strix - Open-Source AI Hacker That Finds and Fixes App Vulnerabilities

strix is an open-source security testing tool based on autonomous AI agents that runs code directly like a real hacker, discovers vulnerabilities, and then validates them through PoC (Proof of Concept).

It adopts a Graph of Agents architecture where multiple agents collaborate, performing comprehensive testing through distributed workflows and parallel execution. It can detect vulnerabilities across various categories including IDOR, SQL injection, SSRF, XSS, JWT vulnerabilities, and infrastructure misconfigurations.

It comes with built-in tools equivalent to a real hacker's toolkit, such as Full HTTP Proxy, browser automation, terminal environment, and OSINT reconnaissance, and supports various target types ranging from local codebases to deployed web app URLs.

It integrates with CI/CD pipelines and GitHub Actions to automatically perform security scans on every PR, blocking vulnerable code before it gets deployed to production. It supports all major LLMs from OpenAI, Anthropic, and Google.