Strix

Strix is an open-source AI penetration-testing tool built around autonomous agents that behave like real ethical hackers. Instead of relying on static analysis that produces long lists of false positives, Strix runs your code and applications dynamically, finds vulnerabilities, and validates them by generating actual working proofs-of-concept. It is aimed at developers and security teams who want fast, accurate security testing without the cost and delay of manual pentesting engagements. The agents ship with a full offensive-security toolkit out of the box, including an HTTP interception proxy (built on Caido), an automated browser for testing XSS, CSRF, clickjacking, and auth-bypass flows, an interactive shell for exploit development, a Python sandbox for custom proof-of-concept exploits, reconnaissance and OSINT for attack-surface mapping, and combined static and dynamic code analysis (SAST plus DAST). Strix detects a wide range of issues across the OWASP Top 10 and beyond, from broken access control and injection to SSRF, insecure deserialization, business-logic flaws, and cloud misconfigurations. A key strength is its Graph of Agents multi-agent orchestration, where specialized AI pentesters for recon, exploitation, and post-exploitation collaborate and chain vulnerabilities like a red team. Builders and business users can run it from a developer-first CLI, use headless mode for CI/CD, or add it to GitHub Actions to block insecure code before production. It works with LLM providers including OpenAI, Anthropic, and Google, and can auto-generate remediation patches and compliance-ready pentest reports. A hosted Strix Platform and enterprise tier add continuous pentesting, one-click autofix PRs, SSO, and self-hosted deployment options. Use only on systems you own or are authorized to test.