strix - Open-source AI penetration testing tool to find an

项目说明

<p align="center">
<a href="
<img src=" alt="Strix Banner" width="100%">
</a>
</p>

<di="center">

Strix

The open-源码 AI pentesting 工具. Autonomous AI hackers that find and fix your app’s .

<br/>

<a href=" src=" alt="Docs"></a>
<a href=" src=" alt="Website"></a>
![]()

<a href=" src=" alt="Strix Cloud"></a>
<a href=" src=" alt="Try Strix Enterprise"></a>

<a href=" src=" alt="GitHub Stars"></a>
<a href="LICENSE"><img src=" alt="License"></a>
<a href=" src=" alt="PyPI "></a>

<a href=" src=" height="40" alt="Join Discord"></a>
<a href=" src=" height="40" alt="Follow on X"></a>

<a href=" target="_blank" rel="noopener noreferrer"><img src=" alt="usestrix%2Fstrix | Trendshift" width="250" height="55"/></a>
<a href=" target="_blank"><img src=" alt="usestrix/strix | Trendshift" width="250" height="55"/></a>

</div>

> [!TIP]
> New! Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for on every pull request and block insecure 代码 before it reaches production - Get started with no setup required.

---

Strix O

Strix are autonomous AI penetration testing agents that act just like real hackers - they run your 代码 dynamically, find , and them through actual proofs-of-concept. Built for de and security teams who need fast, accurate security testing without the o of manual pentesting or the false positives of static analysis tools.

Key Capabilities:

<br>

<di="center">
<a href="
<img src=".github/screenshot.png" alt="Strix Demo" width="1000" style="border-radius: 16px;">
</a>
</div>

Use Cases

🚀 Quick Start

Prerequisites:

Installation & First Scan

> [!NOTE]
> First run automatically pulls the sandbox Docker image. Results are saved to strix_runs/<run-name>

---

Ways to Run Strix

---

☁️ Strix Cloud

Try the Strix full-stack penetration testing platform at app.strix.ai - sign up for free, connect your repos and domains, and launch a pentest in minutes.

Run a pentest →

🏢 Enterprise

Get the same Strix experience with enterprise-grade controls: SSO (SAML/OIDC), custom compliance-ready penetration testing reports (SOC 2, ISO 27001, PCI DSS), dedicated support and SLA, custom deployment options (VPC or self-hosted), BYOK model support, and tailored AI pentesting agents optimized for your en.

Try Strix Enterprise →

---

🤖 Use Strix from Your Coding Agent

Strix is agent-ready. Gi 代码, Cursor, Codex, or any SKILL.md-compatible agent the ability to run pentests, fix findings, and set up CI scanning:

This installs nine skills for running pentests, fixing findings, and CI scanning, against 代码, web apps, APIs, and the OWASP Top 10. Agents can use the local CLI or the managed cloud with the same 引擎.

See AGENTS.md for the quick reference, docs.strix.ai/llms.txt for the CLI, and docs.app.strix.ai for the API.

---

✨ Features

Agentic Pentesting Tools

Strix agents come equipped with a comprehensi security toolkit - the same tools used by professional penetration testers and ethical hackers:

Comprehensi Scanner

Strix identifies, , and exploits a wide range of security across the OWASP Top 10 and beyond:

Graph of Agents (Multi-Agent Pentesting)

Ad multi-agent orchestration for comprehensi penetration testing:

---

🖥️ Local Web

Every scan writes its results to disk as it runs. Bring them up in a local dashboard with a single command:

The dashboard shows the findings, a live map of the agent team, and past runs. Nothing leaves your machine, and the UI ships prebuilt. strix view binds to 127.0.0.1 and prints a tokened link that grants access to the run, so share it carefully.

See the documentation for the options and for reaching the from another machine.

---

Usage Examples

Basic Usage

API Testing (OpenAPI / Swagger / Postman)

Point Strix at an API contract and it tests every declared endpoint instead of
having to discover them by crawling. Pair the spec with the live base URL so the
agent knows where to send traffic:

Ad Testing Scenarios

See the CLI reference for every option, including scan modes, diff scope, instruction files, and budgets.

Headless Mode

Run Strix programmatically without interactive UI using the -n/--non-interactive flag - perfect for servers and automated jobs. The CLI prints real-time findings and the final report before exiting. Exits with non-zero 代码 when are found.

CI/CD (GitHub Actions)

Strix can be added to your pipeline to run a security test on pull requests with a lightweight GitHub Actions workflow:

> [!TIP]
> In CI pull request runs, Strix automatically scopes quick reviews to changed files, which is why the
> checkout abo full history. See the
> CI/CD documentation for the details.

Configuration

> [!NOTE]
> Strix automatically saves your configuration to ~/.strix/cli-config.json, so you don't have to re-enter it on every run.
> See the configuration reference for every en .

#### Sign in with a ChatGPT subscription

Instead of a metered API key, you can run Strix on your ChatGPT Plus/Pro subscription:

#### Use the managed platform: strix cloud

Run scans on app.strix.ai from the terminal, without Docker or an LLM key:

Every REST API operation has a matching strix cloud <resource> <verb> command. Run strix cloud to list the resources, and add help to a resource to list its verbs. Output is JSON when stdout is not a terminal or when you pass --json. Binary downloads are the exception: redirect the raw bytes, or combine --output FILE --json for download metadata.

See the cloud CLI documentation for scopes, workspaces, billing, and 源码-upload options.

#### Connect your own MCP servers

Strix can connect to Model Context 协议 (MCP) servers you list and expose their tools to the agent during a run. Create ~/.strix/mcp-servers.json with a JSON list of local stdio servers or remote http servers:

Each 服务端's tools are namespaced by name, for example github_list_issues. See the MCP documentation for the full schema, 工具 filtering, and stdio servers.

Recommended models for best results:

See the LLM Pro documentation for all supported pro including AI, Bedrock, Azure, and local models.

Documentation

Full documentation is a at docs.strix.ai - including detailed guides for usage, CI/CD integrations, skills, and ad configuration.

Contributing

We welcome contributions of 代码, docs, and new skills - check out our Contributing Guide to get started or open a pull request/issue.

Join Our Community

Ha? Found a bug? Want to contribute? Join our Discord!

Support the Project

Lo? Give us a ⭐ on GitHub!

Acknowledgements

Strix builds on the incredible work of open-源码 projects like LiteLLM, Caido, Nuclei, Playwright, and Bubble Tea. Huge thanks to their maintainers!

> [!WARNING]
> Authorized use only. Strix actively tests the targets you point it at, so only run it against systems you own or have explicit, written permission to test, and stay within the agreed scope. Unauthorized testing is illegal in most jurisdictions.
> You alone are responsible for obtaining authorization and complying with the law. Strix is provided "as is" with no warranty or liability for misuse.

</div>

项目信息

开发语言：Python

Star 数：66595

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-源码 AI penetration testing 工具 to find and fix your app’s vulnerabilities.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。