strix-agent 0.4.0__py3-none-any.whl → 0.6.2__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- strix/agents/StrixAgent/strix_agent.py +3 -3
- strix/agents/StrixAgent/system_prompt.jinja +30 -26
- strix/agents/base_agent.py +159 -75
- strix/agents/state.py +5 -2
- strix/config/__init__.py +12 -0
- strix/config/config.py +172 -0
- strix/interface/assets/tui_styles.tcss +195 -230
- strix/interface/cli.py +16 -41
- strix/interface/main.py +151 -74
- strix/interface/streaming_parser.py +119 -0
- strix/interface/tool_components/__init__.py +4 -0
- strix/interface/tool_components/agent_message_renderer.py +190 -0
- strix/interface/tool_components/agents_graph_renderer.py +54 -38
- strix/interface/tool_components/base_renderer.py +68 -36
- strix/interface/tool_components/browser_renderer.py +106 -91
- strix/interface/tool_components/file_edit_renderer.py +117 -36
- strix/interface/tool_components/finish_renderer.py +43 -10
- strix/interface/tool_components/notes_renderer.py +63 -38
- strix/interface/tool_components/proxy_renderer.py +133 -92
- strix/interface/tool_components/python_renderer.py +121 -8
- strix/interface/tool_components/registry.py +19 -12
- strix/interface/tool_components/reporting_renderer.py +196 -28
- strix/interface/tool_components/scan_info_renderer.py +22 -19
- strix/interface/tool_components/terminal_renderer.py +270 -90
- strix/interface/tool_components/thinking_renderer.py +8 -6
- strix/interface/tool_components/todo_renderer.py +225 -0
- strix/interface/tool_components/user_message_renderer.py +26 -19
- strix/interface/tool_components/web_search_renderer.py +7 -6
- strix/interface/tui.py +907 -262
- strix/interface/utils.py +236 -4
- strix/llm/__init__.py +6 -2
- strix/llm/config.py +8 -5
- strix/llm/dedupe.py +217 -0
- strix/llm/llm.py +209 -356
- strix/llm/memory_compressor.py +6 -5
- strix/llm/utils.py +17 -8
- strix/runtime/__init__.py +12 -3
- strix/runtime/docker_runtime.py +121 -202
- strix/runtime/tool_server.py +55 -95
- strix/skills/README.md +64 -0
- strix/skills/__init__.py +110 -0
- strix/{prompts → skills}/frameworks/nextjs.jinja +26 -0
- strix/skills/scan_modes/deep.jinja +145 -0
- strix/skills/scan_modes/quick.jinja +63 -0
- strix/skills/scan_modes/standard.jinja +91 -0
- strix/telemetry/README.md +38 -0
- strix/telemetry/__init__.py +7 -1
- strix/telemetry/posthog.py +137 -0
- strix/telemetry/tracer.py +194 -54
- strix/tools/__init__.py +11 -4
- strix/tools/agents_graph/agents_graph_actions.py +20 -21
- strix/tools/agents_graph/agents_graph_actions_schema.xml +8 -8
- strix/tools/browser/browser_actions.py +10 -6
- strix/tools/browser/browser_actions_schema.xml +6 -1
- strix/tools/browser/browser_instance.py +96 -48
- strix/tools/browser/tab_manager.py +121 -102
- strix/tools/context.py +12 -0
- strix/tools/executor.py +63 -4
- strix/tools/file_edit/file_edit_actions.py +6 -3
- strix/tools/file_edit/file_edit_actions_schema.xml +45 -3
- strix/tools/finish/finish_actions.py +80 -105
- strix/tools/finish/finish_actions_schema.xml +121 -14
- strix/tools/notes/notes_actions.py +6 -33
- strix/tools/notes/notes_actions_schema.xml +50 -46
- strix/tools/proxy/proxy_actions.py +14 -2
- strix/tools/proxy/proxy_actions_schema.xml +0 -1
- strix/tools/proxy/proxy_manager.py +28 -16
- strix/tools/python/python_actions.py +2 -2
- strix/tools/python/python_actions_schema.xml +9 -1
- strix/tools/python/python_instance.py +39 -37
- strix/tools/python/python_manager.py +43 -31
- strix/tools/registry.py +73 -12
- strix/tools/reporting/reporting_actions.py +218 -31
- strix/tools/reporting/reporting_actions_schema.xml +256 -8
- strix/tools/terminal/terminal_actions.py +2 -2
- strix/tools/terminal/terminal_actions_schema.xml +6 -0
- strix/tools/terminal/terminal_manager.py +41 -30
- strix/tools/thinking/thinking_actions_schema.xml +27 -25
- strix/tools/todo/__init__.py +18 -0
- strix/tools/todo/todo_actions.py +568 -0
- strix/tools/todo/todo_actions_schema.xml +225 -0
- strix/utils/__init__.py +0 -0
- strix/utils/resource_paths.py +13 -0
- {strix_agent-0.4.0.dist-info → strix_agent-0.6.2.dist-info}/METADATA +90 -65
- strix_agent-0.6.2.dist-info/RECORD +134 -0
- {strix_agent-0.4.0.dist-info → strix_agent-0.6.2.dist-info}/WHEEL +1 -1
- strix/llm/request_queue.py +0 -87
- strix/prompts/README.md +0 -64
- strix/prompts/__init__.py +0 -109
- strix_agent-0.4.0.dist-info/RECORD +0 -118
- /strix/{prompts → skills}/cloud/.gitkeep +0 -0
- /strix/{prompts → skills}/coordination/root_agent.jinja +0 -0
- /strix/{prompts → skills}/custom/.gitkeep +0 -0
- /strix/{prompts → skills}/frameworks/fastapi.jinja +0 -0
- /strix/{prompts → skills}/protocols/graphql.jinja +0 -0
- /strix/{prompts → skills}/reconnaissance/.gitkeep +0 -0
- /strix/{prompts → skills}/technologies/firebase_firestore.jinja +0 -0
