strix-agent 0.4.0__py3-none-any.whl → 0.6.2__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (117) hide show
  1. strix/agents/StrixAgent/strix_agent.py +3 -3
  2. strix/agents/StrixAgent/system_prompt.jinja +30 -26
  3. strix/agents/base_agent.py +159 -75
  4. strix/agents/state.py +5 -2
  5. strix/config/__init__.py +12 -0
  6. strix/config/config.py +172 -0
  7. strix/interface/assets/tui_styles.tcss +195 -230
  8. strix/interface/cli.py +16 -41
  9. strix/interface/main.py +151 -74
  10. strix/interface/streaming_parser.py +119 -0
  11. strix/interface/tool_components/__init__.py +4 -0
  12. strix/interface/tool_components/agent_message_renderer.py +190 -0
  13. strix/interface/tool_components/agents_graph_renderer.py +54 -38
  14. strix/interface/tool_components/base_renderer.py +68 -36
  15. strix/interface/tool_components/browser_renderer.py +106 -91
  16. strix/interface/tool_components/file_edit_renderer.py +117 -36
  17. strix/interface/tool_components/finish_renderer.py +43 -10
  18. strix/interface/tool_components/notes_renderer.py +63 -38
  19. strix/interface/tool_components/proxy_renderer.py +133 -92
  20. strix/interface/tool_components/python_renderer.py +121 -8
  21. strix/interface/tool_components/registry.py +19 -12
  22. strix/interface/tool_components/reporting_renderer.py +196 -28
  23. strix/interface/tool_components/scan_info_renderer.py +22 -19
  24. strix/interface/tool_components/terminal_renderer.py +270 -90
  25. strix/interface/tool_components/thinking_renderer.py +8 -6
  26. strix/interface/tool_components/todo_renderer.py +225 -0
  27. strix/interface/tool_components/user_message_renderer.py +26 -19
  28. strix/interface/tool_components/web_search_renderer.py +7 -6
  29. strix/interface/tui.py +907 -262
  30. strix/interface/utils.py +236 -4
  31. strix/llm/__init__.py +6 -2
  32. strix/llm/config.py +8 -5
  33. strix/llm/dedupe.py +217 -0
  34. strix/llm/llm.py +209 -356
  35. strix/llm/memory_compressor.py +6 -5
  36. strix/llm/utils.py +17 -8
  37. strix/runtime/__init__.py +12 -3
  38. strix/runtime/docker_runtime.py +121 -202
  39. strix/runtime/tool_server.py +55 -95
  40. strix/skills/README.md +64 -0
  41. strix/skills/__init__.py +110 -0
  42. strix/{prompts → skills}/frameworks/nextjs.jinja +26 -0
  43. strix/skills/scan_modes/deep.jinja +145 -0
  44. strix/skills/scan_modes/quick.jinja +63 -0
  45. strix/skills/scan_modes/standard.jinja +91 -0
  46. strix/telemetry/README.md +38 -0
  47. strix/telemetry/__init__.py +7 -1
  48. strix/telemetry/posthog.py +137 -0
  49. strix/telemetry/tracer.py +194 -54
  50. strix/tools/__init__.py +11 -4
  51. strix/tools/agents_graph/agents_graph_actions.py +20 -21
  52. strix/tools/agents_graph/agents_graph_actions_schema.xml +8 -8
  53. strix/tools/browser/browser_actions.py +10 -6
  54. strix/tools/browser/browser_actions_schema.xml +6 -1
  55. strix/tools/browser/browser_instance.py +96 -48
  56. strix/tools/browser/tab_manager.py +121 -102
  57. strix/tools/context.py +12 -0
  58. strix/tools/executor.py +63 -4
  59. strix/tools/file_edit/file_edit_actions.py +6 -3
  60. strix/tools/file_edit/file_edit_actions_schema.xml +45 -3
  61. strix/tools/finish/finish_actions.py +80 -105
  62. strix/tools/finish/finish_actions_schema.xml +121 -14
  63. strix/tools/notes/notes_actions.py +6 -33
  64. strix/tools/notes/notes_actions_schema.xml +50 -46
  65. strix/tools/proxy/proxy_actions.py +14 -2
  66. strix/tools/proxy/proxy_actions_schema.xml +0 -1
  67. strix/tools/proxy/proxy_manager.py +28 -16
  68. strix/tools/python/python_actions.py +2 -2
  69. strix/tools/python/python_actions_schema.xml +9 -1
  70. strix/tools/python/python_instance.py +39 -37
  71. strix/tools/python/python_manager.py +43 -31
  72. strix/tools/registry.py +73 -12
  73. strix/tools/reporting/reporting_actions.py +218 -31
  74. strix/tools/reporting/reporting_actions_schema.xml +256 -8
  75. strix/tools/terminal/terminal_actions.py +2 -2
  76. strix/tools/terminal/terminal_actions_schema.xml +6 -0
