Strix
lastmod 2026-04-10created 2026-04-101 edits
Open-source AI hacker that finds and fixes vulnerabilities in your apps
About
- Open-source security testing tool that works as autonomous AI agents: like a real hacker, it runs code directly, finds vulnerabilities, and then validates them with an actual PoC (proof of concept)
- Supports CI/CD pipeline and GitHub Actions integration, running security scans automatically on every PR and blocking vulnerable code before it is deployed to production
- Detectable vulnerability types span many categories, including IDOR, privilege escalation, SQL injection, SSRF, XSS, JWT vulnerabilities, and infrastructure misconfiguration
- Graph of Agents architecture in which multiple agents cooperate, performing comprehensive testing through distributed workflows, parallel execution, and dynamic collaboration
- Ships with tools equivalent to a real hacker's toolkit, such as a Full HTTP Proxy, browser automation, terminal environment, Python runtime, OSINT reconnaissance, and code analysis
- Supports various target types, such as a local codebase (
./app-directory), a GitHub repository URL, or a deployed web app URL - Headless (
-n) mode allows non-interactive runs on servers and in automation environments; when vulnerabilities are found, it exits with a non-zero exit code to block the pipeline - Recommended LLMs: OpenAI GPT-5.4, Anthropic Claude Sonnet 4.6, Google Gemini 3 Pro Preview, etc.; all major providers are supported
- The cloud platform (app.strix.ai) additionally provides one-click auto-fix (as a PR), continuous monitoring, and integration with GitHub, Slack, Jira, and Linear
- Apache-2.0 license / Python
See also
- AI Agent
- Security testing
- Vulnerability scanner
- CI/CD
- GitHub Actions
- SQL Injection
- XSS
- SSRF
- Python
- LLM