Strix is an open-source AI penetration testing tool. Its agents use a browser, HTTP proxy, terminal, Python runtime, and code analysis to test applications and infrastructure.
The project says its agents attempt to validate findings with proof-of-concept evidence. That evidence can support triage, but it does not remove the need to check reproduction, scope, and impact.
The project is Apache 2.0 licensed and has passed 46,000 GitHub stars.
This Strix example shows a confirmed business-logic finding with severity, CVSS score, affected endpoints, and reproduction output.
What is Strix?
Strix orchestrates specialized AI agents that collaborate on a target. Its documented toolkit covers reconnaissance, browser automation, request manipulation, command execution, code analysis, and exploit development.
You can point it at a local directory, repository, live URL, domain, or IP address. The agents inspect and interact with the target rather than limiting the run to source-code pattern matching.
The CLI uses LiteLLM for compatibility with more than 100 providers. Published guides cover OpenAI, Anthropic, OpenRouter, Google Vertex AI, AWS Bedrock, Azure OpenAI, Novita AI, and local OpenAI-compatible models.
Key Features
| Feature | Details |
|---|---|
| Testing approach | Autonomous multi-agent, dynamic code execution against the running app |
| Validation | Proof-of-concept evidence and reproduction details |
| Coverage | OWASP Top 10 and beyond, including business logic and API flaws |
| Targets | Local directory, repository, URL, domain, or IP address |
| LLM providers | 100+ through LiteLLM, including local models |
| Automation | Headless mode (-n), GitHub Actions, pull-request diff scoping |
| Scan modes | Quick, standard, or deep (--scan-mode) |
| License | Apache 2.0, 46,000+ GitHub stars |
Vulnerability coverage
Strix targets the OWASP Top 10 and a range of classes beyond it. The list below comes from the project’s documentation.
- Access control: IDOR, privilege escalation, and authentication bypass
- Injection: SQL, NoSQL, and command injection
- Server-side: SSRF, XXE, and deserialization
- Client-side: XSS, prototype pollution, and DOM vulnerabilities
- Authentication: JWT and session-management weaknesses
- Business logic: race conditions and workflow manipulation
- Infrastructure: misconfigurations and exposed services
Test scoping and CI
The CLI reads plain instructions through --instruction or --instruction-file, so you can direct agents at specific flows. Diff scoping (--scope-mode diff with --diff-base) limits a run to changed code.
Headless mode (-n) and a published GitHub Actions workflow let Strix run on every pull request without an interactive session.
Getting Started
Strix installs with a single command. Docker must be running, and you need either an LLM API key or a configured local model.
curl -sSL https://strix.ai/install | bash
Set your model and key, then point Strix at a target:
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"
strix --target ./app-directory
You can also pass a repository (--target https://github.com/org/repo) or a live URL. Add -n for headless CI runs, and the CLI reports each validated vulnerability with a proof-of-concept and remediation guidance.
Strix Platform (hosted)
Beyond the open-source CLI, the vendor (OmniSecure, Inc.) runs a hosted Strix Platform for continuous testing. It adds PR security reviews, one-click autofix with merge-ready pull requests, attack-surface monitoring, and scheduled pentesting.
The Platform Pro plan is $29 per seat per month and includes Jira, Linear, and Slack integrations plus a 7-day trial. Pentests are billed separately from the seat subscription.
The custom-priced Enterprise plan adds VPC or on-premises deployment, custom model support, internal infrastructure testing, SSO and SCIM, and dedicated support. The open-source CLI has no license fee, but users still provide model and infrastructure resources.
When to Use Strix
Strix suits developers and security teams who want exploit-validated testing wired into the workflow, not a separate scanning step. Diff scoping makes it practical to run on every pull request.
Because it needs an LLM API key, the running cost scales with model usage. For signature-based scanning without that dependency, Nuclei and OWASP ZAP remain the open-source references.