OPEN-SOURCE AI PENTESTING

Find the flaw.
Follow the
evidence.

Give application security an investigative edge. Strix brings autonomous AI agents, dynamic testing, and reproducible findings into the developer workflow.

Explore the project ↗See it in action ↓
Open source · Apache 2.0 · Built for developers & security teams
strix / workflow preview
❯ strix --target ./your-application
01 Map the application surface
02 Coordinate specialized agents
03 Investigate potential weaknesses
04 Validate with reproducible evidence
05 Review findings & remediation
Ready to investigate
ILLUSTRATIVE WORKFLOWNOT A LIVE SCAN
Local codebasesWeb applicationsAPIs & servicesCI/CD workflows
01 / THE TOOLKIT

More than another
list of warnings.

From exploration to validation, Strix combines tools and agent coordination to make security findings actionable.

⌘
Coordination

A team of agents

Specialized agents collaborate across reconnaissance, analysis, and validation, sharing discoveries as an assessment develops.

>_
Investigation

Tools, not just text

Browser automation, HTTP inspection, shell access, and sandboxed Python support hands-on application testing.

◎
Validation

Evidence first

Working proofs of concept and reproduction steps help reviewers distinguish a suspected issue from a demonstrated weakness.

↗
Coverage

Across the stack

Investigate access controls, injection risks, authentication, business logic, and API behavior across your application surface.

≡
Reporting

Findings with context

Review vulnerability details, technical evidence, and remediation guidance in the context of your development process.

⟳
Integration

Closer to your code

Use the CLI for focused reviews or bring assessments into CI/CD. Consult upstream documentation for current integration options.

02 / THE PROCESS

From a target
to a clearer next step.

A practical assessment follows a trail of evidence. Human review remains part of deciding what to fix and how.

01

Set the scope

Choose an authorized target: local source code, a repository, or a running web application.

02

Explore & investigate

Agents map the surface and use testing tools to investigate potentially vulnerable behavior.

03

Validate the finding

Inspect evidence and reproduction steps. Understand what happened and why it matters.

04

Review & remediate

Use the report and remediation guidance to prioritize fixes, then verify the changes.

03 / WHERE IT FITS

Your application.
Your security workflow.

Start with a focused question, then choose the assessment that fits your environment.

01

Before you ship

Review a local codebase or development build to investigate security issues before a release.

02

Test what is running

Assess an authorized web application and examine how its real behavior compares with your assumptions.

03

Bring APIs into scope

Use supported API contracts, including OpenAPI specifications, to guide testing toward declared endpoints.

04

Keep reviews repeatable

Run the CLI in automated workflows and use findings as input to your team's security review process.

04 / QUICK START

Start at
the command line.

The open-source tool runs with Docker and a supported LLM provider. Install and configure it using the official guide, then point it at your authorized target.

  • Docker installed and running
  • Strix installed from the official project
  • Supported LLM provider configured
  • A clearly defined, authorized test scope
Open the setup guide ↗
# Assess a local application
strix --target ./app-directory

# Review a source repository
strix --target https://github.com/org/repo
Examples assume installation and LLM configuration are complete. Assessments actively test targets. Read the official documentation before running.
05 / GOOD QUESTIONS

Before your
first assessment.

A few things to know about the project and this page.

What is Strix?

Strix is an open-source AI penetration testing tool. It uses autonomous agents and testing tools to investigate applications, validate vulnerabilities, and provide findings with remediation guidance.

Does this website run security scans?

No. This is an independent project introduction. The links take you to the official repository and documentation, where you can learn how to install and use Strix.

What do I need to run it locally?

The upstream quick start requires Docker and a supported LLM provider configuration. Provider availability and installation instructions can change, so follow the current official documentation.

Can it replace a security review?

Treat automated findings as input to a security process. Review the scope, evidence, impact, and proposed fixes. No automated assessment establishes that an application is free of vulnerabilities.

Is Strix open source?

Yes. The upstream repository is published under Apache 2.0. Local open-source usage, LLM provider costs, and the managed cloud offering are separate considerations.

Which targets may I assess?

Only systems you own or have explicit authorization to test. Define the allowed targets and testing scope before starting an assessment.

EXPLORE THE SOURCE

Understand the tool.
Then put it to work.

Read the code, explore the documentation, and make evidence-driven testing part of your development workflow.

Explore GitHub ↗Read documentation ↗