usestrix/strix

Strix is an open-source security testing tool that uses AI agents to act like a real hacker, probing your application for vulnerabilities and confirming them with actual working proof-of-concept exploits (not just theoretical warnings). Most security tools either flag too many false alarms (static analysis that says something might be risky) or require expensive manual work (hiring a human penetration tester). Strix sits in between: automated, but actually verifying that vulnerabilities are real before reporting them. You point it at a local codebase, a GitHub repo, or a live web URL, and a team of AI agents goes to work. They can browse your app in a real browser, manipulate HTTP requests (the messages sent between browser and server), run commands in a terminal, write and execute custom exploit code, and document findings. They cover common vulnerability categories like SQL injection (tricking a database with malicious input), access control flaws (reaching data you shouldn't), XSS (cross-site scripting, injecting code into web pages), SSRF (making your server call internal systems it shouldn't), and more. It integrates with CI/CD pipelines (automated build and deploy systems) so you can scan every pull request automatically and block insecure code before it ships. A managed cloud platform at app.strix.ai offers one-click auto-fix as ready-to-merge pull requests. You'd reach for Strix when preparing for a product launch, running a bug bounty program, or wanting continuous security coverage without a dedicated security team. Requires Docker and an LLM API key. Written in Python.