- /strix/{prompts → skills}/technologies/supabase.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/authentication_jwt.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/broken_function_level_authorization.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/business_logic.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/csrf.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/idor.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/information_disclosure.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/insecure_file_uploads.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/mass_assignment.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/open_redirect.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/path_traversal_lfi_rfi.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/race_conditions.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/rce.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/sql_injection.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/ssrf.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/subdomain_takeover.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/xss.jinja +0 -0
- /strix/{prompts → skills}/vulnerabilities/xxe.jinja +0 -0
- {strix_agent-0.4.0.dist-info → strix_agent-0.6.2.dist-info}/entry_points.txt +0 -0
- {strix_agent-0.4.0.dist-info → strix_agent-0.6.2.dist-info/licenses}/LICENSE +0 -0
|
@@ -0,0 +1,225 @@
|
|
|
1
|
+
<tools>
|
|
2
|
+
<important>
|
|
3
|
+
The todo tool is available for organizing complex tasks when needed. Each subagent has their own
|
|
4
|
+
separate todo list - your todos are private to you and do not interfere with other agents' todos.
|
|
5
|
+
|
|
6
|
+
WHEN TO USE TODOS:
|
|
7
|
+
- Planning complex multi-step operations
|
|
8
|
+
- Tracking multiple parallel workstreams
|
|
9
|
+
- When you need to remember tasks to return to later
|
|
10
|
+
- Organizing large-scope assessments with many components
|
|
11
|
+
|
|
12
|
+
WHEN NOT NEEDED:
|
|
13
|
+
- Simple, straightforward tasks
|
|
14
|
+
- Linear workflows where progress is obvious
|
|
15
|
+
- Short tasks that can be completed quickly
|
|
16
|
+
|
|
17
|
+
If you do use todos, batch operations together to minimize tool calls.
|
|
18
|
+
</important>
|
|
19
|
+
|
|
20
|
+
<tool name="create_todo">
|
|
21
|
+
<description>Create a new todo item to track tasks, goals, and progress.</description>
|
|
22
|
+
<details>Use this tool when you need to track multiple tasks or plan complex operations.
|
|
23
|
+
Each subagent maintains their own independent todo list - your todos are yours alone.
|
|
24
|
+
|
|
25
|
+
Useful for breaking down complex tasks into smaller, manageable items when the workflow
|
|
26
|
+
is non-trivial or when you need to track progress across multiple components.</details>
|
|
27
|
+
<parameters>
|
|
28
|
+
<parameter name="title" type="string" required="false">
|
|
29
|
+
<description>Short, actionable title for the todo (e.g., "Test login endpoint for SQL injection")</description>
|
|
30
|
+
</parameter>
|
|
31
|
+
<parameter name="todos" type="string" required="false">
|
|
32
|
+
<description>Create multiple todos at once. Provide a JSON array of {"title": "...", "description": "...", "priority": "..."} objects or a newline-separated bullet list.</description>
|
|
33
|
+
</parameter>
|
|
34
|
+
<parameter name="description" type="string" required="false">
|
|
35
|
+
<description>Detailed description or notes about the task</description>
|
|
36
|
+
</parameter>
|
|
37
|
+
<parameter name="priority" type="string" required="false">
|
|
38
|
+
<description>Priority level: "low", "normal", "high", "critical" (default: "normal")</description>
|
|
39
|
+
</parameter>
|
|
40
|
+
</parameters>
|
|
41
|
+
<returns type="Dict[str, Any]">
|
|
42
|
+
<description>Response containing: - created: List of created todos with their IDs - todos: Full sorted todo list - success: Whether the operation succeeded</description>
|
|
43
|
+
</returns>
|
|
44
|
+
<examples>
|
|
45
|
+
# Create a high priority todo
|
|
46
|
+
<function=create_todo>
|
|
47
|
+
<parameter=title>Test authentication bypass on /api/admin</parameter>
|
|
48
|
+
<parameter=description>The admin endpoint seems to have weak authentication. Try JWT manipulation, session fixation, and privilege escalation.</parameter>
|
|
49
|
+
<parameter=priority>high</parameter>
|
|
50
|
+
</function>
|
|
51
|
+
|
|
52
|
+
# Create a simple todo
|
|
53
|
+
<function=create_todo>
|
|
54
|
+
<parameter=title>Enumerate all API endpoints</parameter>
|
|
55
|
+
</function>
|
|
56
|
+
|
|
57
|
+
# Bulk create todos (JSON array)
|
|
58
|
+
<function=create_todo>
|
|
59
|
+
<parameter=todos>[{"title": "Map all admin routes", "priority": "high"}, {"title": "Check forgotten password flow"}]</parameter>
|
|
60
|
+
</function>
|
|
61
|
+
|
|
62
|
+
# Bulk create todos (bullet list)
|
|
63
|
+
<function=create_todo>
|
|
64
|
+
<parameter=todos>
|
|
65
|
+
- Capture baseline traffic in proxy
|
|
66
|
+
- Enumerate S3 buckets for leaked assets
|
|
67
|
+
- Compare responses for timing differences
|
|
68
|
+
</parameter>
|
|
69
|
+
</function>
|
|
70
|
+
</examples>
|
|
71
|
+
</tool>
|
|
72
|
+
|
|
73
|
+
<tool name="list_todos">
|
|
74
|
+
<description>List all todos with optional filtering by status or priority.</description>
|
|
75
|
+
<details>Use this when you need to check your current todos, get fresh IDs, or reprioritize.
