Strix is an AI powered security platform designed to help organizations detect vulnerabilities, monitor threats, and protect digital assets.
Depending on the implementation, Strix platforms typically fall into two categories:
These systems use artificial intelligence to analyze large amounts of data and provide actionable security insights.
Download Strix v1.5.0 - AI Penetration Testing Tools - Software Mirrors |
|---|
Download Strix for Linux
strix_agent-1.5.0-py3-none-manylinux_2_17_x86_64.whl Download Strix for Linux
strix_agent-1.5.0-py3-none-manylinux_2_17_aarch64.whl Download Strix for Windows
strix-1.5.0-windows-x86_64.zip Download Strix for macOS - Intel
strix-1.5.0-macos-x86_64.tar.gz Download Strix for macOS - Silicon
strix-1.5.0-macos-arm64.tar.gz Download Strix for Linux
strix-1.5.0-linux-x86_64.tar.gz Download Strix for Linux
strix-1.5.0-linux-arm64.tar.gz |
Strix v1.5.0 - AI Penetration Testing Tools Release Notes: What's Changed- fix(cli): align View label spacing in final panel by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/918
- fix viewer tool call collisions across agents by @bearsyankees in https://github.com/usestrix/strix/pull/917
- fix: recoverable guardrail blocks and decoupled crash-notify by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/919
- Scope viewer session cookie to the bound port by @yoni-at-strix in https://github.com/usestrix/strix/pull/922
- fix(cost): capture OpenRouter streamed usage.cost (fixes $0 kimi-k3 c… by @bearsyankees in https://github.com/usestrix/strix/pull/929
- fix(runtime): label docker sandbox containers with the run id for teardown by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/933
- feat(llm): custom request headers for OpenAI-compatible endpoints via LLM_EXTRA_HEADERS by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/936
- fix(llm): pass LLM_EXTRA_HEADERS through ModelSettings so they reach the agent loop by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/937
- feat(llm): opt-in LLM_DISABLE_STREAMING for non-streaming OpenAI-compatible endpoints by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/938
- fix(llm): prevent ChatGPT subscription scan freezes by @chunguscodes in https://github.com/usestrix/strix/pull/943
- fix(llm): surface structured provider refusals by @bearsyankees in https://github.com/usestrix/strix/pull/944
- fix: pre-v1-style lifecycle resilience — mailbox delivery, uniform revival, unexitable runner, waiting timeout, broader retries, crash-safe identity by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/923
- docs(prompt): teach agents to recognize Caido proxy error pages instead of chasing them by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/955
- fix(core): explicit lifecycle contract — plain text never ends a run; respond_to_user / wait_for_agents split by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/954
- docs(llm-providers): explain the structured tool_calls requirement for local endpoints (#520) by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/901
- feat(config): accept STRIX_REASONING_EFFORT=max for providers that support it by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/956
- fix(tools): accept both the string and structured form of every tool argument by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/957
- perf(cli): ~10x faster startup via lazy imports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/920
- fix(core): a child never leaves its parent waiting silently by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/959
- feat(runtime): mount local targets instead of copying them in by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/958
- fix: calibrate vulnerability severity to demonstrated impact by @bearsyankees in https://github.com/usestrix/strix/pull/962
- feat(tui): replace Textual with a Go/Bubble Tea interface by @kusonooyasumi in https://github.com/usestrix/strix/pull/941
- Create credential files with owner-only permissions by @lukiod in https://github.com/usestrix/strix/pull/945
- fix(tui): remove the shift+enter newline hint from the setup footer by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/968
- feat: support API specs and Postman collections as targets by @5h4d0wr007 in https://github.com/usestrix/strix/pull/866
- fix(tui): keep a long error inside the status row by @0xallam in https://github.com/usestrix/strix/pull/970
- feat(reporting): record transitive dependency chain on SCA findings by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/971
- fix(llm): keep tool-call ids unique so a recycled id can't erase history by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/976
- fix(llm): cap the tool calls one assistant response may queue by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/977
- fix(llm): abandon a model stream that stops producing events by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/978
- fix(agents): collapse repeated waits queued inside one model turn by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/979
- feat(reporting): structured reachability evidence ladder for dependen… by @bearsyankees in https://github.com/usestrix/strix/pull/974
- feat(reporting): require repo-relative manifest_path on dependency CVE findings by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/982
- prompt changes by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/984
- update readme by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/985
- feat: agent-ready — installable SKILL.md skills, AGENTS.md, coding-ag… by @bearsyankees in https://github.com/usestrix/strix/pull/926
- docs(skills): require per-CVE affected-symbol matching in dependency reachability analysis by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/986
