What this is: Strix runs autonomous AI pentesting agents against your own app — they explore it like real attackers, prove each finding with a working exploit, and hand you patches. Open source (Apache-2.0), 53k+ stars on GitHub. Two ways to run it: local CLI or the managed platform with no setup.
⚠️ Authorized use only. Run Strix only against apps you own or have explicit written permission to test. Unauthorized testing is illegal in most jurisdictions. Everything below assumes you're scanning your own project.
Thanks for commenting HACK! This is exactly what I ran in the reel.
Go to app.strix.ai → sign up free → connect your repo or enter your domain → pick Standard Pentest → start. No Docker, no API key, no local install. You get validated findings with proof-of-concepts and one-click autofix pull requests.
Best for: you just want to know if your app is safe, today.
Prerequisites: Docker running + an LLM API key (OpenAI / Anthropic / Google / local model).
# 1. install
curl -sSL <https://strix.ai/install> | bash
# 2. configure your model
export STRIX_LLM="anthropic/claude-sonnet-4-6"
export LLM_API_KEY="your-api-key"
# 3. scan your own project
strix --target ./my-app
First run pulls a sandbox Docker image. Results are written to strix_runs/<run-name>.
Have a ChatGPT Plus/Pro subscription? You can skip the metered API key:
strix auth login chatgpt
export STRIX_LLM="chatgpt/gpt-5.4"
# a local codebase
strix --target ./my-app
# your own GitHub repo
strix --target <https://github.com/me/my-repo>
# your deployed app (black-box)
strix --target <https://my-app.com>
# source + deployed app together (best coverage)
strix -t <https://github.com/me/my-app> -t <https://my-app.com>
# your API from its spec
strix --target ./openapi.yaml --target <https://api.my-app.com>
Focus a run with plain english:
strix --target <https://my-app.com> --instruction "Focus on auth bypass and IDOR. Do not test the payment provider."