{ "$schema": "https://readbeforerun.ai/schema/entry.schema.json", "entry": { "id": "usestrix-strix", "name": "Strix", "summary": "Autonomous AI penetration-testing agents that run offensive tools in a container sandbox and validate findings with a proof of concept.", "draft": "review", "type": "agent", "mission": [ "offensive" ], "task": [ "web-api-testing" ], "domain": [ "application-security" ], "runtime": [ "standalone" ], "tier": "listed", "last_checked": "2026-10-19", "next_check": "2027-01-17", "freshness": "fresh", "superseded": false, "in_my_kit": null, "advice": null, "code_shows": "can tunnel or exfiltrate · uses sudo or the docker socket · adds autostart, users or keys · writes outside the project · reads broad tokens or the environment · has broad pre-approvals", "source": { "repo": "https://github.com/usestrix/strix", "subpath": null, "commit": "55bc07991aacb1c26a81b43e7ca53148730d2019", "version": "v1.7.0", "license": "Apache-2.0" }, "install": { "skills_cli": null, "claude_code": null, "upstream": "curl -sSL https://strix.ai/install | bash\nexport STRIX_LLM=\"openrouter/z-ai/glm-5.3\"\nstrix --target ./app-directory", "bundled": false }, "scan": { "status": "static scan pending (not run)" }, "reach": { "method": "reach-v0.1", "level": 3, "level_source": "static", "level_label": "privileged", "unknown_axes": 0, "verdict": "not-run", "badge": "reach 3 · not run yet", "long": "reach 3 from code (privileged); lab: not run yet", "declared": { "fs": 2, "net": 2, "exec": 2, "cred": 1, "persist": 2, "hitl": 2 }, "static": { "level": 3, "fs": 2, "net": 3, "exec": 3, "cred": 2, "persist": 3, "hitl": 2, "unknown": [] }, "observed": null, "surplus": null, "fit": null, "exports": { "aivss": { "fs": 0.5, "net": 1, "exec": 1, "cred": 0.5, "persist": 1, "hitl": 0.5 }, "usf_risk_tier": "L3" } }, "profile": { "read_at": "55bc07991aacb1c26a81b43e7ca53148730d2019", "read_on": "2026-10-25", "overview": "Autonomous AI penetration-testing agents that run your code dynamically, find vulnerabilities and validate them through proofs of concept.", "purpose": [ "Security testing for developers and security teams as an alternative to manual pentesting and static-analysis scanners." ], "use_cases": [ { "text": "Detect and validate critical vulnerabilities in an application", "task": "web-api-testing" }, { "text": "Automate bug-bounty research and generate proof-of-concept exploits", "task": "finding-validation" }, { "text": "Run scans in CI/CD to block vulnerable code before it reaches production", "task": "code-review-sast" }, { "text": "Review source code white-box and exploit findings for a proof-of-concept", "task": "code-review-sast" } ], "maturity": "experimental", "capabilities": [ { "name": "shell (exec_command / write_stdin)", "effects": [ "reads", "changes", "runs-commands", "sends-data" ], "enabled": "default" }, { "name": "apply_patch", "effects": [ "changes" ], "enabled": "default" }, { "name": "HTTP Interception Proxy", "effects": [ "reads", "changes", "sends-data" ], "enabled": "default" }, { "name": "Browser Exploitation", "effects": [ "reads", "runs-commands", "sends-data" ], "enabled": "default" }, { "name": "web_search", "effects": [ "reads", "sends-data" ], "enabled": "optional" }, { "name": "Vulnerability Knowledge Base", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "Multi-agent orchestration", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "MCP connectors", "effects": [ "reads", "runs-commands", "sends-data" ], "enabled": "optional" }, { "name": "threat_model", "effects": [ "reads", "changes" ], "enabled": "default" } ], "effects": [ "reads", "changes", "runs-commands", "sends-data" ], "runs": "local-program", "listens": [ { "mode": "default", "bind": "all-interfaces", "sign_in": "unknown" }, { "mode": "optional", "bind": "configurable", "sign_in": "unknown" }, { "mode": "optional", "bind": "loopback", "sign_in": "unknown" }, { "mode": "default", "bind": "loopback", "sign_in": "unknown" } ], "sends_to": [ { "to": "LLM provider", "kind": "model-provider", "when": "always" }, { "to": "targets you name", "kind": "target", "when": "always" }, { "to": "PostHog", "kind": "telemetry", "when": "default" }, { "to": "Scarf", "kind": "telemetry", "when": "default" }, { "to": "Perplexity", "kind": "vendor-api", "when": "optional" }, { "to": "PyPI", "kind": "other", "when": "default" }, { "to": "Strix Cloud (app.strix.ai)", "kind": "vendor-api", "when": "optional" }, { "to": "ghcr.io", "kind": "download", "when": "default" }, { "to": "Strix Cloud (app.strix.ai)", "kind": "vendor-api", "when": "optional" } ], "model": "own-key", "needs": [ { "kind": "container", "text": "Docker installed and running to host the sandbox container." }, { "kind": "model-key", "text": "An LLM API key from a supported provider (OpenAI, Anthropic, Google, etc.)." }, { "kind": "authorization", "text": "Authorization to test the target systems." } ] }, "urls": { "page": "/catalog/usestrix-strix/", "json": "/entries/usestrix-strix.json", "md": "/catalog/usestrix-strix.md", "badge": "/badge/usestrix-strix.svg" } }, "data": { "schema_version": "0.5", "slug": "usestrix-strix", "name": "Strix", "summary": "Autonomous AI penetration-testing agents that run offensive tools in a container sandbox and validate findings with a proof of concept.", "draft": "review", "in_my_kit": null, "type": "agent", "mission": [ "offensive" ], "task": [ "web-api-testing" ], "domain": [ "application-security" ], "phase": [ "off:discovery" ], "role": [ "pentest" ], "runtime": [ "standalone" ], "auth": null, "autonomy": 3, "addresses": [], "frameworks": { "owasp_ast": [], "owasp_asi": [], "attack_tactic": [], "atlas": [] }, "source": { "repo": "https://github.com/usestrix/strix", "commit": "55bc07991aacb1c26a81b43e7ca53148730d2019", "version": "v1.7.0", "license": "Apache-2.0", "manifest": "pyproject.toml", "also_listed": {} }, "upstream": { "checked_at": "2026-10-19", "updated_at": "2026-10-18", "current_release": "v1.7.0", "archived": false, "stars": 69681, "commit_history": {}, "releases_since_pin": 0 }, "install": { "upstream": "curl -sSL https://strix.ai/install | bash\nexport STRIX_LLM=\"openrouter/z-ai/glm-5.3\"\nstrix --target ./app-directory", "upstream_evidence": "README.md#L84-91", "bundled": false }, "scan": [ { "tool": "cisco-skill-scanner", "version": "not-run", "llm_judge": false, "date": "2026-10-19", "result": "pending" } ], "privileges": { "method": "reach-v0.1", "declared": { "axes": { "fs": 2, "net": 2, "exec": 2, "cred": 1, "persist": 2, "hitl": 2 }, "evidence": { "fs": "skills/penetration-testing-with-strix/SKILL.md#L83 author states a local target path is mounted writable so agents may modify it", "net": "README.md#L374 author states Strix sends real traffic to whatever target the user points it at", "exec": "README.md#L149 author declares a shell and command-execution capability for the agent", "cred": "README.md#L78 author states one LLM provider API key is needed", "persist": "README.md#L295 author states Strix writes its configuration to the home directory", "hitl": "README.md#L244 author documents a headless mode that runs with no interactive approval" } }, "static": { "level": 3, "axes": { "fs": 2, "net": 3, "exec": 3, "cred": 2, "persist": 3, "hitl": 2 }, "evidence": { "fs": "skills/penetration-testing-with-strix/SKILL.md#L83 a user-chosen host directory is bind-mounted writable into the sandbox", "net": "containers/docker-entrypoint.sh#L41 the sandbox runs the Caido HTTP interception proxy as a listener on all interfaces, beyond contacting target URLs; strix/runtime/docker_client.py#L217-220 Docker publishes that port only on host interface 127.0.0.1", "exec": "containers/Dockerfile#L36 the agent user is given passwordless sudo inside the sandbox on top of a free shell", "cred": "strix/config/settings.py#L38-189 reads several provider API-key environment variables", "persist": "scripts/install.sh#L213-218 the installer appends a PATH export to the user's shell rc file, a persistence vector", "hitl": "skills/penetration-testing-with-strix/SKILL.md#L57 the skill instructs agents to always run the headless mode, which executes without per-step approval" }, "unknown": [] }, "min_config": { "status": "derived", "note": "derived from the code, not tested in the lab; run only against authorised targets, keep execution inside the Docker sandbox, and set STRIX_TELEMETRY=0 to turn off the default telemetry" }, "override": null, "reviews": [] }, "status": { "tier": "listed", "last_checked": "2026-10-19", "next_check": "2027-01-17", "freshness": "fresh", "superseded": false, "superseded_by": null, "added": "2026-10-19", "added_by": "scout" }, "evidence": { "runs": [], "badge": "/badge/usestrix-strix.svg" }, "changes": [] }, "profile": { "schema_version": "0.1", "entry": "usestrix-strix", "draft": "review", "commit": "55bc07991aacb1c26a81b43e7ca53148730d2019", "read_on": "2026-10-25", "check": { "date": "2026-10-25", "facts": 63, "confirmed": 63, "verified": 53 }, "overview": { "text": "Autonomous AI penetration-testing agents that run your code dynamically, find vulnerabilities and validate them through proofs of concept.", "ev": "README.md#L46 author's overview of what Strix is" }, "maturity": { "word": "experimental", "text": "The package metadata marks the project as alpha.", "ev": "pyproject.toml#L22 development status classifier" }, "purpose": [ { "text": "Security testing for developers and security teams as an alternative to manual pentesting and static-analysis scanners.", "ev": "README.md#L46 stated audience and purpose" } ], "use_cases": [ { "text": "Detect and validate critical vulnerabilities in an application", "task": "web-api-testing", "ev": "README.md#L69 use-cases list" }, { "text": "Automate bug-bounty research and generate proof-of-concept exploits", "task": "finding-validation", "ev": "README.md#L71 use-cases list" }, { "text": "Run scans in CI/CD to block vulnerable code before it reaches production", "task": "code-review-sast", "ev": "README.md#L72 use-cases list" }, { "text": "Review source code white-box and exploit findings for a proof-of-concept", "task": "code-review-sast", "ev": "skills/find-security-vulnerabilities-in-code/SKILL.md#L12 white-box review workflow" } ], "not_for": [ { "text": "Run it only against systems you own or have explicit, written permission to test, and stay within the agreed scope.", "ev": "README.md#L374 authorized-use warning" } ], "autonomy": { "text": "The agents act on their own: they run the code dynamically, find vulnerabilities and validate them through proofs of concept.", "ev": "README.md#L46 autonomous operation" }, "capabilities": { "coverage": "partial", "missing": "The managed cloud CLI (strix cloud) and the local web viewer (strix view) are separate product surfaces, not agent tools, and are not listed as capability groups.", "count": { "n": 9, "unit": "skills", "by": "author", "text": "The author states the repo publishes nine consumer skills for coding agents.", "ev": "README.md#L135 skills install count" }, "groups": [ { "name": "shell (exec_command / write_stdin)", "does": "Runs shell commands and programs in the sandbox (nmap, ffuf, python3, agent-browser) through exec_command and write_stdin.", "effects": [ "reads", "changes", "runs-commands", "sends-data" ], "enabled": "default", "ev": "strix/tools/shell/README.md#L2-4 exec_command runs every CLI invocation" }, { "name": "apply_patch", "does": "Edits files in the sandbox through apply_patch, the agent's only first-class file-editing tool.", "effects": [ "changes" ], "enabled": "default", "ev": "strix/tools/apply_patch/README.md#L2-3 only first-class file editing" }, { "name": "HTTP Interception Proxy", "does": "Manipulates and analyses HTTP requests and responses through the Caido interception proxy.", "effects": [ "reads", "changes", "sends-data" ], "enabled": "default", "ev": "README.md#L147 HTTP interception proxy" }, { "name": "Browser Exploitation", "does": "Runs an automated browser for testing XSS, CSRF, clickjacking and auth bypass flows.", "effects": [ "reads", "runs-commands", "sends-data" ], "enabled": "default", "ev": "README.md#L148 browser exploitation" }, { "name": "web_search", "does": "Runs real-time web searches through Exa or Perplexity (web_search).", "effects": [ "reads", "sends-data" ], "enabled": "optional", "ev": "strix/tools/web_search/tool.py#L321 web search tool description" }, { "name": "Vulnerability Knowledge Base", "does": "Structures findings with CVSS scoring and OWASP classification.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "README.md#L153 vulnerability knowledge base" }, { "name": "Multi-agent orchestration", "does": "Runs teams of AI pentester agents that collaborate and scale.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "README.md#L51 multi-agent orchestration" }, { "name": "MCP connectors", "does": "Connects to user-listed MCP servers (stdio or http) and calls their tools during a run (list_mcps, call_mcp).", "effects": [ "reads", "runs-commands", "sends-data" ], "enabled": "optional", "ev": "README.md#L325 connect your own MCP servers" }, { "name": "threat_model", "does": "Gives the agents threat-model tools from strix.tools.threat_model.