- chore: release v1.5.0 + bump sandbox image to 1.3.0 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/987
- ci: fix Windows release build — TUI-sidecar archive check used forward-slash paths by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/990
- ci: tolerate repr-escaped backslashes in the release TUI-sidecar check by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/991
New Contributors- @chunguscodes made their first contribution in https://github.com/usestrix/strix/pull/943
- @lukiod made their first contribution in https://github.com/usestrix/strix/pull/945
- @5h4d0wr007 made their first contribution in https://github.com/usestrix/strix/pull/866
Full Changelog: https://github.com/usestrix/strix/compare/v1.4.1...v1.5.0
What's Changed- fix(cli): align View label spacing in final panel by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/918
- fix viewer tool call collisions across agents by @bearsyankees in https://github.com/usestrix/strix/pull/917
- fix: recoverable guardrail blocks and decoupled crash-notify by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/919
- Scope viewer session cookie to the bound port by @yoni-at-strix in https://github.com/usestrix/strix/pull/922
- fix(cost): capture OpenRouter streamed usage.cost (fixes $0 kimi-k3 c… by @bearsyankees in https://github.com/usestrix/strix/pull/929
- fix(runtime): label docker sandbox containers with the run id for teardown by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/933
- feat(llm): custom request headers for OpenAI-compatible endpoints via LLM_EXTRA_HEADERS by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/936
- fix(llm): pass LLM_EXTRA_HEADERS through ModelSettings so they reach the agent loop by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/937
- feat(llm): opt-in LLM_DISABLE_STREAMING for non-streaming OpenAI-compatible endpoints by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/938
- fix(llm): prevent ChatGPT subscription scan freezes by @chunguscodes in https://github.com/usestrix/strix/pull/943
- fix(llm): surface structured provider refusals by @bearsyankees in https://github.com/usestrix/strix/pull/944
- fix: pre-v1-style lifecycle resilience — mailbox delivery, uniform revival, unexitable runner, waiting timeout, broader retries, crash-safe identity by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/923
- docs(prompt): teach agents to recognize Caido proxy error pages instead of chasing them by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/955
- fix(core): explicit lifecycle contract — plain text never ends a run; respond_to_user / wait_for_agents split by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/954
- docs(llm-providers): explain the structured tool_calls requirement for local endpoints (#520) by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/901
- feat(config): accept STRIX_REASONING_EFFORT=max for providers that support it by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/956
- fix(tools): accept both the string and structured form of every tool argument by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/957
- perf(cli): ~10x faster startup via lazy imports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/920
- fix(core): a child never leaves its parent waiting silently by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/959
- feat(runtime): mount local targets instead of copying them in by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/958
- fix: calibrate vulnerability severity to demonstrated impact by @bearsyankees in https://github.com/usestrix/strix/pull/962
- feat(tui): replace Textual with a Go/Bubble Tea interface by @kusonooyasumi in https://github.com/usestrix/strix/pull/941
- Create credential files with owner-only permissions by @lukiod in https://github.com/usestrix/strix/pull/945
- fix(tui): remove the shift+enter newline hint from the setup footer by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/968
- feat: support API specs and Postman collections as targets by @5h4d0wr007 in https://github.com/usestrix/strix/pull/866
- fix(tui): keep a long error inside the status row by @0xallam in https://github.com/usestrix/strix/pull/970
- feat(reporting): record transitive dependency chain on SCA findings by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/971
- fix(llm): keep tool-call ids unique so a recycled id can't erase history by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/976
- fix(llm): cap the tool calls one assistant response may queue by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/977
- fix(llm): abandon a model stream that stops producing events by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/978
- fix(agents): collapse repeated waits queued inside one model turn by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/979
- feat(reporting): structured reachability evidence ladder for dependen… by @bearsyankees in https://github.com/usestrix/strix/pull/974
- feat(reporting): require repo-relative manifest_path on dependency CVE findings by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/982
- prompt changes by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/984
- update readme by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/985
- feat: agent-ready — installable SKILL.md skills, AGENTS.md, coding-ag… by @bearsyankees in https://github.com/usestrix/strix/pull/926
- docs(skills): require per-CVE affected-symbol matching in dependency reachability analysis by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/986
- chore: release v1.5.0 + bump sandbox image to 1.3.0 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/987
