249 lines
8.9 KiB
Markdown
249 lines
8.9 KiB
Markdown
<p align="center">
|
||
<a href="https://strix.ai/">
|
||
<img src="https://github.com/usestrix/.github/raw/main/imgs/cover.png" alt="Strix Banner" width="100%">
|
||
</a>
|
||
</p>
|
||
|
||
<div align="center">
|
||
|
||
# Strix
|
||
|
||
### Open-source AI hackers to find and fix your app’s vulnerabilities.
|
||
|
||
<br/>
|
||
|
||
|
||
<a href="https://docs.strix.ai"><img src="https://img.shields.io/badge/Docs-docs.strix.ai-2b9246?style=for-the-badge&logo=gitbook&logoColor=white" alt="Docs"></a>
|
||
<a href="https://strix.ai"><img src="https://img.shields.io/badge/Website-strix.ai-f0f0f0?style=for-the-badge&logoColor=000000" alt="Website"></a>
|
||
[](https://discord.gg/strix-ai)
|
||
|
||
<a href="https://deepwiki.com/usestrix/strix"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a>
|
||
<a href="https://github.com/usestrix/strix"><img src="https://img.shields.io/github/stars/usestrix/strix?style=flat-square" alt="GitHub Stars"></a>
|
||
<a href="LICENSE"><img src="https://img.shields.io/badge/License-Apache%202.0-3b82f6?style=flat-square" alt="License"></a>
|
||
<a href="https://pypi.org/project/strix-agent/"><img src="https://img.shields.io/pypi/v/strix-agent?style=flat-square" alt="PyPI Version"></a>
|
||
|
||
|
||
<a href="https://discord.gg/strix-ai"><img src="https://github.com/usestrix/.github/raw/main/imgs/Discord.png" height="40" alt="Join Discord"></a>
|
||
<a href="https://x.com/strix_ai"><img src="https://github.com/usestrix/.github/raw/main/imgs/X.png" height="40" alt="Follow on X"></a>
|
||
|
||
|
||
<a href="https://trendshift.io/repositories/15362" target="_blank"><img src="https://trendshift.io/api/badge/repositories/15362" alt="usestrix/strix | Trendshift" width="250" height="55"/></a>
|
||
|
||
</div>
|
||
|
||
|
||
> [!TIP]
|
||
> **New!** Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches production!
|
||
|
||
---
|
||
|
||
|
||
## Strix Overview
|
||
|
||
Strix are autonomous AI agents that act just like real hackers - they run your code dynamically, find vulnerabilities, and validate them through actual proof-of-concepts. Built for developers and security teams who need fast, accurate security testing without the overhead of manual pentesting or the false positives of static analysis tools.
|
||
|
||
**Key Capabilities:**
|
||
|
||
- **Full hacker toolkit** out of the box
|
||
- **Teams of agents** that collaborate and scale
|
||
- **Real validation** with PoCs, not false positives
|
||
- **Developer‑first** CLI with actionable reports
|
||
- **Auto‑fix & reporting** to accelerate remediation
|
||
|
||
|
||
<br>
|
||
|
||
|
||
<div align="center">
|
||
<a href="https://strix.ai">
|
||
<img src=".github/screenshot.png" alt="Strix Demo" width="1000" style="border-radius: 16px;">
|
||
</a>
|
||
</div>
|
||
|
||
|
||
## Use Cases
|
||
|
||
- **Application Security Testing** - Detect and validate critical vulnerabilities in your applications
|
||
- **Rapid Penetration Testing** - Get penetration tests done in hours, not weeks, with compliance reports
|
||
- **Bug Bounty Automation** - Automate bug bounty research and generate PoCs for faster reporting
|
||
- **CI/CD Integration** - Run tests in CI/CD to block vulnerabilities before reaching production
|
||
|
||
## 🚀 Quick Start
|
||
|
||
**Prerequisites:**
|
||
- Docker (running)
|
||
- An LLM provider key (e.g. [get OpenAI API key](https://platform.openai.com/api-keys) or use a local LLM)
|
||
|
||
### Installation & First Scan
|
||
|
||
```bash
|
||
# Install Strix
|
||
curl -sSL https://strix.ai/install | bash
|
||
|
||
# Or via pipx
|
||
pipx install strix-agent
|
||
|
||
# Configure your AI provider
|
||
export STRIX_LLM="openai/gpt-5"
|
||
export LLM_API_KEY="your-api-key"
|
||
|
||
# Run your first security assessment
|
||
strix --target ./app-directory
|
||
```
|
||
|
||
> [!NOTE]
|
||
> First run automatically pulls the sandbox Docker image. Results are saved to `strix_runs/<run-name>`
|
||
|
||
---
|
||
|
||
## ✨ Features
|
||
|
||
### Agentic Security Tools
|
||
|
||
Strix agents come equipped with a comprehensive security testing toolkit:
|
||
|
||
- **Full HTTP Proxy** - Full request/response manipulation and analysis
|
||
- **Browser Automation** - Multi-tab browser for testing of XSS, CSRF, auth flows
|
||
- **Terminal Environments** - Interactive shells for command execution and testing
|
||
- **Python Runtime** - Custom exploit development and validation
|
||
- **Reconnaissance** - Automated OSINT and attack surface mapping
|
||
- **Code Analysis** - Static and dynamic analysis capabilities
|
||
- **Knowledge Management** - Structured findings and attack documentation
|
||
|
||
### Comprehensive Vulnerability Detection
|
||
|
||
Strix can identify and validate a wide range of security vulnerabilities:
|
||
|
||
- **Access Control** - IDOR, privilege escalation, auth bypass
|
||
- **Injection Attacks** - SQL, NoSQL, command injection
|
||
- **Server-Side** - SSRF, XXE, deserialization flaws