  77. strix/tools/terminal/terminal_manager.py +41 -30
  78. strix/tools/thinking/thinking_actions_schema.xml +27 -25
  79. strix/tools/todo/__init__.py +18 -0
  80. strix/tools/todo/todo_actions.py +568 -0
  81. strix/tools/todo/todo_actions_schema.xml +225 -0
  82. strix/utils/__init__.py +0 -0
  83. strix/utils/resource_paths.py +13 -0
  84. {strix_agent-0.4.0.dist-info → strix_agent-0.6.2.dist-info}/METADATA +90 -65
  85. strix_agent-0.6.2.dist-info/RECORD +134 -0
  86. {strix_agent-0.4.0.dist-info → strix_agent-0.6.2.dist-info}/WHEEL +1 -1
  87. strix/llm/request_queue.py +0 -87
  88. strix/prompts/README.md +0 -64
  89. strix/prompts/__init__.py +0 -109
  90. strix_agent-0.4.0.dist-info/RECORD +0 -118
  91. /strix/{prompts → skills}/cloud/.gitkeep +0 -0
  92. /strix/{prompts → skills}/coordination/root_agent.jinja +0 -0
  93. /strix/{prompts → skills}/custom/.gitkeep +0 -0
  94. /strix/{prompts → skills}/frameworks/fastapi.jinja +0 -0
  95. /strix/{prompts → skills}/protocols/graphql.jinja +0 -0
  96. /strix/{prompts → skills}/reconnaissance/.gitkeep +0 -0
  97. /strix/{prompts → skills}/technologies/firebase_firestore.jinja +0 -0
  98. /strix/{prompts → skills}/technologies/supabase.jinja +0 -0
  99. /strix/{prompts → skills}/vulnerabilities/authentication_jwt.jinja +0 -0
  100. /strix/{prompts → skills}/vulnerabilities/broken_function_level_authorization.jinja +0 -0
  101. /strix/{prompts → skills}/vulnerabilities/business_logic.jinja +0 -0
  102. /strix/{prompts → skills}/vulnerabilities/csrf.jinja +0 -0
  103. /strix/{prompts → skills}/vulnerabilities/idor.jinja +0 -0
  104. /strix/{prompts → skills}/vulnerabilities/information_disclosure.jinja +0 -0
  105. /strix/{prompts → skills}/vulnerabilities/insecure_file_uploads.jinja +0 -0
  106. /strix/{prompts → skills}/vulnerabilities/mass_assignment.jinja +0 -0
  107. /strix/{prompts → skills}/vulnerabilities/open_redirect.jinja +0 -0
  108. /strix/{prompts → skills}/vulnerabilities/path_traversal_lfi_rfi.jinja +0 -0
  109. /strix/{prompts → skills}/vulnerabilities/race_conditions.jinja +0 -0
  110. /strix/{prompts → skills}/vulnerabilities/rce.jinja +0 -0
  111. /strix/{prompts → skills}/vulnerabilities/sql_injection.jinja +0 -0
  112. /strix/{prompts → skills}/vulnerabilities/ssrf.jinja +0 -0
  113. /strix/{prompts → skills}/vulnerabilities/subdomain_takeover.jinja +0 -0
  114. /strix/{prompts → skills}/vulnerabilities/xss.jinja +0 -0
  115. /strix/{prompts → skills}/vulnerabilities/xxe.jinja +0 -0
  116. {strix_agent-0.4.0.dist-info → strix_agent-0.6.2.dist-info}/entry_points.txt +0 -0
  117. {strix_agent-0.4.0.dist-info → strix_agent-0.6.2.dist-info/licenses}/LICENSE +0 -0
@@ -0,0 +1,225 @@
1
+ <tools>
2
+ <important>
3
+ The todo tool is available for organizing complex tasks when needed. Each subagent has their own
4
+ separate todo list - your todos are private to you and do not interfere with other agents' todos.
5
+
6
+ WHEN TO USE TODOS:
7
+ - Planning complex multi-step operations
8
+ - Tracking multiple parallel workstreams
9
+ - When you need to remember tasks to return to later
10
+ - Organizing large-scope assessments with many components
11
+
12
+ WHEN NOT NEEDED:
13
+ - Simple, straightforward tasks
14
+ - Linear workflows where progress is obvious
15
+ - Short tasks that can be completed quickly
16
+
17
+ If you do use todos, batch operations together to minimize tool calls.
18
+ </important>
19
+
20
+ <tool name="create_todo">
21
+ <description>Create a new todo item to track tasks, goals, and progress.</description>
22
+ <details>Use this tool when you need to track multiple tasks or plan complex operations.
23
+ Each subagent maintains their own independent todo list - your todos are yours alone.
24
+
25
+ Useful for breaking down complex tasks into smaller, manageable items when the workflow
26
+ is non-trivial or when you need to track progress across multiple components.</details>
27
+ <parameters>
28
+ <parameter name="title" type="string" required="false">
29
+ <description>Short, actionable title for the todo (e.g., "Test login endpoint for SQL injection")</description>
30
+ </parameter>
31
+ <parameter name="todos" type="string" required="false">
32
+ <description>Create multiple todos at once. Provide a JSON array of {"title": "...", "description": "...", "priority": "..."} objects or a newline-separated bullet list.</description>
33
+ </parameter>
34
+ <parameter name="description" type="string" required="false">
35
+ <description>Detailed description or notes about the task</description>
36
+ </parameter>
37
+ <parameter name="priority" type="string" required="false">
38
+ <description>Priority level: "low", "normal", "high", "critical" (default: "normal")</description>
39
+ </parameter>
40
+ </parameters>
41
+ <returns type="Dict[str, Any]">
42
+ <description>Response containing: - created: List of created todos with their IDs - todos: Full sorted todo list - success: Whether the operation succeeded</description>
43
+ </returns>
44
+ <examples>
45
+ # Create a high priority todo
46
+ <function=create_todo>
47
+ <parameter=title>Test authentication bypass on /api/admin</parameter>
48
+ <parameter=description>The admin endpoint seems to have weak authentication. Try JWT manipulation, session fixation, and privilege escalation.</parameter>
49
+ <parameter=priority>high</parameter>
50
+ </function>
51
+
52
+ # Create a simple todo
53
+ <function=create_todo>
54
+ <parameter=title>Enumerate all API endpoints</parameter>
55
+ </function>
56
+
57
+ # Bulk create todos (JSON array)
58
+ <function=create_todo>
59
+ <parameter=todos>[{"title": "Map all admin routes", "priority": "high"}, {"title": "Check forgotten password flow"}]</parameter>
60
+ </function>
61
+
62
+ # Bulk create todos (bullet list)
63
+ <function=create_todo>
64
+ <parameter=todos>
65
+ - Capture baseline traffic in proxy
66
+ - Enumerate S3 buckets for leaked assets
67
+ - Compare responses for timing differences
68
+ </parameter>
69
+ </function>
70
+ </examples>
71
+ </tool>
72
+
73
+ <tool name="list_todos">
74
+ <description>List all todos with optional filtering by status or priority.</description>
75
+ <details>Use this when you need to check your current todos, get fresh IDs, or reprioritize.
76
+ The list is sorted: done first, then in_progress, then pending. Within each status, sorted by priority (critical > high > normal > low).
77
+ Each subagent has their own independent todo list.</details>
78
+ <parameters>
79
+ <parameter name="status" type="string" required="false">
80
+ <description>Filter by status: "pending", "in_progress", "done"</description>
81
+ </parameter>
82
+ <parameter name="priority" type="string" required="false">
83
+ <description>Filter by priority: "low", "normal", "high", "critical"</description>
84
+ </parameter>
85
+ </parameters>
86
+ <returns type="Dict[str, Any]">
87
+ <description>Response containing: - todos: List of todo items - total_count: Total number of todos - summary: Count by status (pending, in_progress, done)</description>
88
+ </returns>
89
+ <examples>
90
+ # List all todos
91
+ <function=list_todos>
92
+ </function>
93
+
94
+ # List only pending todos
95
+ <function=list_todos>
96
+ <parameter=status>pending</parameter>
97
+ </function>
98
+
99
+ # List high priority items
100
+ <function=list_todos>
101
+ <parameter=priority>high</parameter>
102
+ </function>
103
+ </examples>
104
+ </tool>
105
+
106
+ <tool name="update_todo">
107
+ <description>Update one or multiple todo items. Prefer bulk updates in a single call when updating multiple items.</description>
108
+ <parameters>
109
+ <parameter name="todo_id" type="string" required="false">
110
+ <description>ID of a single todo to update (for simple updates)</description>
111
+ </parameter>
112
+ <parameter name="updates" type="string" required="false">
113
+ <description>Bulk update multiple todos at once. JSON array of objects with todo_id and fields to update: [{"todo_id": "abc", "status": "done"}, {"todo_id": "def", "priority": "high"}].</description>
114
+ </parameter>