- ci: fix Windows release build — TUI-sidecar archive check used forward-slash paths by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/990
- ci: tolerate repr-escaped backslashes in the release TUI-sidecar check by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/991
- ci: publish nested standalone archives as release assets by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/994
New Contributors- @chunguscodes made their first contribution in https://github.com/usestrix/strix/pull/943
- @lukiod made their first contribution in https://github.com/usestrix/strix/pull/945
- @5h4d0wr007 made their first contribution in https://github.com/usestrix/strix/pull/866
Full Changelog: https://github.com/usestrix/strix/compare/v1.4.1...v1.5.0 |
Quick Start
Prerequisites:
Installation & First Scan
# Install Strix
curl -sSL https://strix.ai/install | bash
# Configure your AI provider
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"
# Run your first security assessment
strix --target ./app-directory
Usage Examples
Basic Usage
# Scan a local codebase
strix --target ./app-directory
# Security review of a GitHub repository
strix --target https://github.com/org/repo
# Black-box web application assessment
strix --target https://your-app.com
Advanced Testing Scenarios
# Grey-box authenticated testing
strix --target https://your-app.com --instruction "Perform authenticated testing using credentials: user:pass"
# Multi-target testing (source code + deployed app)
strix -t https://github.com/org/app -t https://your-app.com
# Focused testing with custom instructions
strix --target api.your-app.com --instruction "Focus on business logic flaws and IDOR vulnerabilities"
# Provide detailed instructions through file (e.g., rules of engagement, scope, exclusions)
strix --target api.your-app.com --instruction-file ./instruction.md
Headless Mode
Run Strix programmatically without interactive UI using the -n/--non-interactive flag—perfect for servers and automated jobs. The CLI prints real-time vulnerability findings, and the final report before exiting. Exits with non-zero code when vulnerabilities are found.
strix -n --target https://your-app.com
CI/CD (GitHub Actions)
Strix can be added to your pipeline to run a security test on pull requests with a lightweight GitHub Actions workflow:
name: strix-penetration-test
on:
pull_request:
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install Strix
run: curl -sSL https://strix.ai/install | bash
- name: Run Strix
env:
STRIX_LLM: ${{ secrets.STRIX_LLM }}
LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
run: strix -n -t ./ --scan-mode quick
Configuration
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"
# Optional
export LLM_API_BASE="your-api-base-url" # if using a local model, e.g. Ollama, LMStudio
export PERPLEXITY_API_KEY="your-api-key" # for search capabilities
export STRIX_REASONING_EFFORT="high" # control thinking effort (default: high, quick scan: medium)
Key Features of Strix
AI Driven Penetration Testing
Some versions of Strix act like automated ethical hackers.
They can:
Scan applications for vulnerabilities
Simulate real world attack scenarios
Validate findings with proof of concept exploits
This approach reduces false positives and speeds up testing significantly.
Multi Agent Security System
Strix uses multiple AI agents working together to perform complex security tasks.
Capabilities include:
Parallel vulnerability scanning
Coordinated attack simulations
Shared intelligence between agents
This allows faster and more comprehensive testing compared to manual methods.
Digital Risk Monitoring
Another core capability is monitoring threats across external sources.
Strix can track:
This helps organizations detect risks before they escalate.
Attack Surface Mapping
Strix continuously scans and maps an organization’s external footprint.
It identifies:
This provides a clear view of security exposure.
CI/CD Integration
Strix integrates with development workflows to improve security during development.
Features include:
Automated scans during code changes
Blocking vulnerabilities before deployment
Continuous monitoring of new risks
This is especially useful for DevSecOps environments.
Reporting and Insights
The platform generates detailed reports with:
This helps teams prioritize and fix issues efficiently.
Performance and Usability
Strix is designed for technical users such as developers and security teams.
Performance highlights:
Usability considerations:
Requires understanding of cybersecurity concepts
Setup and configuration may be complex
Best suited for professional environments
Pros and Cons
Advantages
AI driven security automation
Reduces manual penetration testing effort
Real time threat monitoring
Integrates with development pipelines
Provides actionable security insights
Limitations
Not a replacement for human security experts
May require advanced technical knowledge
Limited visibility compared to established enterprise tools
Effectiveness depends on configuration and data quality
Who Should Use Strix
Strix is best suited for:
Cybersecurity professionals
DevSecOps teams
Organizations protecting digital assets
Developers building secure applications
It is particularly useful for teams that want to integrate AI into security workflows.
Final Verdict
Strix represents a new generation of AI powered cybersecurity tools that combine automated penetration testing with real time threat monitoring. Its ability to simulate attackers, analyze risks, and integrate into development pipelines makes it a powerful solution for modern security challenges.
For organizations looking to improve security efficiency and reduce manual workload, Strix is a forward looking and capable platform.
Post a Comment/Report Broken Link: