Strix

About

Run a real pentest on your own app from the terminal or CI

Point Strix at a local folder, a GitHub repo, a live URL or an OpenAPI spec and it spins up a sandbox with a browser, an HTTP proxy, a terminal and a Python runtime. Several agents split the work: recon, exploitation and validation, so you get confirmed issues (IDOR, injection, auth bypass, SSRF and more) instead of a long list of scanner guesses. Each run saves its report under strix_runs/. You bring your own model key (OpenRouter, Anthropic, OpenAI and others) or sign in to Strix Cloud and skip Docker. It also runs in GitHub Actions to scan pull requests, can call your own MCP servers during a run, and ships nine agent skills (npx skills add usestrix/strix) so Claude Code, Cursor or Codex can start pentests and fix findings. Only test systems you own or have permission to test.

Features

• Multi-agent recon, exploitation and validation
• Findings confirmed with real proofs of concept
• Targets: code folders, repos, live URLs, OpenAPI and Postman
• GitHub Actions mode to block insecure pull requests
• Connect your own MCP servers to a run
• Nine agent skills for Claude Code, Cursor and Codex

Install