Merge origin/main into better-whitebox

2026-03-19 19:36:17 -06:00
parent f65a97f6b2 86341597c1
commit b67712beec
66 changed files with 4712 additions and 336 deletions
--- a/docs/advanced/configuration.mdx
+++ b/docs/advanced/configuration.mdx
@@ -8,7 +8,7 @@ Configure Strix using environment variables or a config file.
 ## LLM Configuration

 <ParamField path="STRIX_LLM" type="string" required>
-  Model name in LiteLLM format (e.g., `openai/gpt-5`, `anthropic/claude-sonnet-4-5`).
+  Model name in LiteLLM format (e.g., `openai/gpt-5`, `anthropic/claude-sonnet-4-6`).
 </ParamField>

 <ParamField path="LLM_API_KEY" type="string">
@@ -46,9 +46,37 @@ Configure Strix using environment variables or a config file.
 </ParamField>

 <ParamField path="STRIX_TELEMETRY" default="1" type="string">
-  Enable/disable anonymous telemetry. Set to `0`, `false`, `no`, or `off` to disable.
+  Global telemetry default toggle. Set to `0`, `false`, `no`, or `off` to disable both PostHog and OTEL unless overridden by per-channel flags below.
 </ParamField>

+<ParamField path="STRIX_OTEL_TELEMETRY" type="string">
+  Enable/disable OpenTelemetry run observability independently. When unset, falls back to `STRIX_TELEMETRY`.
+</ParamField>
+
+<ParamField path="STRIX_POSTHOG_TELEMETRY" type="string">
+  Enable/disable PostHog product telemetry independently. When unset, falls back to `STRIX_TELEMETRY`.
+</ParamField>
+
+<ParamField path="TRACELOOP_BASE_URL" type="string">
+  OTLP/Traceloop base URL for remote OpenTelemetry export. If unset, Strix keeps traces local only.
+</ParamField>
+
+<ParamField path="TRACELOOP_API_KEY" type="string">
+  API key used for remote trace export. Remote export is enabled only when both `TRACELOOP_BASE_URL` and `TRACELOOP_API_KEY` are set.
+</ParamField>
+
+<ParamField path="TRACELOOP_HEADERS" type="string">
+  Optional custom OTEL headers (JSON object or `key=value,key2=value2`). Useful for Langfuse or custom/self-hosted OTLP gateways.
+</ParamField>
+
+When remote OTEL vars are not set, Strix still writes complete run telemetry locally to:
+
+```bash
+strix_runs/<run_name>/events.jsonl
+```
+
+When remote vars are set, Strix dual-writes telemetry to both local JSONL and the remote OTEL endpoint.
+
 ## Docker Configuration

 <ParamField path="STRIX_IMAGE" default="ghcr.io/usestrix/strix-sandbox:0.1.12" type="string">
@@ -106,4 +134,5 @@ export PERPLEXITY_API_KEY="pplx-..."
 # Optional: Custom timeouts
 export LLM_TIMEOUT="600"
 export STRIX_SANDBOX_EXECUTION_TIMEOUT="300"
+
 ```
--- a/docs/advanced/skills.mdx
+++ b/docs/advanced/skills.mdx
@@ -81,6 +81,21 @@ Protocol-specific testing techniques.
 | --------- | ------------------------------------------------ |
 | `graphql` | GraphQL introspection, batching, resolver issues |

+### Tooling
+
+Sandbox CLI playbooks for core recon and scanning tools.
+
+| Skill       | Coverage                                                |
+| ----------- | ------------------------------------------------------- |
+| `nmap`      | Port/service scan syntax and high-signal scan patterns  |
+| `nuclei`    | Template selection, severity filtering, and rate tuning |
+| `httpx`     | HTTP probing and fingerprint output patterns            |
+| `ffuf`      | Wordlist fuzzing, matcher/filter strategy, recursion    |
+| `subfinder` | Passive subdomain enumeration and source control        |
+| `naabu`     | Fast port scanning with explicit rate/verify controls   |
+| `katana`    | Crawl depth/JS/known-files behavior and pitfalls        |
+| `sqlmap`    | SQLi workflow for enumeration and controlled extraction  |
+
 ## Skill Structure

 Each skill is a Markdown file with YAML frontmatter for metadata:
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -32,6 +32,7 @@
            "group": "LLM Providers",
            "pages": [
              "llm-providers/overview",
+              "llm-providers/models",
              "llm-providers/openai",
              "llm-providers/anthropic",
              "llm-providers/openrouter",
--- a/docs/llm-providers/anthropic.mdx
+++ b/docs/llm-providers/anthropic.mdx
@@ -6,7 +6,7 @@ description: "Configure Strix with Claude models"
 ## Setup

