Strix

usestrix‘s open-source autonomous pentesting agent: a CLI that points a team of LLM agents at a codebase, a GitHub repo, or a deployed web app, and has them find vulnerabilities and prove them with working exploits. Apache 2.0, ~44.8k★ / 4.7k forks, shipped as strix-agent on PyPI and run inside a Docker sandbox.

It is by a wide margin the most capable and most widely adopted tool this spoke has recorded, and the first where the agents act on the target rather than gathering information about it.

Where it sits on this spoke’s autonomy axis

ai-osint tracked a progression: llm-osint (one model, one loop) → kallisto-osinter (orchestrated specialist agents). Both gather. Strix keeps the orchestration — a “Graph of Agents” with specialists for recon, exploitation and post-exploitation, running in parallel across targets and sharing findings so one agent’s discovery feeds another’s chain — and extends the axis past collection into action. Reconnaissance (subdomain enumeration, attack-surface mapping, fingerprinting) is one agent among several here, the first step of a longer automated chain rather than the product.

The toolkit

The README’s framing is that the agents get what a human tester gets: an intercepting HTTP proxy (Caido), a Playwright browser for client-side testing, an interactive shell, a Python sandbox for writing and running proof-of-concept exploits, recon tooling, and combined SAST + DAST over source. Findings land in a structured knowledge base with CVSS scores and OWASP classification. Coverage is described as OWASP Top 10 and beyond: access control, injection, server-side (SSRF, XXE, deserialization, RCE), client-side, business-logic, authentication/session, cloud misconfiguration, and API classes. Built on LiteLLM, Caido, Nuclei, Playwright and Textual.

Exploit validation as the evidence standard

The product argument is aimed at scanner noise: “working PoCs, not false positives.” A finding counts only when the agent has demonstrated it, with reproduction steps attached. That is a stronger evidence discipline than anything else in this corpus — llm-osint and kallisto-osinter assert profiles nobody checks — and it is available here because the target is the oracle. An exploit either fires or it doesn’t, which is exactly the ground truth an OSINT profile lacks. Note what it doesn’t claim: no independent benchmark, no measured false-negative rate, no published comparison against human testers.

Red team on every pull request

A GitHub Actions workflow, a --non-interactive mode that exits non-zero when it finds something, and automatic diff-scoping on PR runs. That turns offensive testing into a CI gate — continuous exploitation of your own application at commit cadence, with AI-generated patches offered as ready-to-merge PRs on the hosted platform. This is the shift-left / DevSecOps seam with ../defensive-security-wiki (which names AI-accelerated exploitation in its own domain).

The human dial is still there

strix view serves a local dashboard on 127.0.0.1 reading run files off disk, with a live map of which agent is doing what, and steering: you can send instructions into a running scan and redirect the agents mid-flight. Full autonomy with a hand on the wheel, the same augment/automate compromise kafsiem and sift-kg’s human-gated merges reach by different routes.

Availability and the ethics line

Apache 2.0, a one-line install script, and model-agnostic configuration including local models (Ollama/LMStudio via LLM_API_BASE) and sign-in with a ChatGPT subscription instead of a metered API key. So the cost and access floor for running an autonomous exploitation agent is a consumer subscription or a local model. The only stated constraint is a README warning: “Only test apps you own or have permission to test. You are responsible for using Strix ethically and legally.” No technical scope enforcement, no authorization check. See synthesis for what that does to this spoke’s dual-use tension.

Tier

T3 — a vendor README for a commercially backed open-source tool. Capability claims are self-reported and marketing-shaped (“act just like real hackers”), and there is no third-party evaluation. The star count (2026-07-27) and the model list are dated snapshots.

autonomous-pentesting · usestrix · ai-osint · osint · ip-reconnaissance · swaggerspy · kallisto-osinter · synthesis