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "strix/agents/factory.py#L65 threat-model tools imported into every agent" } ] }, "architecture": { "summary": { "text": "The code is split into strix/agents (agent graph and prompts), strix/tools (proxy, browser, terminal, scanners), strix/runtime (Docker sandbox), strix/report (findings, SARIF), strix/interface (CLI/TUI) and containers/ (sandbox image).", "ev": "AGENTS.md#L68 component layout" }, "runs": { "where": "local-program", "text": "You run the strix CLI yourself; by default it opens an interactive TUI that then launches the sandbox.", "ev": "strix/interface/cli_args.py#L190 default mode" }, "modes": [ { "where": "local-program", "mode": "headless", "switch": "-n/--non-interactive", "text": "Non-interactive mode runs without the TUI and exits on completion.", "ev": "strix/interface/cli_args.py#L188-191 non-interactive flag" }, { "where": "vendor-hosted", "mode": "managed cloud", "switch": "strix cloud", "text": "The managed cloud runs scans on app.strix.ai with no local Docker or LLM key.", "ev": "README.md#L310 strix cloud" } ], "parts": [ { "name": "strix CLI / TUI", "zone": "machine", "does": "The strix command-line / TUI that configures and launches a scan.", "ev": "pyproject.toml#L58 console entry point" }, { "name": "Kali sandbox container", "zone": "container", "does": "A Kali Linux Docker container where the agents run offensive tools.", "ev": "containers/Dockerfile#L25 runtime image base" }, { "name": "Caido proxy", "zone": "container", "does": "A Caido instance the sandbox entrypoint starts inside the container, listening on port ${CAIDO_PORT}.", "ev": "containers/docker-entrypoint.sh#L41 caido listener startup" }, { "name": "LLM provider", "zone": "outside", "does": "A model provider the agents call with the user's API key.", "ev": "README.md#L78 LLM provider prerequisite" }, { "name": "Target systems", "zone": "outside", "does": "The systems under test: URLs, repos, domains, IPs, or API specs.", "ev": "strix/interface/cli_args.py#L137 target kinds" }, { "name": "Strix Cloud / relay", "zone": "outside", "does": "The Strix Cloud platform and viewer relay at app.strix.ai.", "ev": "strix/config/settings.py#L198 viewer relay base URL" }, { "name": "Kali sandbox container", "zone": "container", "does": "The sandbox image installs nmap, sqlmap, nuclei, subfinder, naabu and ffuf.", "ev": "containers/Dockerfile#L54-55 apt package list of the runtime stage names these scanners" }, { "name": "Kali sandbox container", "zone": "container", "does": "The sandbox image installs the secret scanners trufflehog and gitleaks.", "ev": "containers/Dockerfile#L180-189 trufflehog install script and gitleaks release download in the image build" } ], "listens": [ { "what": "Caido listens on 0.0.0.0 at port ${CAIDO_PORT} inside the sandbox container.", "mode": "default", "bind": "all-interfaces", "sign_in": "unknown", "ev": "containers/docker-entrypoint.sh#L41 caido bind address" }, { "what": "strix view binds to 127.0.0.1 by default; --host 0.0.0.0 serves it on all IPv4 interfaces.", "mode": "optional", "bind": "configurable", "sign_in": "unknown", "ev": "strix/interface/viewer/cli.py#L51 host bind option" }, { "what": "The ChatGPT OAuth login uses a callback on localhost port 1455.", "mode": "optional", "bind": "loopback", "sign_in": "unknown", "ev": "strix/config/codex.py#L44-45 callback host and port" }, { "what": "Ports the sandbox container exposes are published on the host bound to 127.0.0.1, on a port Docker picks.", "mode": "default", "bind": "loopback", "sign_in": "unknown", "ev": "strix/runtime/docker_client.py#L217-219 port publishing for exposed_ports" } ], "connections": [ { "to": "LLM provider", "kind": "model-provider", "when": "always", "what": "Agents send prompts to the configured model provider with the user's key.", "ev": "README.md#L78 LLM provider" }, { "to": "targets you name", "kind": "target", "when": "always", "what": "Sends test traffic to the targets passed with --target.", "ev": "strix/interface/cli_args.py#L137 target kinds" }, { "to": "PostHog", "kind": "telemetry", "when": "default", "what": "Sends telemetry events to PostHog at https://us.i.posthog.com.", "ev": "strix/telemetry/posthog.py#L26 posthog host" }, { "to": "Scarf", "kind": "telemetry", "when": "default", "what": "Sends telemetry events to Scarf at https://strix.gateway.scarf.sh.", "ev": "strix/telemetry/scarf.py#L29 scarf endpoint" }, { "to": "Perplexity", "kind": "vendor-api", "when": "optional", "what": "Sends web-search queries to the Perplexity chat completions API at api.perplexity.ai.", "ev": "strix/tools/web_search/tool.py#L50 perplexity