115
+ <parameter name="title" type="string" required="false">
116
+ <description>New title (used with todo_id)</description>
117
+ </parameter>
118
+ <parameter name="description" type="string" required="false">
119
+ <description>New description (used with todo_id)</description>
120
+ </parameter>
121
+ <parameter name="priority" type="string" required="false">
122
+ <description>New priority: "low", "normal", "high", "critical" (used with todo_id)</description>
123
+ </parameter>
124
+ <parameter name="status" type="string" required="false">
125
+ <description>New status: "pending", "in_progress", "done" (used with todo_id)</description>
126
+ </parameter>
127
+ </parameters>
128
+ <returns type="Dict[str, Any]">
129
+ <description>Response containing: - updated: List of updated todo IDs - updated_count: Number updated - todos: Full sorted todo list - errors: Any failed updates</description>
130
+ </returns>
131
+ <examples>
132
+ # Single update
133
+ <function=update_todo>
134
+ <parameter=todo_id>abc123</parameter>
135
+ <parameter=status>in_progress</parameter>
136
+ </function>
137
+
138
+ # Bulk update - mark multiple todos with different statuses in ONE call
139
+ <function=update_todo>
140
+ <parameter=updates>[{"todo_id": "abc123", "status": "done"}, {"todo_id": "def456", "status": "in_progress"}, {"todo_id": "ghi789", "priority": "critical"}]</parameter>
141
+ </function>
142
+ </examples>
143
+ </tool>
144
+
145
+ <tool name="mark_todo_done">
146
+ <description>Mark one or multiple todos as completed in a single call.</description>
147
+ <details>Mark todos as done after completing them. Group multiple completions into one call using todo_ids when possible.</details>
148
+ <parameters>
149
+ <parameter name="todo_id" type="string" required="false">
150
+ <description>ID of a single todo to mark as done</description>
151
+ </parameter>
152
+ <parameter name="todo_ids" type="string" required="false">
153
+ <description>Mark multiple todos done at once. JSON array of IDs: ["abc123", "def456"] or comma-separated: "abc123, def456"</description>
154
+ </parameter>
155
+ </parameters>
156
+ <returns type="Dict[str, Any]">
157
+ <description>Response containing: - marked_done: List of IDs marked done - marked_count: Number marked - todos: Full sorted list - errors: Any failures</description>
158
+ </returns>
159
+ <examples>
160
+ # Mark single todo done
161
+ <function=mark_todo_done>
162
+ <parameter=todo_id>abc123</parameter>
163
+ </function>
164
+
165
+ # Mark multiple todos done in ONE call
166
+ <function=mark_todo_done>
167
+ <parameter=todo_ids>["abc123", "def456", "ghi789"]</parameter>
168
+ </function>
169
+ </examples>
170
+ </tool>
171
+
172
+ <tool name="mark_todo_pending">
173
+ <description>Mark one or multiple todos as pending (reopen completed tasks).</description>
174
+ <details>Use this to reopen tasks that were marked done but need more work. Supports bulk operations.</details>
175
+ <parameters>
176
+ <parameter name="todo_id" type="string" required="false">
177
+ <description>ID of a single todo to mark as pending</description>
178
+ </parameter>
179
+ <parameter name="todo_ids" type="string" required="false">
180
+ <description>Mark multiple todos pending at once. JSON array of IDs: ["abc123", "def456"] or comma-separated: "abc123, def456"</description>
181
+ </parameter>
182
+ </parameters>
183
+ <returns type="Dict[str, Any]">
184
+ <description>Response containing: - marked_pending: List of IDs marked pending - marked_count: Number marked - todos: Full sorted list - errors: Any failures</description>
185
+ </returns>
186
+ <examples>
187
+ # Mark single todo pending
188
+ <function=mark_todo_pending>
189
+ <parameter=todo_id>abc123</parameter>
190
+ </function>
191
+
192
+ # Mark multiple todos pending in ONE call
193
+ <function=mark_todo_pending>
194
+ <parameter=todo_ids>["abc123", "def456"]</parameter>
195
+ </function>
196
+ </examples>
197
+ </tool>
198
+
199
+ <tool name="delete_todo">
200
+ <description>Delete one or multiple todos in a single call.</description>
201
+ <details>Use this to remove todos that are no longer relevant. Supports bulk deletion to save tool calls.</details>
202
+ <parameters>
203
+ <parameter name="todo_id" type="string" required="false">
204
+ <description>ID of a single todo to delete</description>
205
+ </parameter>
206
+ <parameter name="todo_ids" type="string" required="false">
207
+ <description>Delete multiple todos at once. JSON array of IDs: ["abc123", "def456"] or comma-separated: "abc123, def456"</description>
208
+ </parameter>
209
+ </parameters>
210
+ <returns type="Dict[str, Any]">
211
+ <description>Response containing: - deleted: List of deleted IDs - deleted_count: Number deleted - todos: Remaining todos - errors: Any failures</description>
212
+ </returns>
213
+ <examples>
214
+ # Delete single todo
215
+ <function=delete_todo>
216
+ <parameter=todo_id>abc123</parameter>
217
+ </function>
218
+
219
+ # Delete multiple todos in ONE call
220
+ <function=delete_todo>
221
+ <parameter=todo_ids>["abc123", "def456", "ghi789"]</parameter>
222
+ </function>
223
+ </examples>
224
+ </tool>
225
+ </tools>
File without changes
@@ -0,0 +1,13 @@
1
+ import sys
2
+ from pathlib import Path
3
+
4
+
5
+ def get_strix_resource_path(*parts: str) -> Path:
6
+ frozen_base = getattr(sys, "_MEIPASS", None)
7
+ if frozen_base:
8
+ base = Path(frozen_base) / "strix"
9
+ if base.exists():
10
+ return base.joinpath(*parts)
11
+
12
+ base = Path(__file__).resolve().parent.parent
13
+ return base.joinpath(*parts)
@@ -1,8 +1,9 @@
1
- Metadata-Version: 2.3
1
+ Metadata-Version: 2.4
2
2
  Name: strix-agent
3
- Version: 0.4.0
3
+ Version: 0.6.2
4
4
  Summary: Open-source AI Hackers for your apps
5
5
  License: Apache-2.0
6
+ License-File: LICENSE
6
7
  Keywords: cybersecurity,security,vulnerability,scanner,pentest,agent,ai,cli
7
8
  Author: Strix
8
9
  Author-email: hi@usestrix.com
@@ -16,77 +17,91 @@ Classifier: Programming Language :: Python
16
17
  Classifier: Programming Language :: Python :: 3
17
18
  Classifier: Programming Language :: Python :: 3.12
18
19
  Classifier: Programming Language :: Python :: 3.13
20
+ Classifier: Programming Language :: Python :: 3.14
19
21
  Classifier: Programming Language :: Python :: 3 :: Only
20
22
  Classifier: Topic :: Security
23
+ Provides-Extra: sandbox
24
+ Provides-Extra: vertex
25
+ Requires-Dist: cvss (>=3.2,<4.0)
26
+ Requires-Dist: defusedxml (>=0.7.1,<0.8.0)
21
27
  Requires-Dist: docker (>=7.1.0,<8.0.0)
22
- Requires-Dist: fastapi
23
- Requires-Dist: gql[requests] (>=3.5.3,<4.0.0)
24
- Requires-Dist: ipython (>=9.3.0,<10.0.0)
25
- Requires-Dist: libtmux (>=0.46.2,<0.47.0)
26
- Requires-Dist: litellm[proxy] (>=1.79.1,<1.80.0)
27
- Requires-Dist: numpydoc (>=1.8.0,<2.0.0)
28
- Requires-Dist: openai (>=1.99.5,<1.100.0)
29
- Requires-Dist: openhands-aci (>=0.3.0,<0.4.0)
30
- Requires-Dist: playwright (>=1.48.0,<2.0.0)
28
+ Requires-Dist: fastapi ; extra == "sandbox"
29
+ Requires-Dist: google-cloud-aiplatform (>=1.38) ; extra == "vertex"
30
+ Requires-Dist: gql[requests] (>=3.5.3,<4.0.0) ; extra == "sandbox"
31
+ Requires-Dist: ipython (>=9.3.0,<10.0.0) ; extra == "sandbox"
32
+ Requires-Dist: libtmux (>=0.46.2,<0.47.0) ; extra == "sandbox"
33
+ Requires-Dist: litellm[proxy] (>=1.80.7,<1.81.0)
34
+ Requires-Dist: numpydoc (>=1.8.0,<2.0.0) ; extra == "sandbox"
35
+ Requires-Dist: openhands-aci (>=0.3.0,<0.4.0) ; extra == "sandbox"
36
+ Requires-Dist: playwright (>=1.48.0,<2.0.0) ; extra == "sandbox"
31
37
  Requires-Dist: pydantic[email] (>=2.11.3,<3.0.0)
32
- Requires-Dist: pyte (>=0.8.1,<0.9.0)
38
+ Requires-Dist: pyte (>=0.8.1,<0.9.0) ; extra == "sandbox"
33
39
  Requires-Dist: requests (>=2.32.0,<3.0.0)
34
40
  Requires-Dist: rich
35
41
  Requires-Dist: tenacity (>=9.0.0,<10.0.0)
36
42
  Requires-Dist: textual (>=4.0.0,<5.0.0)
37
- Requires-Dist: uvicorn
43
+ Requires-Dist: uvicorn ; extra == "sandbox"
38
44
  Requires-Dist: xmltodict (>=0.13.0,<0.14.0)
39
45
  Description-Content-Type: text/markdown
40
46
 
41
47
  <p align="center">
42
- <a href="https://usestrix.com/">
43
- <img src=".github/logo.png" width="150" alt="Strix Logo">
48
+ <a href="https://strix.ai/">
49
+ <img src="https://github.com/usestrix/.github/raw/main/imgs/cover.png" alt="Strix Banner" width="100%">
44
50
  </a>
45
51
  </p>
46
52
 
47
- <h1 align="center">Strix</h1>
53
+ <div align="center">
48
54
 
49
- <h2 align="center">Open-source AI Hackers to secure your Apps</h2>
55
+ # Strix
50
56
 
51
- <div align="center">
57
+ ### Open-source AI hackers to find and fix your app’s vulnerabilities.
58
+
59
+ <br/>
60
+
61
+
62
+ <a href="https://docs.strix.ai"><img src="https://img.shields.io/badge/Docs-docs.strix.ai-2b9246?style=for-the-badge&logo=gitbook&logoColor=white" alt="Docs"></a>
63
+ <a href="https://strix.ai"><img src="https://img.shields.io/badge/Website-strix.ai-3b82f6?style=for-the-badge&logoColor=white" alt="Website"></a>
64
+ <a href="https://pypi.org/project/strix-agent/"><img src="https://img.shields.io/badge/PyPI-strix--agent-f59e0b?style=for-the-badge&logo=pypi&logoColor=white" alt="PyPI"></a>
52
65
 
53
- [![Python](https://img.shields.io/pypi/pyversions/strix-agent?color=3776AB)](https://pypi.org/project/strix-agent/)
54
- [![PyPI](https://img.shields.io/pypi/v/strix-agent?color=10b981)](https://pypi.org/project/strix-agent/)
55
- [![PyPI Downloads](https://static.pepy.tech/personalized-badge/strix-agent?period=total&units=INTERNATIONAL_SYSTEM&left_color=GREY&right_color=RED&left_text=Downloads)](https://pepy.tech/projects/strix-agent)
56
- [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
66
+ <a href="https://deepwiki.com/usestrix/strix"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a>
67
+ <a href="https://github.com/usestrix/strix"><img src="https://img.shields.io/github/stars/usestrix/strix?style=flat-square" alt="GitHub Stars"></a>
68
+ <a href="LICENSE"><img src="https://img.shields.io/badge/License-Apache%202.0-3b82f6?style=flat-square" alt="License"></a>
69
+ <a href="https://pypi.org/project/strix-agent/"><img src="https://img.shields.io/pypi/v/strix-agent?style=flat-square" alt="PyPI Version"></a>
57
70
 
58
- [![GitHub Stars](https://img.shields.io/github/stars/usestrix/strix)](https://github.com/usestrix/strix)
59
- [![Discord](https://img.shields.io/badge/Discord-%235865F2.svg?&logo=discord&logoColor=white)](https://discord.gg/YjKFvEZSdZ)
60
- [![Website](https://img.shields.io/badge/Website-usestrix.com-2d3748.svg)](https://usestrix.com)
61
71
 
62
- <a href="https://trendshift.io/repositories/15362" target="_blank"><img src="https://trendshift.io/api/badge/repositories/15362" alt="usestrix%2Fstrix | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
72
+ <a href="https://discord.gg/YjKFvEZSdZ"><img src="https://github.com/usestrix/.github/raw/main/imgs/Discord.png" height="40" alt="Join Discord"></a>
73
+ <a href="https://x.com/strix_ai"><img src="https://github.com/usestrix/.github/raw/main/imgs/X.png" height="40" alt="Follow on X"></a>
74
+
75
+
76
+ <a href="https://trendshift.io/repositories/15362" target="_blank"><img src="https://trendshift.io/api/badge/repositories/15362" alt="usestrix/strix | Trendshift" width="250" height="55"/></a>
63
77
 
64
78
  </div>
65
79
 
66
- <br>
80
+ <br/>
67
81
 
68
82
  <div align="center">
69
- <img src=".github/screenshot.png" alt="Strix Demo" width="800" style="border-radius: 16px;">
83
+ <img src=".github/screenshot.png" alt="Strix Demo" width="900" style="border-radius: 16px;">
70
84
  </div>
71
85
 
72
86
  <br>
73
87
 
74
88
  > [!TIP]
75
- > **New!** Strix now integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches production!
89
+ > **New!** Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches production!
76
90
 
77
91
  ---
78
92
 
79
- ## 🦉 Strix Overview
93
+
94
+ ## Strix Overview
80
95
 
81
96
  Strix are autonomous AI agents that act just like real hackers - they run your code dynamically, find vulnerabilities, and validate them through actual proof-of-concepts. Built for developers and security teams who need fast, accurate security testing without the overhead of manual pentesting or the false positives of static analysis tools.
82
97
 
83
98
  **Key Capabilities:**
84
99
 
85
- - 🔧 **Full hacker toolkit** out of the box
86
- - 🤝 **Teams of agents** that collaborate and scale
87
- - **Real validation** with PoCs, not false positives
88
- - 💻 **Developer‑first** CLI with actionable reports
89
- - 🔄 **Auto‑fix & reporting** to accelerate remediation
100
+ - **Full hacker toolkit** out of the box
101
+ - **Teams of agents** that collaborate and scale
102
+ - **Real validation** with PoCs, not false positives
103
+ - **Developer‑first** CLI with actionable reports
104
+ - **Auto‑fix & reporting** to accelerate remediation
90
105
 
