# Strix

> Draft · awaiting review.

> Autonomous AI penetration-testing agents that run offensive tools in a container sandbox and validate findings with a proof of concept.

- Badge: `reach 3 · not run yet`
- Type: Agent; tier: not run yet
- Tasks: Web and API testing; mission: Offensive; works with: Standalone (own model access)
- Source: https://github.com/usestrix/strix, pinned to `55bc079` (v1.7.0), licence Apache-2.0
- Last checked: 2026-10-19; next check: 2027-01-17; method v0.1, reach-v0.1

## At a glance

- **What it is:** Autonomous AI penetration-testing agents that run your code dynamically, find vulnerabilities and validate them through proofs of concept. An agent is a program with its own model access that works through a task on its own.
- **Made for:** Security testing for developers and security teams as an alternative to manual pentesting and static-analysis scanners.
- **Runs:** On your machine, started by you. Other modes: headless; managed cloud (on the vendor's servers). Listens by default: Caido listens on 0.0.0.0 at port ${CAIDO_PORT} inside the sandbox container (sign-in not read); 4 listeners in all.
- **Sends data to:** LLM provider (always), targets you name (always), PostHog (by default), Scarf (by default), Perplexity (if you turn it on), PyPI (by default), Strix Cloud (app.strix.ai) (if you turn it on), ghcr.io (by default). Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Changes, runs commands, sends data out, according to the capabilities read. Partly listed: The managed cloud CLI (strix cloud) and the local web viewer (strix view) are separate product surfaces, not agent tools, and are not listed as capability groups.
- **Needs:** Docker installed and running to host the sandbox container · An LLM API key from a supported provider (OpenAI, Anthropic, Google, etc.) · Authorization to test the target systems

Profile read at commit `55bc079` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

Autonomous AI penetration-testing agents that run your code dynamically, find vulnerabilities and validate them through proofs of concept. (README.md#L46)

Made for (the author says):

- Security testing for developers and security teams as an alternative to manual pentesting and static-analysis scanners. (README.md#L46)

Documented uses:

- Detect and validate critical vulnerabilities in an application [Web and API testing] (README.md#L69)
- Automate bug-bounty research and generate proof-of-concept exploits [Finding validation] (README.md#L71)
- Run scans in CI/CD to block vulnerable code before it reaches production [Code review and static analysis (SAST)] (README.md#L72)
- Review source code white-box and exploit findings for a proof-of-concept [Code review and static analysis (SAST)] (skills/find-security-vulnerabilities-in-code/SKILL.md#L12)

Not for (the author says):

- Run it only against systems you own or have explicit, written permission to test, and stay within the agreed scope. (README.md#L374)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| shell (exec_command / write_stdin) | Runs shell commands and programs in the sandbox (nmap, ffuf, python3, agent-browser) through exec_command and write_stdin. (strix/tools/shell/README.md#L2-4) | reads, changes, runs commands, sends data out | yes |
| apply_patch | Edits files in the sandbox through apply_patch, the agent's only first-class file-editing tool. (strix/tools/apply_patch/README.md#L2-3) | changes | yes |
| HTTP Interception Proxy | Manipulates and analyses HTTP requests and responses through the Caido interception proxy. (README.md#L147) | reads, changes, sends data out | yes |
| Browser Exploitation | Runs an automated browser for testing XSS, CSRF, clickjacking and auth bypass flows. (README.md#L148) | reads, runs commands, sends data out | yes |
| web_search | Runs real-time web searches through Exa or Perplexity (web_search). (strix/tools/web_search/tool.py#L321) | reads, sends data out | no |
| Vulnerability Knowledge Base | Structures findings with CVSS scoring and OWASP classification. (README.md#L153) | reads, changes | yes |
| Multi-agent orchestration | Runs teams of AI pentester agents that collaborate and scale. (README.md#L51) | reads, changes | yes |
| MCP connectors | Connects to user-listed MCP servers (stdio or http) and calls their tools during a run (list_mcps, call_mcp). (README.md#L325) | reads, runs commands, sends data out | no |
| threat_model | Gives the agents threat-model tools from strix.tools.threat_model. (strix/agents/factory.py#L65) | reads, changes | yes |

Partly listed: The managed cloud CLI (strix cloud) and the local web viewer (strix view) are separate product surfaces, not agent tools, and are not listed as capability groups.

