# Strix

> Open-source AI pentesting agents that dynamically exploit and validate application vulnerabilities.

Strix is an open-source penetration testing tool that orchestrates autonomous AI agents to simulate real-world attacks. Unlike static code scanners, it dynamically interacts with applications, constructs working proofs-of-concept (PoCs) to verify vulnerabilities, and provides remediation guidance or automated fixes. It can be run locally via Docker with your own LLM keys, integrated into CI/CD pipelines, or used through a hosted cloud platform.

Website: https://github.com/usestrix/strix

## What it is for

- Run autonomous dynamic penetration tests against local repositories or deployed web apps
- Validate application security flaws with working proof-of-concept exploits to eliminate false positives
- Integrate automated vulnerability assessments into CI/CD pipelines to block insecure pull requests
- Test API endpoints automatically using OpenAPI, Swagger, or Postman collections
- Equip coding agents like Claude Code or Cursor with offensive security tools via Agent Skills

## Features

- Multi-agent architecture coordinating reconnaissance, exploitation, and validation
- Real exploit validation generating reproducible proof-of-concept scripts
- Built-in offensive toolkit including Caido interception proxy, headless browser automation, and shell execution
- Broad vulnerability detection covering OWASP Top 10, IDOR, injection, SSRF, and business logic flaws
- CI/CD integration for GitHub Actions to scan pull request code diffs
- Local web dashboard viewer to review findings and watch agent execution
- Model Context Protocol (MCP) support to connect custom external tools
- Supports multiple LLM backends via LiteLLM including OpenAI, Anthropic, Google, and local setups

## Pricing

Open source. Free and open source (Apache-2.0); optional hosted Strix Cloud and Enterprise tiers available.

## Details

- Type: GitHub repo
- Category: [Development](https://xiry.app/topics/development.md)
- Open source: yes
- Platforms: Command line, Self-hosted, Web
- For: Developers, AppSec engineers, and penetration testers looking to automate dynamic security assessments.
- Alternative to: Nuclei, Snyk, Burp Suite, OWASP ZAP
- Tags: pentesting, ai agents, appsec, cybersecurity, red teaming, vulnerability scanner

## Why it was saved

- [@kyle.disruptor, 20 August 2026](https://www.instagram.com/reel/DcRfbXnjO_j/): Unlike static scanners, it actively executes targeted attacks on running apps to prove vulnerabilities are real, generates reproducible proofs of concept, and suggests fixes before launch.

## Related

- [security-audit-skill](https://xiry.app/resources/security-audit-skill): Coding-agent skill for multi-phase code security audits with verified structured findings (GitHub repo, Free)
- [Firecrawl](https://xiry.app/resources/firecrawl-1984): Turn websites and documents into clean, LLM-ready markdown or structured data. (Website, Freemium)
- [agent-browser](https://xiry.app/resources/agent-browser): Browser automation CLI and engine purpose-built for AI agents (GitHub repo, Open source)
- [awesome-llm-apps](https://xiry.app/resources/awesome-llm-apps): Open-source collection of runnable AI agent, skill, and RAG templates (GitHub repo, Open source)
- [Parse](https://xiry.app/resources/parse): Turn any website into a structured REST API using natural language (Web app, Freemium)
- [Remotion Agent Skills](https://xiry.app/resources/remotion-agent-skills): Agent skills enabling AI coding agents to create programmatic Remotion videos (GitHub repo, Open source)

Updated 3 October 2026. Page: https://xiry.app/resources/strix

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.