usestrix/strix

What it solves

Strix is an autonomous AI penetration testing tool designed to find and fix security vulnerabilities in applications. It replaces manual pentesting and static analysis tools by dynamically running code to identify real vulnerabilities and validating them with working proofs-of-concept (PoCs), reducing false positives.

How it works

Strix uses a team of collaborative AI agents that orchestrate reconnaissance, exploitation, and validation. It operates in a Docker sandbox and can be pointed at local codebases, GitHub repositories, or live web applications. The agents use a full offensive security toolkit—including an HTTP interception proxy (Caido), a browser for client-side attacks, and a Python sandbox for exploit development—to simulate real-world hacker behavior.

Who it’s for

It is built for developers and security teams who need fast, accurate security testing, bug bounty researchers looking to automate PoC generation, and DevSecOps teams integrating security scans into CI/CD pipelines.

Highlights

• Multi-Agent Orchestration: Uses specialized agents for recon, exploitation, and post-exploitation that share discoveries and chain vulnerabilities.
• Real Exploit Validation: Generates working PoCs rather than just flagging potential issues.
• Comprehensive Coverage: Tests for OWASP Top 10 vulnerabilities, including injection, broken access control, and business logic flaws.
• CI/CD Integration: Seamlessly integrates with GitHub Actions to block insecure code before production.
• Auto-Fix Capabilities: Provides AI-generated security patches as ready-to-merge pull requests.
• Extensible: Supports Model Context Protocol (MCP) servers to add custom tools to the agent's toolkit.