xalgorix/xalgorix

Xalgorix – Open‑source AI‑driven penetration‑testing platform

What it is – Xalgorix is a self‑hosted tool that uses a large language model (LLM) as an autonomous security‑testing agent. The agent runs a full 22‑phase pentest methodology, then a separate verifier re‑exploits every candidate finding so the results are proved rather than just flagged.

Why it matters – Traditional scanners (Nuclei, OWASP ZAP, commercial DAST) can only detect known patterns. Xalgorix adds reasoning‑heavy discovery and an exploit‑verification step, dramatically reducing false‑positives and giving you concrete proof‑of‑concept evidence.

---

Core components

Component	Role
LLM‑driven agent	Drives reconnaissance, auth‑flow handling, vulnerability discovery, and chaining of exploits. Supports any OpenAI‑compatible provider (OpenAI, Anthropic, Gemini, Groq, Ollama, etc.).
Independent verifier	Re‑runs each finding with a fresh LLM call to confirm that the exploit works before the finding is reported.
Web dashboard	Local UI (http://127.0.0.1:9137) for scan launch, live telemetry, finding management, and PDF report generation.
Toolset	Pre‑installed offensive‑security binaries (nmap, nuclei, httpx, subfinder, ffuf, sqlmap, masscan, …) plus full package‑manager access (apt, go, pipx, npm, cargo) for on‑the‑fly installation.
API / service mode	Machine‑to‑machine token authentication for CI/CD or custom integrations.
Integrations	Optional Discord/Telegram alerts, AgentMail for email‑based OTP flows, and Caido proxy support.

How you use it

1. Install – one‑line script, Go install, Docker image, or build from source.
2. Configure – run xalgorix --setup to pick an LLM provider, enter the API key, and set optional proxy settings.
3. Launch – start the dashboard (xalgorix --web) or run headless scans via the CLI / API.
4. Watch – live WebSocket telemetry shows tool calls, LLM messages, and HTTP activity.
5. Verify – the built‑in verifier automatically re‑exploits each candidate finding.
6. Report – generate a branded PDF with CVSS scores, PoC screenshots, and remediation guidance.

Notable features

• Exploit‑verified findings – a separate verifier confirms each vulnerability before it appears in the report.
• Bring‑your‑own‑LLM – use any compatible model; you control cost, reasoning depth, and rate limits.
• Self‑hosted & private – all data, keys, and scan results stay on your infrastructure; no cloud‑only SaaS lock‑in.
• Extensive toolchain – dozens of pentesting utilities are bundled and can auto‑install missing dependencies at runtime.
• Multiple scan modes – single‑target, wildcard, multi‑target, and “scan your code” (no external host needed) workflows.
• Automation friendly – API token auth, GitHub App for PR security reviews, and a GitHub Action for CI pipelines.
• Safety controls – runs privileged only inside a disposable container; dashboard is bound to localhost by default; explicit auth required for external access.

Typical use cases

Scenario	How Xalgorix helps
Pen‑testing a web app	Runs a full methodology, handles auth flows, finds IDOR/BOLA, race conditions, and provides exploit‑verified proof.
Bug‑bounty program	Quickly enumerate the attack surface and surface verified CVSS‑scored findings with PoC.
Red‑team reconnaissance	Wildcard/multi‑target scans map external assets, then deep‑dive DAST with browser automation.
CI/CD security gate	GitHub App comments on PRs with automated security review; CI action can block merges on verified findings.
Continuous monitoring	Run as a system service, schedule scans, and push alerts to Discord/Telegram.

Getting started quickly

# one‑line install (Linux/macOS)
curl -sSL https://www.xalgorix.com/install | bash

# run the interactive setup wizard
xalgorix --setup

# start the dashboard (default http://127.0.0.1:9137)
xalgorix --web

Or use the Docker image:

docker run --rm -p 9137:9137 \
  --privileged -v xalgorix-data:/data \
  xalgord/xalgorix:latest

License & community

• License: Apache 2.0 (permissive, commercial‑friendly).
• Stars / forks: visible on GitHub badge.
• Sponsors: Swiftproxy provides residential proxy discounts for regional testing.
• Hosted SaaS option: www.xalgorix.com offers a managed version with built‑in LLM keys and OOB services.

---

Bottom line: Xalgorix is a genuine open‑source project that combines LLM reasoning with a full offensive‑security toolchain to deliver proved vulnerability findings. It is suitable for security teams that need an autonomous, self‑hosted pentesting engine while retaining full control over data and LLM costs.