Strix: an open source AI penetration testing tool that allows AI to run applications like a real hacker, find vulnerabilities and provide repair patchesStrix：开源 AI 渗透测试工具，让 AI 像真黑客一样把应用跑起来、找出漏洞并给出修复补丁

Real vulnerabilities, no false positives: Each conclusion is accompanied by a working PoC and reproduction steps, which not only saves the cycle cost of manual penetration, but also avoids the problem of false positives caused by static analysis tools.

Multi-agent collaboration: Multiple AI penetration testers work together and deploy in parallel, covering the entire process of reconnaissance, utilization, and verification, and automatically generate repair patches and compliance reports.

Attack tool chain: Caido HTTP interception proxy, automatic browser testing for XSS/CSRF/clickjacking/authentication bypass, interactive terminal, Python vulnerability sandbox.

Covers the OWASP Top 10: common high-risk aspects such as unauthorized access (IDOR, privilege escalation, authentication bypass), injection classes (SQL / NoSQL / command injection / SSTI), and provides CVSS scores and OWASP classifications.

Prerequisites: Install and start Docker on this machine, and then prepare a large model API Key from any supported manufacturer (OpenAI, Anthropic, Google, etc.).

Three steps to start: curl -sSL https://strix.ai/install | bash installation; set the two environment variables STRIX_LLM and LLM_API_KEY; then strix --target ./your project directory to start the first security assessment. The first run will automatically pull the sandbox image, and the result will be saved in strix_runs/<run-name>.

It can also be installed into programming agents: npx skills add usestrix/strix will install 9 skills, allowing Claude Code, Cursor, and Codex to directly have the ability to run penetrations, fix vulnerabilities, and connect to CI.

The download button provides the complete source code package of the project's main branch (about 5.2 MB), including CLI, multi-agent orchestration, vulnerability knowledge base and documentation, and is licensed under Apache-2.0. Python users can also install directly via pip install strix-agent.

Penetration testing tools can only be used on targets that you own or have written authorization for; it may be illegal to initiate tests on other people's systems without authorization. Calling third-party large model APIs will incur fees, please evaluate them yourself. This article is compiled from public information, and the resources are only for learning and exchange.