endpoint" }, { "to": "PyPI", "kind": "other", "when": "default", "what": "Queries the PyPI JSON API for the latest strix-agent version.", "ev": "strix/interface/update_check.py#L108 pypi version check" }, { "to": "Strix Cloud (app.strix.ai)", "kind": "vendor-api", "when": "optional", "what": "Uses https://app.strix.ai as the default Strix relay URL (STRIX_APP_URL).", "ev": "strix/config/settings.py#L198 relay base URL" }, { "to": "ghcr.io", "kind": "download", "when": "default", "what": "The installer names the sandbox image ghcr.io/usestrix/strix-sandbox:1.3.0.", "ev": "scripts/install.sh#L7 sandbox image reference" }, { "to": "Strix Cloud (app.strix.ai)", "kind": "vendor-api", "when": "optional", "what": "strix cloud scans start --source uploads local code to app.strix.ai for a managed scan; --yes approves the upload.", "ev": "README.md#L310-314 managed platform CLI example" } ], "model": { "who": "own-key", "text": "The tool calls the model set in STRIX_LLM with the provider key set in LLM_API_KEY.", "ev": "README.md#L87-88 model and key environment variables" } }, "needs": [ { "kind": "container", "text": "Docker installed and running to host the sandbox container.", "ev": "scripts/install.sh#L181 docker requirement message" }, { "kind": "model-key", "text": "An LLM API key from a supported provider (OpenAI, Anthropic, Google, etc.).", "ev": "README.md#L78 LLM provider prerequisite" }, { "kind": "authorization", "text": "Authorization to test the target systems.", "ev": "README.md#L374 authorized-use warning" } ], "installer": [ { "text": "The documented install pipes the script at https://strix.ai/install into bash.", "ev": "README.md#L84 curl-piped install" }, { "text": "The installer removes an older pipx install of strix-agent when it finds one.", "ev": "scripts/install.sh#L120 old pipx removal" }, { "text": "The installer appends a '# strix' comment line to the detected shell config file.", "ev": "scripts/install.sh#L216 shell profile edit" }, { "text": "Besides an old pipx install, the installer deletes any other strix file or symlink it finds on PATH.", "ev": "scripts/install.sh#L117-125 cleanup branch removes the found path for pipx and for any other file or symlink" }, { "text": "The installer appends a line that puts its install directory on PATH (export PATH, or fish_add_path for fish) to the detected shell config file.", "ev": "scripts/install.sh#L264-270 PATH commands passed to add_to_path per shell" } ], "limits": [ { "text": "The sandbox user has passwordless sudo.", "ev": "containers/Dockerfile#L36 sudoers entry" }, { "text": "The sandbox container is created with the NET_ADMIN and NET_RAW capabilities.", "ev": "strix/runtime/docker_client.py#L228 added capabilities" }, { "text": "A local directory target is bind-mounted into the sandbox writable, so agents can modify it.", "ev": "strix/interface/cli_args.py#L140 writable mount note" }, { "text": "Telemetry is enabled by default via the STRIX_TELEMETRY setting.", "ev": "strix/config/settings.py#L151 default-on telemetry" }, { "text": "strix view binds to 127.0.0.1 and prints a tokened link that grants access to the run; the author says to share it carefully.", "ev": "README.md#L193 tokened viewer link" }, { "text": "Without a VERSION setting, the installer looks up the latest usestrix/strix release tag through the GitHub API and installs that release.", "ev": "scripts/install.sh#L77 latest-release lookup" }, { "text": "The tokened strix view link authorizes the browser; anyone it is shared with can steer a live scan and browse run history.", "ev": "strix/interface/viewer/cli.py#L96-97 warning printed next to the viewer link" }, { "text": "The sandbox container resolves host.docker.internal to the Docker host gateway, which gives it a network path to the host machine.", "ev": "strix/runtime/docker_client.py#L232-233 extra_hosts injected at container creation" }, { "text": "--max-budget sets a maximum LLM cost in USD at which the scan stops; the flag defaults to None.", "ev": "strix/interface/cli_args.py#L278-287 budget flag definition with default=None" } ], "not_found": [ { "field": "maturity (preview/beta/stable)", "searched": "README.md, pyproject.toml, strix/skills/README.md for stability words; found only Alpha classifier and 'Work in Progress'" }, { "field": "capability_count (tools total)", "searched": "README.md features, strix/agents/factory.py tool lists for an author-stated tool count; only 'nine skills' stated" } ] }, "verdict": null, "runs": [] }