|
||
- **Client-Side** - XSS, prototype pollution, DOM vulnerabilities
|
||
- **Business Logic** - Race conditions, workflow manipulation
|
||
- **Authentication** - JWT vulnerabilities, session management
|
||
- **Infrastructure** - Misconfigurations, exposed services
|
||
|
||
### Graph of Agents
|
||
|
||
Advanced multi-agent orchestration for comprehensive security testing:
|
||
|
||
- **Distributed Workflows** - Specialized agents for different attacks and assets
|
||
- **Scalable Testing** - Parallel execution for fast comprehensive coverage
|
||
- **Dynamic Coordination** - Agents collaborate and share discoveries
|
||
|
||
---
|
||
|
||
## Usage Examples
|
||
|
||
### Basic Usage
|
||
|
||
```bash
|
||
# Scan a local codebase
|
||
strix --target ./app-directory
|
||
|
||
# Security review of a GitHub repository
|
||
strix --target https://github.com/org/repo
|
||
|
||
# Black-box web application assessment
|
||
strix --target https://your-app.com
|
||
```
|
||
|
||
### Advanced Testing Scenarios
|
||
|
||
```bash
|
||
# Grey-box authenticated testing
|
||
strix --target https://your-app.com --instruction "Perform authenticated testing using credentials: user:pass"
|
||
|
||
# Multi-target testing (source code + deployed app)
|
||
strix -t https://github.com/org/app -t https://your-app.com
|
||
|
||
# Focused testing with custom instructions
|
||
strix --target api.your-app.com --instruction "Focus on business logic flaws and IDOR vulnerabilities"
|
||
|
||
# Provide detailed instructions through file (e.g., rules of engagement, scope, exclusions)
|
||
strix --target api.your-app.com --instruction-file ./instruction.md
|
||
```
|
||
|
||
### Headless Mode
|
||
|
||
Run Strix programmatically without interactive UI using the `-n/--non-interactive` flag—perfect for servers and automated jobs. The CLI prints real-time vulnerability findings, and the final report before exiting. Exits with non-zero code when vulnerabilities are found.
|
||
|
||
```bash
|
||
strix -n --target https://your-app.com
|
||
```
|
||
|
||
### CI/CD (GitHub Actions)
|
||
|
||
Strix can be added to your pipeline to run a security test on pull requests with a lightweight GitHub Actions workflow:
|
||
|
||
```yaml
|
||
name: strix-penetration-test
|
||
|
||
on:
|
||
pull_request:
|
||
|
||
jobs:
|
||
security-scan:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v6
|
||
|
||
- name: Install Strix
|
||
run: curl -sSL https://strix.ai/install | bash
|
||
|
||
- name: Run Strix
|
||
env:
|
||
STRIX_LLM: ${{ secrets.STRIX_LLM }}
|
||
LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
|
||
|
||
run: strix -n -t ./ --scan-mode quick
|
||
```
|
||
|
||
### Configuration
|
||
|
||
```bash
|
||
export STRIX_LLM="openai/gpt-5"
|
||
export LLM_API_KEY="your-api-key"
|
||
|
||
# Optional
|
||
export LLM_API_BASE="your-api-base-url" # if using a local model, e.g. Ollama, LMStudio
|
||
export PERPLEXITY_API_KEY="your-api-key" # for search capabilities
|
||
export STRIX_REASONING_EFFORT="high" # control thinking effort (default: high, quick scan: medium)
|
||
```
|
||
|
||
> [!NOTE]
|
||
> Strix automatically saves your configuration to `~/.strix/cli-config.json`, so you don't have to re-enter it on every run.
|
||
|
||
**Recommended models for best results:**
|
||
|
||
- [OpenAI GPT-5](https://openai.com/api/) — `openai/gpt-5`
|
||
- [Anthropic Claude Sonnet 4.5](https://claude.com/platform/api) — `anthropic/claude-sonnet-4-5`
|
||
- [Google Gemini 3 Pro Preview](https://cloud.google.com/vertex-ai) — `vertex_ai/gemini-3-pro-preview`
|
||
|
||
See the [LLM Providers documentation](https://docs.strix.ai/llm-providers/overview) for all supported providers including Vertex AI, Bedrock, Azure, and local models.
|
||
|
||
## Documentation
|
||
|
||
Full documentation is available at **[docs.strix.ai](https://docs.strix.ai)** — including detailed guides for usage, CI/CD integrations, skills, and advanced configuration.
|
||
|
||
## Contributing
|
||
|
||
We welcome contributions of code, docs, and new skills - check out our [Contributing Guide](https://docs.strix.ai/contributing) to get started or open a [pull request](https://github.com/usestrix/strix/pulls)/[issue](https://github.com/usestrix/strix/issues).
|
||
|
||
## Join Our Community
|
||
|
||
Have questions? Found a bug? Want to contribute? **[Join our Discord!](https://discord.gg/strix-ai)**
|
||
|
||
## Support the Project
|
||
|
||
**Love Strix?** Give us a ⭐ on GitHub!
|
||
|
||
## Acknowledgements
|
||
|
||
Strix builds on the incredible work of open-source projects like [LiteLLM](https://github.com/BerriAI/litellm), [Caido](https://github.com/caido/caido), [Nuclei](https://github.com/projectdiscovery/nuclei), [Playwright](https://github.com/microsoft/playwright), and [Textual](https://github.com/Textualize/textual). Huge thanks to their maintainers!
|
||
|
||
|
||
> [!WARNING]
|
||
> Only test apps you own or have permission to test. You are responsible for using Strix ethically and legally.
|
||
|
||
</div>
|