91
106
 
92
107
  ## 🎯 Use Cases
@@ -102,13 +117,15 @@ Strix are autonomous AI agents that act just like real hackers - they run your c
102
117
 
103
118
  **Prerequisites:**
104
119
  - Docker (running)
105
- - Python 3.12+
106
120
  - An LLM provider key (e.g. [get OpenAI API key](https://platform.openai.com/api-keys) or use a local LLM)
107
121
 
108
122
  ### Installation & First Scan
109
123
 
110
124
  ```bash
111
125
  # Install Strix
126
+ curl -sSL https://strix.ai/install | bash
127
+
128
+ # Or via pipx
112
129
  pipx install strix-agent
113
130
 
114
131
  # Configure your AI provider
@@ -122,9 +139,9 @@ strix --target ./app-directory
122
139
  > [!NOTE]
123
140
  > First run automatically pulls the sandbox Docker image. Results are saved to `strix_runs/<run-name>`
124
141
 
125
- ## ☁️ Run Strix in Cloud
142
+ ## Run Strix in Cloud
126
143
 
127
- Want to skip the local setup, API keys, and unpredictable LLM costs? Run the hosted cloud version of Strix at **[app.usestrix.com](https://app.usestrix.com)**.
144
+ Want to skip the local setup, API keys, and unpredictable LLM costs? Run the hosted cloud version of Strix at **[app.strix.ai](https://strix.ai)**.
128
145
 
129
146
  Launch a scan in just a few minutes—no setup or configuration required—and you’ll get:
130
147
 
@@ -133,13 +150,13 @@ Launch a scan in just a few minutes—no setup or configuration required—and y
133
150
  - **CI/CD and GitHub integrations** to block risky changes before production
134
151
  - **Continuous monitoring** so new vulnerabilities are caught quickly
135
152
 
136
- [**Run your first pentest now →**](https://app.usestrix.com)
153
+ [**Run your first pentest now →**](https://strix.ai)
137
154
 
138
155
  ---
139
156
 
140
157
  ## ✨ Features
141
158
 
142
- ### 🛠️ Agentic Security Tools
159
+ ### Agentic Security Tools
143
160
 
144
161
  Strix agents come equipped with a comprehensive security testing toolkit:
145
162
 
@@ -151,7 +168,7 @@ Strix agents come equipped with a comprehensive security testing toolkit:
151
168
  - **Code Analysis** - Static and dynamic analysis capabilities
152
169
  - **Knowledge Management** - Structured findings and attack documentation
153
170
 
154
- ### 🎯 Comprehensive Vulnerability Detection
171
+ ### Comprehensive Vulnerability Detection
155
172
 
156
173
  Strix can identify and validate a wide range of security vulnerabilities:
157
174
 
@@ -163,7 +180,7 @@ Strix can identify and validate a wide range of security vulnerabilities:
163
180
  - **Authentication** - JWT vulnerabilities, session management
164
181
  - **Infrastructure** - Misconfigurations, exposed services
165
182
 
166
- ### 🕸️ Graph of Agents
183
+ ### Graph of Agents
167
184
 
168
185
  Advanced multi-agent orchestration for comprehensive security testing:
169
186
 
@@ -173,7 +190,7 @@ Advanced multi-agent orchestration for comprehensive security testing:
173
190
 
174
191
  ---
175
192
 
176
- ## 💻 Usage Examples
193
+ ## Usage Examples
177
194
 
178
195
  ### Basic Usage
179
196
 
@@ -199,9 +216,12 @@ strix -t https://github.com/org/app -t https://your-app.com
199
216
 
200
217
  # Focused testing with custom instructions
201
218
  strix --target api.your-app.com --instruction "Focus on business logic flaws and IDOR vulnerabilities"
219
+
220
+ # Provide detailed instructions through file (e.g., rules of engagement, scope, exclusions)
221
+ strix --target api.your-app.com --instruction-file ./instruction.md
202
222
  ```
203
223
 
204
- ### 🤖 Headless Mode
224
+ ### Headless Mode
205
225
 
206
226
  Run Strix programmatically without interactive UI using the `-n/--non-interactive` flag—perfect for servers and automated jobs. The CLI prints real-time vulnerability findings, and the final report before exiting. Exits with non-zero code when vulnerabilities are found.
207
227
 