|
|
76
|
+
The list is sorted: done first, then in_progress, then pending. Within each status, sorted by priority (critical > high > normal > low).
|
|
77
|
+
Each subagent has their own independent todo list.</details>
|
|
78
|
+
<parameters>
|
|
79
|
+
<parameter name="status" type="string" required="false">
|
|
80
|
+
<description>Filter by status: "pending", "in_progress", "done"</description>
|
|
81
|
+
</parameter>
|
|
82
|
+
<parameter name="priority" type="string" required="false">
|
|
83
|
+
<description>Filter by priority: "low", "normal", "high", "critical"</description>
|
|
84
|
+
</parameter>
|
|
85
|
+
</parameters>
|
|
86
|
+
<returns type="Dict[str, Any]">
|
|
87
|
+
<description>Response containing: - todos: List of todo items - total_count: Total number of todos - summary: Count by status (pending, in_progress, done)</description>
|
|
88
|
+
</returns>
|
|
89
|
+
<examples>
|
|
90
|
+
# List all todos
|
|
91
|
+
<function=list_todos>
|
|
92
|
+
</function>
|
|
93
|
+
|
|
94
|
+
# List only pending todos
|
|
95
|
+
<function=list_todos>
|
|
96
|
+
<parameter=status>pending</parameter>
|
|
97
|
+
</function>
|
|
98
|
+
|
|
99
|
+
# List high priority items
|
|
100
|
+
<function=list_todos>
|
|
101
|
+
<parameter=priority>high</parameter>
|
|
102
|
+
</function>
|
|
103
|
+
</examples>
|
|
104
|
+
</tool>
|
|
105
|
+
|
|
106
|
+
<tool name="update_todo">
|
|
107
|
+
<description>Update one or multiple todo items. Prefer bulk updates in a single call when updating multiple items.</description>
|
|
108
|
+
<parameters>
|
|
109
|
+
<parameter name="todo_id" type="string" required="false">
|
|
110
|
+
<description>ID of a single todo to update (for simple updates)</description>
|
|
111
|
+
</parameter>
|
|
112
|
+
<parameter name="updates" type="string" required="false">
|
|
113
|
+
<description>Bulk update multiple todos at once. JSON array of objects with todo_id and fields to update: [{"todo_id": "abc", "status": "done"}, {"todo_id": "def", "priority": "high"}].</description>
|
|
114
|
+
</parameter>
|
|
115
|
+
<parameter name="title" type="string" required="false">
|
|
116
|
+
<description>New title (used with todo_id)</description>
|
|
117
|
+
</parameter>
|
|
118
|
+
<parameter name="description" type="string" required="false">
|
|
119
|
+
<description>New description (used with todo_id)</description>
|
|
120
|
+
</parameter>
|
|
121
|
+
<parameter name="priority" type="string" required="false">
|
|
122
|
+
<description>New priority: "low", "normal", "high", "critical" (used with todo_id)</description>
|
|
123
|
+
</parameter>
|
|
124
|
+
<parameter name="status" type="string" required="false">
|
|
125
|
+
<description>New status: "pending", "in_progress", "done" (used with todo_id)</description>
|
|
126
|
+
</parameter>
|
|
127
|
+
</parameters>
|
|
128
|
+
<returns type="Dict[str, Any]">
|
|
129
|
+
<description>Response containing: - updated: List of updated todo IDs - updated_count: Number updated - todos: Full sorted todo list - errors: Any failed updates</description>
|
|
130
|
+
</returns>
|
|
131
|
+
<examples>
|
|
132
|
+
# Single update
|
|
133
|
+
<function=update_todo>
|
|
134
|
+
<parameter=todo_id>abc123</parameter>
|
|
135
|
+
<parameter=status>in_progress</parameter>
|
|
136
|
+
</function>
|
|
137
|
+
|
|
138
|
+
# Bulk update - mark multiple todos with different statuses in ONE call
|
|
139
|
+
<function=update_todo>
|
|
140
|
+
<parameter=updates>[{"todo_id": "abc123", "status": "done"}, {"todo_id": "def456", "status": "in_progress"}, {"todo_id": "ghi789", "priority": "critical"}]</parameter>
|
|
141
|
+
</function>
|
|
142
|
+
</examples>
|
|
143
|
+
</tool>
|
|
144
|
+
|
|
145
|
+
<tool name="mark_todo_done">
|
|
146
|
+
<description>Mark one or multiple todos as completed in a single call.</description>
|
|
147
|
+
<details>Mark todos as done after completing them. Group multiple completions into one call using todo_ids when possible.</details>
|
|
148
|
+
<parameters>
|
|
149
|
+
<parameter name="todo_id" type="string" required="false">
|
|
150
|
+
<description>ID of a single todo to mark as done</description>
|
|
151
|
+
</parameter>
|
|
152
|
+
<parameter name="todo_ids" type="string" required="false">
|
|
153
|
+
<description>Mark multiple todos done at once. JSON array of IDs: ["abc123", "def456"] or comma-separated: "abc123, def456"</description>
|
|
154
|
+
</parameter>
|
|
155
|
+
</parameters>
|
|
156
|
+
<returns type="Dict[str, Any]">
|
|
157
|
+
<description>Response containing: - marked_done: List of IDs marked done - marked_count: Number marked - todos: Full sorted list - errors: Any failures</description>
|
|
158
|
+
</returns>
|
|
159
|
+
<examples>
|
|
160
|
+
# Mark single todo done
|
|
161
|
+
<function=mark_todo_done>
|
|
162
|
+
<parameter=todo_id>abc123</parameter>
|
|
163
|
+
</function>
|
|
164
|
+
|
|
165
|
+
# Mark multiple todos done in ONE call
|
|
166
|
+
<function=mark_todo_done>
|
|
167
|
+
<parameter=todo_ids>["abc123", "def456", "ghi789"]</parameter>
|
|
168
|
+
</function>
|
|
169
|
+
</examples>
|
|
170
|
+
</tool>
|
|
171
|
+
|
|
172
|
+
<tool name="mark_todo_pending">
|
|
173
|
+
<description>Mark one or multiple todos as pending (reopen completed tasks).</description>
|
|
174
|
+
<details>Use this to reopen tasks that were marked done but need more work. Supports bulk operations.</details>
|
|
175
|
+
<parameters>
|
|
176
|
+
<parameter name="todo_id" type="string" required="false">
|
|
177
|
+
<description>ID of a single todo to mark as pending</description>
|
|
178
|
+
</parameter>
|
|
179
|
+
<parameter name="todo_ids" type="string" required="false">
|
|
180
|
+
<description>Mark multiple todos pending at once. JSON array of IDs: ["abc123", "def456"] or comma-separated: "abc123, def456"</description>
|
|
181
|
+
</parameter>
|
|
182
|
+
</parameters>
|
|
183
|
+
<returns type="Dict[str, Any]">
|
|
184
|
+
<description>Response containing: - marked_pending: List of IDs marked pending - marked_count: Number marked - todos: Full sorted list - errors: Any failures</description>
|
|
185
|
+
</returns>
|
|
186
|
+
<examples>
|
|
187
|
+
# Mark single todo pending
|
|
188
|
+
<function=mark_todo_pending>
|
|
189
|
+
<parameter=todo_id>abc123</parameter>
|
|
190
|
+
</function>
|
|
191
|
+
|
|
192
|
+
# Mark multiple todos pending in ONE call
|
|
193
|
+
<function=mark_todo_pending>
|
|
194
|
+
<parameter=todo_ids>["abc123", "def456"]</parameter>
|
|
195
|
+
</function>
|
|
196
|
+
</examples>
|
|
197
|
+
</tool>
|
|
198
|
+
|
|
199
|
+
<tool name="delete_todo">
|
|
200
|
+
<description>Delete one or multiple todos in a single call.</description>
|
|
201
|
+
<details>Use this to remove todos that are no longer relevant. Supports bulk deletion to save tool calls.</details>
|
|
202
|
+
<parameters>
|
|
203
|
+
<parameter name="todo_id" type="string" required="false">
|
|
204
|
+
<description>ID of a single todo to delete</description>
|
|
205
|
+
</parameter>
|
|
206
|
+
<parameter name="todo_ids" type="string" required="false">
|
|
207
|
+
<description>Delete multiple todos at once. JSON array of IDs: ["abc123", "def456"] or comma-separated: "abc123, def456"</description>
|
|
208
|
+
</parameter>
|
|
209
|
+
</parameters>
|
|
210
|
+
<returns type="Dict[str, Any]">
|
|
211
|
+
<description>Response containing: - deleted: List of deleted IDs - deleted_count: Number deleted - todos: Remaining todos - errors: Any failures</description>
|
|
212
|
+
</returns>
|
|
213
|
+
<examples>
|
|
214
|
+
# Delete single todo
|
|
215
|
+
<function=delete_todo>
|
|
216
|
+
<parameter=todo_id>abc123</parameter>
|
|
217
|
+
</function>
|
|
218
|
+
|
|
219
|
+
# Delete multiple todos in ONE call
|
|
220
|
+
<function=delete_todo>
|
|
221
|
+
<parameter=todo_ids>["abc123", "def456", "ghi789"]</parameter>
|
|
222
|
+
</function>
|
|
223
|
+
</examples>
|
|
224
|
+
</tool>
|
|
225
|
+
</tools>
|
strix/utils/__init__.py
ADDED
|
File without changes
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
import sys
|
|
2
|
+
from pathlib import Path
|
|
3
|
+
|
|
4
|
+
|
|
5
|
+
def get_strix_resource_path(*parts: str) -> Path:
|
|
6
|
+
frozen_base = getattr(sys, "_MEIPASS", None)
|
|
7
|
+
if frozen_base:
|
|
8
|
+
base = Path(frozen_base) / "strix"
|
|
9
|
+
if base.exists():
|
|
10
|
+
return base.joinpath(*parts)
|
|
11
|
+
|
|
12
|
+
base = Path(__file__).resolve().parent.parent
|
|
13
|
+
return base.joinpath(*parts)
|
|
@@ -1,8 +1,9 @@
|
|
|
1
|
-
Metadata-Version: 2.
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
2
|
Name: strix-agent
|
|
3
|
-
Version: 0.
|
|
3
|
+
Version: 0.6.2
|
|
4
4
|
Summary: Open-source AI Hackers for your apps
|
|
5
5
|
License: Apache-2.0
|
|
6
|
+
License-File: LICENSE
|
|
6
7
|
Keywords: cybersecurity,security,vulnerability,scanner,pentest,agent,ai,cli
|
|
7
8
|
Author: Strix
|
|
8
9
|
Author-email: hi@usestrix.com
|
|
@@ -16,77 +17,91 @@ Classifier: Programming Language :: Python
|
|
|
16
17
|
Classifier: Programming Language :: Python :: 3
|
|
17
18
|
Classifier: Programming Language :: Python :: 3.12
|
|
18
19
|
Classifier: Programming Language :: Python :: 3.13
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.14
|
|
19
21
|
Classifier: Programming Language :: Python :: 3 :: Only
|
|
20
22
|
Classifier: Topic :: Security
|
|
23
|
+
Provides-Extra: sandbox
|
|
24
|
+
Provides-Extra: vertex
|
|
25
|
+
Requires-Dist: cvss (>=3.2,<4.0)
|
|
26
|
+
Requires-Dist: defusedxml (>=0.7.1,<0.8.0)
|
|
21
27
|
Requires-Dist: docker (>=7.1.0,<8.0.0)
|
|
22
|
-
Requires-Dist: fastapi
|
|
23
|
-
Requires-Dist:
|
|
24
|
-
Requires-Dist:
|
|
25
|
-
Requires-Dist:
|
|
26
|
-
Requires-Dist:
|
|
27
|
-
Requires-Dist:
|
|
28
|
-
Requires-Dist:
|
|
29
|
-
Requires-Dist: openhands-aci (>=0.3.0,<0.4.0)
|
|
30
|
-
Requires-Dist: playwright (>=1.48.0,<2.0.0)
|
|
28
|
+
Requires-Dist: fastapi ; extra == "sandbox"
|
|
29
|
+
Requires-Dist: google-cloud-aiplatform (>=1.38) ; extra == "vertex"
|
|
30
|
+
Requires-Dist: gql[requests] (>=3.5.3,<4.0.0) ; extra == "sandbox"
|
|
31
|
+
Requires-Dist: ipython (>=9.3.0,<10.0.0) ; extra == "sandbox"
|
|
32
|
+
Requires-Dist: libtmux (>=0.46.2,<0.47.0) ; extra == "sandbox"
|
|
33
|
+
Requires-Dist: litellm[proxy] (>=1.80.7,<1.81.0)
|
|
34
|
+
Requires-Dist: numpydoc (>=1.8.0,<2.0.0) ; extra == "sandbox"
|
|
35
|
+
Requires-Dist: openhands-aci (>=0.3.0,<0.4.0) ; extra == "sandbox"
|
|
36
|
+
Requires-Dist: playwright (>=1.48.0,<2.0.0) ; extra == "sandbox"
|
|
31
37
|
Requires-Dist: pydantic[email] (>=2.11.3,<3.0.0)
|
|
32
|
-
Requires-Dist: pyte (>=0.8.1,<0.9.0)
|
|
38
|
+
Requires-Dist: pyte (>=0.8.1,<0.9.0) ; extra == "sandbox"
|
|
33
39
|
Requires-Dist: requests (>=2.32.0,<3.0.0)
|
|
34
40
|
Requires-Dist: rich
|
|
35
41
|
Requires-Dist: tenacity (>=9.0.0,<10.0.0)
|
|
36
42
|
Requires-Dist: textual (>=4.0.0,<5.0.0)
|
|
37
|
-
Requires-Dist: uvicorn
|
|
43
|
+
Requires-Dist: uvicorn ; extra == "sandbox"
|
|
38
44
|
Requires-Dist: xmltodict (>=0.13.0,<0.14.0)
|
|
39
45
|
Description-Content-Type: text/markdown
|
|
40
46
|
|
|
41
47
|
<p align="center">
|
|
42
|
-
<a href="https://
|
|
43
|
-
<img src=".github/
|
|
48
|
+
<a href="https://strix.ai/">
|
|
49
|
+
<img src="https://github.com/usestrix/.github/raw/main/imgs/cover.png" alt="Strix Banner" width="100%">
|
|
44
50
|
</a>
|
|
45
51
|
</p>
|
|
46
52
|
|
|
47
|
-
<
|
|
53
|
+
<div align="center">
|
|
48
54
|
|
|
49
|
-
|
|
55
|
+
# Strix
|
|
50
56
|
|
|
51
|
-
|
|
57
|
+
### Open-source AI hackers to find and fix your app’s vulnerabilities.
|
|
58
|
+
|
|
59
|
+
<br/>
|
|
60
|
+
|
|
61
|
+
|
|
62
|
+
<a href="https://docs.strix.ai"><img src="https://img.shields.io/badge/Docs-docs.strix.ai-2b9246?style=for-the-badge&logo=gitbook&logoColor=white" alt="Docs"></a>
|
|
63
|
+
<a href="https://strix.ai"><img src="https://img.shields.io/badge/Website-strix.ai-3b82f6?style=for-the-badge&logoColor=white" alt="Website"></a>
|
|
64
|
+
<a href="https://pypi.org/project/strix-agent/"><img src="https://img.shields.io/badge/PyPI-strix--agent-f59e0b?style=for-the-badge&logo=pypi&logoColor=white" alt="PyPI"></a>
|
|
52
65
|
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
66
|
+
<a href="https://deepwiki.com/usestrix/strix"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a>
|
|
67
|
+
<a href="https://github.com/usestrix/strix"><img src="https://img.shields.io/github/stars/usestrix/strix?style=flat-square" alt="GitHub Stars"></a>
|
|
68
|
+
<a href="LICENSE"><img src="https://img.shields.io/badge/License-Apache%202.0-3b82f6?style=flat-square" alt="License"></a>
|
|
69
|
+
<a href="https://pypi.org/project/strix-agent/"><img src="https://img.shields.io/pypi/v/strix-agent?style=flat-square" alt="PyPI Version"></a>
|
|
57
70
|
|
|
58
|
-
[](https://github.com/usestrix/strix)
|
|
59
|
-
[](https://discord.gg/YjKFvEZSdZ)
|
|
60
|
-
[](https://usestrix.com)
|
|
61
71
|
|
|
62
|
-
<a href="https://
|
|
72
|
+
<a href="https://discord.gg/YjKFvEZSdZ"><img src="https://github.com/usestrix/.github/raw/main/imgs/Discord.png" height="40" alt="Join Discord"></a>
|
|
73
|
+
<a href="https://x.com/strix_ai"><img src="https://github.com/usestrix/.github/raw/main/imgs/X.png" height="40" alt="Follow on X"></a>
|
|
74
|
+
|
|
75
|
+
|
|
76
|
+
<a href="https://trendshift.io/repositories/15362" target="_blank"><img src="https://trendshift.io/api/badge/repositories/15362" alt="usestrix/strix | Trendshift" width="250" height="55"/></a>
|
|
63
77
|
|
|
64
78
|
</div>
|
|
65
79
|
|
|
66
|
-
<br
|
|
80
|
+
<br/>
|
|
67
81
|
|
|
68
82
|
<div align="center">
|
|
69
|
-
<img src=".github/screenshot.png" alt="Strix Demo" width="
|
|
83
|
+
<img src=".github/screenshot.png" alt="Strix Demo" width="900" style="border-radius: 16px;">
|
|
70
84
|
</div>
|
|
71
85
|
|
|
72
86
|
<br>
|
|
73
87
|
|
|
74
88
|
> [!TIP]
|
|
75
|
-
> **New!** Strix
|
|
89
|
+
> **New!** Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches production!
|
|
76
90
|
|
|
77
91
|
---
|
|
78
92
|
|
|
79
|
-
|
|
93
|
+
|
|
94
|
+
## Strix Overview
|
|
80
95
|
|
|
81
96
|
Strix are autonomous AI agents that act just like real hackers - they run your code dynamically, find vulnerabilities, and validate them through actual proof-of-concepts. Built for developers and security teams who need fast, accurate security testing without the overhead of manual pentesting or the false positives of static analysis tools.
|
|
82
97
|
|
|
83
98
|
**Key Capabilities:**
|
|
84
99
|
|
|
85
|
-
-
|
|
86
|
-
-
|
|
87
|
-
-
|
|
88
|
-
-
|
|
89
|
-
-
|
|
100
|
+
- **Full hacker toolkit** out of the box
|
|
101
|
+
- **Teams of agents** that collaborate and scale
|
|
102
|
+
- **Real validation** with PoCs, not false positives
|
|
103
|
+
- **Developer‑first** CLI with actionable reports
|
|
104
|
+
- **Auto‑fix & reporting** to accelerate remediation
|
|
90
105
|
|
|
91
106
|
|
|
92
107
|
## 🎯 Use Cases
|
|
@@ -102,13 +117,15 @@ Strix are autonomous AI agents that act just like real hackers - they run your c
|
|
|
102
117
|
|
|
103
118
|
**Prerequisites:**
|
|
104
119
|
- Docker (running)
|
|
105
|
-
- Python 3.12+
|
|
106
120
|
- An LLM provider key (e.g. [get OpenAI API key](https://platform.openai.com/api-keys) or use a local LLM)
|
|
107
121
|
|
|
108
122
|
### Installation & First Scan
|
|
109
123
|
|
|
110
124
|
```bash
|
|
111
125
|
# Install Strix
|
|
126
|
+
curl -sSL https://strix.ai/install | bash
|
|
127
|
+
|
|
128
|
+
# Or via pipx
|
|
112
129
|
pipx install strix-agent
|
|
113
130
|
|
|
114
131
|
# Configure your AI provider
|
|
@@ -122,9 +139,9 @@ strix --target ./app-directory
|
|
|
122
139
|
> [!NOTE]
|
|
123
140
|
> First run automatically pulls the sandbox Docker image. Results are saved to `strix_runs/<run-name>`
|
|
124
141
|
|
|
125
|
-
##
|
|
142
|
+
## Run Strix in Cloud
|
|
126
143
|
|
|
127
|
-
Want to skip the local setup, API keys, and unpredictable LLM costs? Run the hosted cloud version of Strix at **[app.
