strix

Strix provides a suite of autonomous AI penetration testing agents designed to simulate real-world hacking activities. Unlike static analysis tools, Strix runs code dynamically to find vulnerabilities and validates them by generating working proofs-of-concept (PoCs). Key capabilities include: - Offensive Toolkit: Includes an HTTP interception proxy (via Caido), automated browser exploitation for XSS/CSRF, shell execution, and a Python sandbox for exploit validation. - Vulnerability Coverage: Scans for OWASP Top 10 issues, including broken access control, injection attacks (SQL, NoSQL, OS), SSRF, XXE, and business logic flaws. - Multi-Agent Orchestration: Uses a graph of specialized agents for reconnaissance, exploitation, and post-exploitation that collaborate to chain vulnerabilities. - Integration & Deployment: Offers a developer-first CLI, a local web viewer for results, and seamless integration with GitHub Actions and CI/CD pipelines. It supports various LLM providers (OpenAI, Anthropic, Google, etc.) and can be run locally via Docker or through a managed cloud platform. - API Testing: Supports testing via OpenAPI/Swagger specifications and Postman collections. - Extensibility: Compatible with Model Context Protocol (MCP) servers to expose additional tools to the AI agents.