## How it runs

The code is split into strix/agents (agent graph and prompts), strix/tools (proxy, browser, terminal, scanners), strix/runtime (Docker sandbox), strix/report (findings, SARIF), strix/interface (CLI/TUI) and containers/ (sandbox image). (AGENTS.md#L68)

- Starts: On your machine, started by you. You run the strix CLI yourself; by default it opens an interactive TUI that then launches the sandbox. (strix/interface/cli_args.py#L190)
- Can also run: On your machine, started by you (headless, switch `-n/--non-interactive`). Non-interactive mode runs without the TUI and exits on completion. (strix/interface/cli_args.py#L188-191)
- Can also run: On the vendor's servers (managed cloud, switch `strix cloud`). The managed cloud runs scans on app.strix.ai with no local Docker or LLM key. (README.md#L310)
- Your machine: **strix CLI / TUI**: The strix command-line / TUI that configures and launches a scan. (pyproject.toml#L58)
- Container on your machine: **Kali sandbox container**: A Kali Linux Docker container where the agents run offensive tools. (containers/Dockerfile#L25)
- Container on your machine: **Caido proxy**: A Caido instance the sandbox entrypoint starts inside the container, listening on port ${CAIDO_PORT}. (containers/docker-entrypoint.sh#L41)
- Container on your machine: **Kali sandbox container**: The sandbox image installs nmap, sqlmap, nuclei, subfinder, naabu and ffuf. (containers/Dockerfile#L54-55)
- Container on your machine: **Kali sandbox container**: The sandbox image installs the secret scanners trufflehog and gitleaks. (containers/Dockerfile#L180-189)
- Outside your machine: **LLM provider**: A model provider the agents call with the user's API key. (README.md#L78)
- Outside your machine: **Target systems**: The systems under test: URLs, repos, domains, IPs, or API specs. (strix/interface/cli_args.py#L137)
- Outside your machine: **Strix Cloud / relay**: The Strix Cloud platform and viewer relay at app.strix.ai. (strix/config/settings.py#L198)
- Listens: Caido listens on 0.0.0.0 at port ${CAIDO_PORT} inside the sandbox container.: all network interfaces, sign-in not read, by default (containers/docker-entrypoint.sh#L41)
- Listens: strix view binds to 127.0.0.1 by default; --host 0.0.0.0 serves it on all IPv4 interfaces.: an address you choose, sign-in not read, in an optional mode (strix/interface/viewer/cli.py#L51)
- Listens: The ChatGPT OAuth login uses a callback on localhost port 1455.: this machine only (loopback), sign-in not read, in an optional mode (strix/config/codex.py#L44-45)
- Listens: Ports the sandbox container exposes are published on the host bound to 127.0.0.1, on a port Docker picks.: this machine only (loopback), sign-in not read, by default (strix/runtime/docker_client.py#L217-219)
- Sends data to LLM provider (model provider, always): Agents send prompts to the configured model provider with the user's key. (README.md#L78)
- Sends data to targets you name (your targets, always): Sends test traffic to the targets passed with --target. (strix/interface/cli_args.py#L137)
- Sends data to PostHog (telemetry, by default): Sends telemetry events to PostHog at https://us.i.posthog.com. (strix/telemetry/posthog.py#L26)
- Sends data to Scarf (telemetry, by default): Sends telemetry events to Scarf at https://strix.gateway.scarf.sh. (strix/telemetry/scarf.py#L29)
- Sends data to Perplexity (vendor API, if you turn it on): Sends web-search queries to the Perplexity chat completions API at api.perplexity.ai. (strix/tools/web_search/tool.py#L50)
- Sends data to PyPI (other, by default): Queries the PyPI JSON API for the latest strix-agent version. (strix/interface/update_check.py#L108)
- Sends data to Strix Cloud (app.strix.ai) (vendor API, if you turn it on): Uses https://app.strix.ai as the default Strix relay URL (STRIX_APP_URL). (strix/config/settings.py#L198)
- Sends data to ghcr.io (download, by default): The installer names the sandbox image ghcr.io/usestrix/strix-sandbox:1.3.0. (scripts/install.sh#L7)
- Sends data to Strix Cloud (app.strix.ai) (vendor API, if you turn it on): strix cloud scans start --source uploads local code to app.strix.ai for a managed scan; --yes approves the upload. (README.md#L310-314)

## What you need

- Container runtime: Docker installed and running to host the sandbox container. (scripts/install.sh#L181)
- Model key: An LLM API key from a supported provider (OpenAI, Anthropic, Google, etc.). (README.md#L78)
- Authorisation: Authorization to test the target systems. (README.md#L374)
- Installer: The documented install pipes the script at https://strix.ai/install into bash. (README.md#L84)
- Installer: The installer removes an older pipx install of strix-agent when it finds one. (scripts/install.sh#L120)
- Installer: The installer appends a '# strix' comment line to the detected shell config file. (scripts/install.sh#L216)
- Installer: Besides an old pipx install, the installer deletes any other strix file or symlink it finds on PATH. (scripts/install.sh#L117-125)
- Installer: The installer appends a line that puts its install directory on PATH (export PATH, or fish_add_path for fish) to the detected shell config file. (scripts/install.sh#L264-270)

## Limits and risks

- The sandbox user has passwordless sudo. (containers/Dockerfile#L36)
- The sandbox container is created with the NET_ADMIN and NET_RAW capabilities. (strix/runtime/docker_client.py#L228)
- A local directory target is bind-mounted into the sandbox writable, so agents can modify it. (strix/interface/cli_args.py#L140)
- Telemetry is enabled by default via the STRIX_TELEMETRY setting. (strix/config/settings.py#L151)
- strix view binds to 127.0.0.1 and prints a tokened link that grants access to the run; the author says to share it carefully. (README.md#L193)
- Without a VERSION setting, the installer looks up the latest usestrix/strix release tag through the GitHub API and installs that release. (scripts/install.sh#L77)
- The tokened strix view link authorizes the browser; anyone it is shared with can steer a live scan and browse run history. (strix/interface/viewer/cli.py#L96-97)
- The sandbox container resolves host.docker.internal to the Docker host gateway, which gives it a network path to the host machine. (strix/runtime/docker_client.py#L232-233)
- --max-budget sets a maximum LLM cost in USD at which the scan stops; the flag defaults to None. (strix/interface/cli_args.py#L278-287)

## Rights in plain language

- Declared: files 2 (writes outside the project), network 2 (talks to any host), execution 2 (runs shell commands or eval), secrets 1 (uses one scoped token), persistence 2 (changes config or installs globally), approval 2 (has broad pre-approvals).
- Code: reach 3 (privileged): files 2 (writes outside the project), network 3 (can tunnel or exfiltrate), execution 3 (uses sudo or the docker socket), secrets 2 (reads broad tokens or the environment), persistence 3 (adds autostart, users or keys), approval 2 (has broad pre-approvals).
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 3 (privileged).

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | 2 writes outside the project | 2 writes outside the project | not run yet |
| Network: whom does it talk to? | 2 talks to any host | 3 can tunnel or exfiltrate | not run yet |
| Execution: what does it run? | 2 runs shell commands or eval | 3 uses sudo or the docker socket | not run yet |
| Secrets: which credentials does it touch? | 1 uses one scoped token | 2 reads broad tokens or the environment | not run yet |
| Persistence: what survives the run? | 2 changes config or installs globally | 3 adds autostart, users or keys | not run yet |
| Approval: does it ask before acting? | 2 has broad pre-approvals | 2 has broad pre-approvals | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream (linked)

Quoted from `README.md#L84-91` at the pinned commit (not a command to copy): `curl -sSL https://strix.ai/install | bash
export STRIX_LLM="openrouter/z-ai/glm-5.3"
strix --target ./app-directory`


### Run it with least privilege

- note: `derived from the code, not tested in the lab; run only against authorised targets, keep execution inside the Docker sandbox, and set STRIX_TELEMETRY=0 to turn off the default telemetry`

- derived, not tested: proposed from the code analysis

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does Strix declare?**

files 2 (writes outside the project), network 2 (talks to any host), execution 2 (runs shell commands or eval), secrets 1 (uses one scoped token), persistence 2 (changes config or installs globally), approval 2 (has broad pre-approvals).

**What does its code suggest?**

reach 3 (privileged): files 2 (writes outside the project), network 3 (can tunnel or exfiltrate), execution 3 (uses sudo or the docker socket), secrets 2 (reads broad tokens or the environment), persistence 3 (adds autostart, users or keys), approval 2 (has broad pre-approvals).

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-10-18; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: note: derived from the code, not tested in the lab; run only against authorised targets, keep execution inside the Docker sandbox, and set STRIX_TELEMETRY=0 to turn off the default telemetry

Method: https://readbeforerun.ai/method/