|
|
144
|
+
Want to skip the local setup, API keys, and unpredictable LLM costs? Run the hosted cloud version of Strix at **[app.strix.ai](https://strix.ai)**.
|
|
128
145
|
|
|
129
146
|
Launch a scan in just a few minutes—no setup or configuration required—and you’ll get:
|
|
130
147
|
|
|
@@ -133,13 +150,13 @@ Launch a scan in just a few minutes—no setup or configuration required—and y
|
|
|
133
150
|
- **CI/CD and GitHub integrations** to block risky changes before production
|
|
134
151
|
- **Continuous monitoring** so new vulnerabilities are caught quickly
|
|
135
152
|
|
|
136
|
-
[**Run your first pentest now →**](https://
|
|
153
|
+
[**Run your first pentest now →**](https://strix.ai)
|
|
137
154
|
|
|
138
155
|
---
|
|
139
156
|
|
|
140
157
|
## ✨ Features
|
|
141
158
|
|
|
142
|
-
###
|
|
159
|
+
### Agentic Security Tools
|
|
143
160
|
|
|
144
161
|
Strix agents come equipped with a comprehensive security testing toolkit:
|
|
145
162
|
|
|
@@ -151,7 +168,7 @@ Strix agents come equipped with a comprehensive security testing toolkit:
|
|
|
151
168
|
- **Code Analysis** - Static and dynamic analysis capabilities
|
|
152
169
|
- **Knowledge Management** - Structured findings and attack documentation
|
|
153
170
|
|
|
154
|
-
###
|
|
171
|
+
### Comprehensive Vulnerability Detection
|
|
155
172
|
|
|
156
173
|
Strix can identify and validate a wide range of security vulnerabilities:
|
|
157
174
|
|
|
@@ -163,7 +180,7 @@ Strix can identify and validate a wide range of security vulnerabilities:
|
|
|
163
180
|
- **Authentication** - JWT vulnerabilities, session management
|
|
164
181
|
- **Infrastructure** - Misconfigurations, exposed services
|
|
165
182
|
|
|
166
|
-
###
|
|
183
|
+
### Graph of Agents
|
|
167
184
|
|
|
168
185
|
Advanced multi-agent orchestration for comprehensive security testing:
|
|
169
186
|
|
|
@@ -173,7 +190,7 @@ Advanced multi-agent orchestration for comprehensive security testing:
|
|
|
173
190
|
|
|
174
191
|
---
|
|
175
192
|
|
|
176
|
-
##
|
|
193
|
+
## Usage Examples
|
|
177
194
|
|
|
178
195
|
### Basic Usage
|
|
179
196
|
|
|
@@ -199,9 +216,12 @@ strix -t https://github.com/org/app -t https://your-app.com
|
|
|
199
216
|
|
|
200
217
|
# Focused testing with custom instructions
|
|
201
218
|
strix --target api.your-app.com --instruction "Focus on business logic flaws and IDOR vulnerabilities"
|
|
219
|
+
|
|
220
|
+
# Provide detailed instructions through file (e.g., rules of engagement, scope, exclusions)
|
|
221
|
+
strix --target api.your-app.com --instruction-file ./instruction.md
|
|
202
222
|
```
|
|
203
223
|
|
|
204
|
-
###
|
|
224
|
+
### Headless Mode
|
|
205
225
|
|
|
206
226
|
Run Strix programmatically without interactive UI using the `-n/--non-interactive` flag—perfect for servers and automated jobs. The CLI prints real-time vulnerability findings, and the final report before exiting. Exits with non-zero code when vulnerabilities are found.