 ```bash
-export STRIX_LLM="anthropic/claude-sonnet-4-5"
+export STRIX_LLM="openai/gpt-5"
 export LLM_API_KEY="sk-ant-..."
 ```

@@ -14,8 +14,8 @@ export LLM_API_KEY="sk-ant-..."

 | Model | Description |
 |-------|-------------|
-| `anthropic/claude-sonnet-4-5` | Best balance of intelligence and speed (recommended) |
-| `anthropic/claude-opus-4-5` | Maximum capability for deep analysis |
+| `anthropic/claude-sonnet-4-6` | Best balance of intelligence and speed |
+| `anthropic/claude-opus-4-6` | Maximum capability for deep analysis |

 ## Get API Key

--- a/docs/llm-providers/models.mdx
+++ b/docs/llm-providers/models.mdx
@@ -0,0 +1,75 @@
+---
+title: "Strix Router"
+description: "Access top LLMs through a single API with high rate limits and zero data retention"
+---
+
+Strix Router gives you access to the best LLMs through a single API key.
+
+<Note>
+Strix Router is currently in **beta**. It's completely optional — Strix works with any [LiteLLM-compatible provider](/llm-providers/overview) using your own API keys, or with [local models](/llm-providers/local). Strix Router is just the setup we test and optimize for.
+</Note>
+
+## Why Use Strix Router?
+
+- **High rate limits** — No throttling during long-running scans
+- **Zero data retention** — Routes to providers with zero data retention policies enabled
+- **Failover & load balancing** — Automatic fallback across providers for reliability
+- **Simple setup** — One API key, one environment variable, no provider accounts needed
+- **No markup** — Same token pricing as the underlying providers, no extra fees
+
+## Quick Start
+
+1. Get your API key at [models.strix.ai](https://models.strix.ai)
+2. Set your environment:
+
+```bash
+export LLM_API_KEY='your-strix-api-key'
+export STRIX_LLM='strix/gpt-5'
+```
+
+3. Run a scan:
+
+```bash
+strix --target ./your-app
+```
+
+## Available Models
+
+### Anthropic
+
+| Model | ID |
+|-------|-----|
+| Claude Sonnet 4.6 | `strix/claude-sonnet-4.6` |
+| Claude Opus 4.6 | `strix/claude-opus-4.6` |
+
+### OpenAI
+
+| Model | ID |
+|-------|-----|
+| GPT-5.2 | `strix/gpt-5.2` |
+| GPT-5.1 | `strix/gpt-5.1` |
+| GPT-5 | `strix/gpt-5` |
+
+### Google
+
+| Model | ID |
+|-------|-----|
+| Gemini 3 Pro | `strix/gemini-3-pro-preview` |
+| Gemini 3 Flash | `strix/gemini-3-flash-preview` |
+
+### Other
+
+| Model | ID |
+|-------|-----|
+| GLM-5 | `strix/glm-5` |
+| GLM-4.7 | `strix/glm-4.7` |
+
+## Configuration Reference
+
+<ParamField path="LLM_API_KEY" type="string" required>
+  Your Strix API key from [models.strix.ai](https://models.strix.ai).
+</ParamField>
+
+<ParamField path="STRIX_LLM" type="string" required>
+  Model ID from the tables above. Must be prefixed with `strix/`.
+</ParamField>
--- a/docs/llm-providers/openrouter.mdx
+++ b/docs/llm-providers/openrouter.mdx
@@ -19,7 +19,7 @@ Access any model on OpenRouter using the format `openrouter/<provider>/<model>`:
 | Model | Configuration |
 |-------|---------------|
 | GPT-5 | `openrouter/openai/gpt-5` |
-| Claude 4.5 Sonnet | `openrouter/anthropic/claude-sonnet-4.5` |
+| Claude Sonnet 4.6 | `openrouter/anthropic/claude-sonnet-4.6` |
 | Gemini 3 Pro | `openrouter/google/gemini-3-pro-preview` |
 | GLM-4.7 | `openrouter/z-ai/glm-4.7` |

--- a/docs/llm-providers/overview.mdx
+++ b/docs/llm-providers/overview.mdx
@@ -5,31 +5,54 @@ description: "Configure your AI model for Strix"

 Strix uses [LiteLLM](https://docs.litellm.ai/docs/providers) for model compatibility, supporting 100+ LLM providers.

-## Recommended Models
+## Strix Router (Recommended)

-For best results, use one of these models:
+The fastest way to get started. [Strix Router](/llm-providers/models) gives you access to tested models with the highest rate limits and zero data retention.
+
+```bash
+export STRIX_LLM="strix/gpt-5"
+export LLM_API_KEY="your-strix-api-key"
+```
+
+Get your API key at [models.strix.ai](https://models.strix.ai).
+
+## Bring Your Own Key
+
+You can also use any LiteLLM-compatible provider with your own API keys:

 | Model             | Provider      | Configuration                    |
 | ----------------- | ------------- | -------------------------------- |
 | GPT-5             | OpenAI        | `openai/gpt-5`                   |
-| Claude 4.5 Sonnet | Anthropic     | `anthropic/claude-sonnet-4-5`    |
+| Claude Sonnet 4.6 | Anthropic     | `anthropic/claude-sonnet-4-6`    |
 | Gemini 3 Pro      | Google Vertex | `vertex_ai/gemini-3-pro-preview` |

-## Quick Setup
-
 ```bash
 export STRIX_LLM="openai/gpt-5"
 export LLM_API_KEY="your-api-key"
 ```

+## Local Models
+
+Run models locally with [Ollama](https://ollama.com), [LM Studio](https://lmstudio.ai), or any OpenAI-compatible server:
+
+```bash
+export STRIX_LLM="ollama/llama4"
+export LLM_API_BASE="http://localhost:11434"
+```
+
+See the [Local Models guide](/llm-providers/local) for setup instructions and recommended models.
+
 ## Provider Guides

 <CardGroup cols={2}>
+  <Card title="Strix Router" href="/llm-providers/models">
+    Recommended models router with high rate limits.
+  </Card>
  <Card title="OpenAI" href="/llm-providers/openai">
-    GPT-5 and Codex models.
+    GPT-5 models.
  </Card>
  <Card title="Anthropic" href="/llm-providers/anthropic">
-    Claude 4.5 Sonnet, Opus, and Haiku.
+    Claude Opus, Sonnet, and Haiku.
  </Card>
  <Card title="OpenRouter" href="/llm-providers/openrouter">
    Access 100+ models through a single API.
@@ -38,7 +61,7 @@ export LLM_API_KEY="your-api-key"
    Gemini 3 models via Google Cloud.
  </Card>
  <Card title="AWS Bedrock" href="/llm-providers/bedrock">
-    Claude 4.5 and Titan models via AWS.
+    Claude and Titan models via AWS.
  </Card>
  <Card title="Azure OpenAI" href="/llm-providers/azure">
    GPT-5 via Azure.
@@ -54,7 +77,7 @@ Use LiteLLM's `provider/model-name` format:

 ```
 openai/gpt-5
-anthropic/claude-sonnet-4-5
+anthropic/claude-sonnet-4-6
 vertex_ai/gemini-3-pro-preview
 bedrock/anthropic.claude-4-5-sonnet-20251022-v1:0
 ollama/llama4
--- a/docs/llm-providers/vertex.mdx
+++ b/docs/llm-providers/vertex.mdx
@@ -44,7 +44,7 @@ export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"

 ```bash
 export VERTEXAI_PROJECT="your-project-id"
-export VERTEXAI_LOCATION="us-central1"
+export VERTEXAI_LOCATION="global"
 ```

 ## Prerequisites
--- a/docs/quickstart.mdx
+++ b/docs/quickstart.mdx
@@ -6,7 +6,7 @@ description: "Install Strix and run your first security scan"
 ## Prerequisites

 - Docker (running)
- An LLM provider API key (OpenAI, Anthropic, or local model)
+- An LLM API key — use [Strix Router](/llm-providers/models) for the easiest setup, or bring your own key from any [supported provider](/llm-providers/overview)

 ## Installation

@@ -27,13 +27,23 @@ description: "Install Strix and run your first security scan"

 Set your LLM provider:

-```bash
-export STRIX_LLM="openai/gpt-5"
-export LLM_API_KEY="your-api-key"
-```
+<Tabs>
+  <Tab title="Strix Router">
+    ```bash
+    export STRIX_LLM="strix/gpt-5"
+    export LLM_API_KEY="your-strix-api-key"
+    ```
+  </Tab>
+  <Tab title="Bring Your Own Key">
+    ```bash
+    export STRIX_LLM="openai/gpt-5"
+    export LLM_API_KEY="your-api-key"
+    ```
+  </Tab>
+</Tabs>

 <Tip>
-For best results, use `openai/gpt-5`, `anthropic/claude-sonnet-4-5`, or `vertex_ai/gemini-3-pro-preview`.
+For best results, use `strix/gpt-5`, `strix/claude-opus-4.6`, or `strix/gpt-5.2`.
 </Tip>

 ## Run Your First Scan
--- a/docs/tools/proxy.mdx
+++ b/docs/tools/proxy.mdx
@@ -80,6 +80,27 @@ for req in user_requests.get('requests', []):
            print(f"Potential IDOR: {test_id} returned 200")
 ```

+## Human-in-the-Loop
+
+Strix exposes the Caido proxy to your host machine, so you can interact with it alongside the automated scan. When the sandbox starts, the Caido URL is displayed in the TUI sidebar — click it to copy, then open it in Caido Desktop.
+
+### Accessing Caido
+
+1. Start a scan as usual
+2. Look for the **Caido** URL in the sidebar stats panel (e.g. `localhost:52341`)
+3. Open the URL in Caido Desktop
+4. Click **Continue as guest** to access the instance
+
+### What You Can Do
+
+- **Inspect traffic** — Browse all HTTP/HTTPS requests the agent is making in real time
+- **Replay requests** — Take any captured request and resend it with your own modifications
+- **Intercept and modify** — Pause requests mid-flight, edit them, then forward
+- **Explore the sitemap** — See the full attack surface the agent has discovered
+- **Manual testing** — Use Caido's tools to test findings the agent reports, or explore areas it hasn't reached
+
+This turns Strix from a fully automated scanner into a collaborative tool — the agent handles the heavy lifting while you focus on the interesting parts.
+
 ## Scope

 Create scopes to filter traffic to relevant domains: