike static code scanners, it dynamically interacts with applications, constructs working proofs-of-concept (PoCs) to verify vulnerabilities, and provides remediation guidance or automated fixes. It can be run locally via Docker with your own LLM keys, integrated into CI/CD pipelines, or used through a hosted cloud platform.
What it's for
- Run autonomous dynamic penetration tests against local repositories or deployed web apps
- Validate application security flaws with working proof-of-concept exploits to eliminate false positives
- Integrate automated vulnerability assessments into CI/CD pipelines to block insecure pull requests
- Test API endpoints automatically using OpenAPI, Swagger, or Postman collections
- Equip coding agents like Claude Code or Cursor with offensive security tools via Agent Skills
Features
- Multi-agent architecture coordinating reconnaissance, exploitation, and validation
- Real exploit validation generating reproducible proof-of-concept scripts
- Built-in offensive toolkit including Caido interception proxy, headless browser automation, and shell execution
- Broad vulnerability detection covering OWASP Top 10, IDOR, injection, SSRF, and business logic flaws
- CI/CD integration for GitHub Actions to scan pull request code diffs
- Local web dashboard viewer to review findings and watch agent execution
- Model Context Protocol (MCP) support to connect custom external tools
- Supports multiple LLM backends via LiteLLM including OpenAI, Anthropic, Google, and local setups
Pricing
Open source. Free and open source (Apache-2.0); optional hosted Strix Cloud and Enterprise tiers available.
Details
- Type
- GitHub repo
- Category
- Development
- Topic
- Security & Pentesting
- Open source
- Yes
- Platforms
- Command line, Self-hosted, Web
- For
- Developers, AppSec engineers, and penetration testers looking to automate dynamic security assessments.
- Alternative to
- Nuclei, Snyk, Burp Suite, OWASP ZAP
- Tags
- pentesting, ai agents, appsec, cybersecurity, red teaming, vulnerability scanner
Why it was saved
- @kyle.disruptor: Unlike static scanners, it actively executes targeted attacks on running apps to prove vulnerabilities are real, generates reproducible proofs of concept, and suggests fixes before launch.
Related
Coding-agent skill for multi-phase code security audits with verified structured findings
Turn websites and documents into clean, LLM-ready markdown or structured data.
Browser automation CLI and engine purpose-built for AI agents
Open-source collection of runnable AI agent, skill, and RAG templates
Turn any website into a structured REST API using natural language
Agent skills enabling AI coding agents to create programmatic Remotion videos
Updated