|
|
207
227
|
|
|
@@ -209,7 +229,7 @@ Run Strix programmatically without interactive UI using the `-n/--non-interactiv
|
|
|
209
229
|
strix -n --target https://your-app.com
|
|
210
230
|
```
|
|
211
231
|
|
|
212
|
-
###
|
|
232
|
+
### CI/CD (GitHub Actions)
|
|
213
233
|
|
|
214
234
|
Strix can be added to your pipeline to run a security test on pull requests with a lightweight GitHub Actions workflow:
|
|
215
235
|
|
|
@@ -223,20 +243,20 @@ jobs:
|
|
|
223
243
|
security-scan:
|
|
224
244
|
runs-on: ubuntu-latest
|
|
225
245
|
steps:
|
|
226
|
-
- uses: actions/checkout@
|
|
246
|
+
- uses: actions/checkout@v6
|
|
227
247
|
|
|
228
248
|
- name: Install Strix
|
|
229
|
-
run:
|
|
249
|
+
run: curl -sSL https://strix.ai/install | bash
|
|
230
250
|
|
|
231
251
|
- name: Run Strix
|
|
232
252
|
env:
|
|
233
253
|
STRIX_LLM: ${{ secrets.STRIX_LLM }}
|
|
234
254
|
LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
|
|
235
255
|
|
|
236
|
-
run: strix -n -t ./
|
|
256
|
+
run: strix -n -t ./ --scan-mode quick
|
|
237
257
|
```
|
|
238
258
|
|
|
239
|
-
###
|
|
259
|
+
### Configuration
|
|
240
260
|
|
|
241
261
|
```bash
|
|
242
262
|
export STRIX_LLM="openai/gpt-5"
|
|
@@ -245,36 +265,41 @@ export LLM_API_KEY="your-api-key"
|
|
|
245
265
|
# Optional
|
|
246
266
|
export LLM_API_BASE="your-api-base-url" # if using a local model, e.g. Ollama, LMStudio
|
|
247
267
|
export PERPLEXITY_API_KEY="your-api-key" # for search capabilities
|
|
268
|
+
export STRIX_REASONING_EFFORT="high" # control thinking effort (default: high, quick scan: medium)
|
|
248
269
|
```
|
|
249
270
|
|
|
250
|
-
|
|
271
|
+
> [!NOTE]
|
|
272
|
+
> Strix automatically saves your configuration to `~/.strix/cli-config.json`, so you don't have to re-enter it on every run.
|
|
273
|
+
|
|
274
|
+
**Recommended models for best results:**
|
|
251
275
|
|
|
252
|
-
|
|
276
|
+
- [OpenAI GPT-5](https://openai.com/api/) — `openai/gpt-5`
|
|
277
|
+
- [Anthropic Claude Sonnet 4.5](https://claude.com/platform/api) — `anthropic/claude-sonnet-4-5`
|
|
278
|
+
- [Google Gemini 3 Pro Preview](https://cloud.google.com/vertex-ai) — `vertex_ai/gemini-3-pro-preview`
|
|
253
279
|
|
|
254
|
-
|
|
280
|
+
See the [LLM Providers documentation](https://docs.strix.ai/llm-providers/overview) for all supported providers including Vertex AI, Bedrock, Azure, and local models.
|
|
255
281
|
|
|
256
|
-
|
|
257
|
-
See our [Contributing Guide](CONTRIBUTING.md) for details on:
|
|
258
|
-
- Setting up your development environment
|
|
259
|
-
- Running tests and quality checks
|
|
260
|
-
- Submitting pull requests
|
|
261
|
-
- Code style guidelines
|
|
282
|
+
## Documentation
|
|
262
283
|
|
|
284
|
+
Full documentation is available at **[docs.strix.ai](https://docs.strix.ai)** — including detailed guides for usage, CI/CD integrations, skills, and advanced configuration.
|
|
263
285
|
|
|
264
|
-
|
|
265
|
-
Help expand our collection of specialized prompt modules for AI agents:
|
|
266
|
-
- Advanced testing techniques for vulnerabilities, frameworks, and technologies
|
|
267
|
-
- See [Prompt Modules Documentation](strix/prompts/README.md) for guidelines
|
|
268
|
-
- Submit via [pull requests](https://github.com/usestrix/strix/pulls) or [issues](https://github.com/usestrix/strix/issues)
|
|
286
|
+
## Contributing
|
|
269
287
|
|
|
270
|
-
|
|
288
|
+
We welcome contributions of code, docs, and new skills - check out our [Contributing Guide](https://docs.strix.ai/contributing) to get started or open a [pull request](https://github.com/usestrix/strix/pulls)/[issue](https://github.com/usestrix/strix/issues).
|
|
289
|
+
|
|
290
|
+
## Join Our Community
|
|
271
291
|
|
|
272
292
|
Have questions? Found a bug? Want to contribute? **[Join our Discord!](https://discord.gg/YjKFvEZSdZ)**
|
|
273
293
|
|
|
274
|
-
##
|
|
294
|
+
## Support the Project
|
|
275
295
|
|
|
276
296
|
**Love Strix?** Give us a ⭐ on GitHub!
|
|
277
297
|
|
|
298
|
+
## Acknowledgements
|
|
299
|
+
|
|
300
|
+
Strix builds on the incredible work of open-source projects like [LiteLLM](https://github.com/BerriAI/litellm), [Caido](https://github.com/caido/caido), [Nuclei](https://github.com/projectdiscovery/nuclei), [Playwright](https://github.com/microsoft/playwright), and [Textual](https://github.com/Textualize/textual). Huge thanks to their maintainers!
|
|
301
|
+
|
|
302
|
+
|
|
278
303
|
> [!WARNING]
|
|
279
304
|
> Only test apps you own or have permission to test. You are responsible for using Strix ethically and legally.
|
|
280
305
|
|