@@ -209,7 +229,7 @@ Run Strix programmatically without interactive UI using the `-n/--non-interactiv
209
229
  strix -n --target https://your-app.com
210
230
  ```
211
231
 
212
- ### 🔄 CI/CD (GitHub Actions)
232
+ ### CI/CD (GitHub Actions)
213
233
 
214
234
  Strix can be added to your pipeline to run a security test on pull requests with a lightweight GitHub Actions workflow:
215
235
 
@@ -223,20 +243,20 @@ jobs:
223
243
  security-scan:
224
244
  runs-on: ubuntu-latest
225
245
  steps:
226
- - uses: actions/checkout@v4
246
+ - uses: actions/checkout@v6
227
247
 
228
248
  - name: Install Strix
229
- run: pipx install strix-agent
249
+ run: curl -sSL https://strix.ai/install | bash
230
250
 
231
251
  - name: Run Strix
232
252
  env:
233
253
  STRIX_LLM: ${{ secrets.STRIX_LLM }}
234
254
  LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
235
255
 
236
- run: strix -n -t ./
256
+ run: strix -n -t ./ --scan-mode quick
237
257
  ```
238
258
 
239
- ### ⚙️ Configuration
259
+ ### Configuration
240
260
 
241
261
  ```bash
242
262
  export STRIX_LLM="openai/gpt-5"
@@ -245,36 +265,41 @@ export LLM_API_KEY="your-api-key"
245
265
  # Optional
246
266
  export LLM_API_BASE="your-api-base-url" # if using a local model, e.g. Ollama, LMStudio
247
267
  export PERPLEXITY_API_KEY="your-api-key" # for search capabilities
268
+ export STRIX_REASONING_EFFORT="high" # control thinking effort (default: high, quick scan: medium)
248
269
  ```
249
270
 
250
- [OpenAI's GPT-5](https://openai.com/api/) (`openai/gpt-5`) and [Anthropic's Claude Sonnet 4.5](https://claude.com/platform/api) (`anthropic/claude-sonnet-4-5`) are the recommended models for best results with Strix. We also support many [other options](https://docs.litellm.ai/docs/providers), including cloud and local models, though their performance and reliability may vary.
271
+ > [!NOTE]
272
+ > Strix automatically saves your configuration to `~/.strix/cli-config.json`, so you don't have to re-enter it on every run.
273
+
274
+ **Recommended models for best results:**
251
275
 
252
- ## 🤝 Contributing
276
+ - [OpenAI GPT-5](https://openai.com/api/) — `openai/gpt-5`
277
+ - [Anthropic Claude Sonnet 4.5](https://claude.com/platform/api) — `anthropic/claude-sonnet-4-5`
278
+ - [Google Gemini 3 Pro Preview](https://cloud.google.com/vertex-ai) — `vertex_ai/gemini-3-pro-preview`
253
279
 
254
- We welcome contributions from the community! There are several ways to contribute:
280
+ See the [LLM Providers documentation](https://docs.strix.ai/llm-providers/overview) for all supported providers including Vertex AI, Bedrock, Azure, and local models.
255
281
 
256
- ### Code Contributions
257
- See our [Contributing Guide](CONTRIBUTING.md) for details on:
258
- - Setting up your development environment
259
- - Running tests and quality checks
260
- - Submitting pull requests
261
- - Code style guidelines
282
+ ## Documentation
262
283
 
284
+ Full documentation is available at **[docs.strix.ai](https://docs.strix.ai)** — including detailed guides for usage, CI/CD integrations, skills, and advanced configuration.
263
285
 
264
- ### Prompt Modules Collection
265
- Help expand our collection of specialized prompt modules for AI agents:
266
- - Advanced testing techniques for vulnerabilities, frameworks, and technologies
267
- - See [Prompt Modules Documentation](strix/prompts/README.md) for guidelines
268
- - Submit via [pull requests](https://github.com/usestrix/strix/pulls) or [issues](https://github.com/usestrix/strix/issues)
286
+ ## Contributing
269
287
 
270
- ## 👥 Join Our Community
288
+ We welcome contributions of code, docs, and new skills - check out our [Contributing Guide](https://docs.strix.ai/contributing) to get started or open a [pull request](https://github.com/usestrix/strix/pulls)/[issue](https://github.com/usestrix/strix/issues).
289
+
290
+ ## Join Our Community
271
291
 
272
292
  Have questions? Found a bug? Want to contribute? **[Join our Discord!](https://discord.gg/YjKFvEZSdZ)**
273
293
 
274
- ## 🌟 Support the Project
294
+ ## Support the Project
275
295
 
276
296
  **Love Strix?** Give us a ⭐ on GitHub!
277
297
 
298
+ ## Acknowledgements
299
+
300
+ Strix builds on the incredible work of open-source projects like [LiteLLM](https://github.com/BerriAI/litellm), [Caido](https://github.com/caido/caido), [Nuclei](https://github.com/projectdiscovery/nuclei), [Playwright](https://github.com/microsoft/playwright), and [Textual](https://github.com/Textualize/textual). Huge thanks to their maintainers!
301
+
302
+
278
303
  > [!WARNING]
279
304
  > Only test apps you own or have permission to test. You are responsible for using Strix ethically and legally.
280
305