ReadBeforeRunAgentic Security Field Guide

Catalog / Agent

Strix

Draft · awaiting review

Autonomous AI penetration-testing agents that run offensive tools in a container sandbox and validate findings with a proof of concept.

Experimental: The package metadata marks the project as alpha. pyproject.toml L22

For Web and API testingWorks with Standalone (own model access)Maintained usestrix, last push 2026-10-18

AgentAn agent is a program with its own model access that works through a task on its own. by usestrix · read from the code at 55bc079 (v1.7.0) on 2026-10-19The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

  1. Network. The sandbox runs the Caido HTTP interception proxy as a listener on all interfaces, beyond contacting target URLs.

    docker-entrypoint.sh L41 · docker_client.py L217-220

  2. Execution. The agent user is given passwordless sudo inside the sandbox on top of a free shell.

    Dockerfile L36

  3. Persistence. The installer appends a PATH export to the user's shell rc file, a persistence vector.

    install.sh L213-218

  4. Files. A user-chosen host directory is bind-mounted writable into the sandbox.

    SKILL.md L83

  5. Secrets. Reads several provider API-key environment variables.

    settings.py L38-189

  6. Approval. The skill instructs agents to always run the headless mode, which executes without per-step approval.

    SKILL.md L57

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

  1. Run only against authorised targets, keep execution inside the Docker sandbox, and set STRIX_TELEMETRY=0 to turn off the default telemetry.

What we checked, and what we foundDisagree?

Agent · code showsreach 3 · privileged
233232FilesNetworkExecutionSecretsPersistenceApproval

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for

Security testing for developers and security teams as an alternative to manual pentesting and static-analysis scanners.

Use it when
Not for

Run it only against systems you own or have explicit, written permission to test, and stay within the agreed scope.

You need
  • Docker installed and running to host the sandbox container
  • An LLM API key from a supported provider (OpenAI, Anthropic, Google, etc.)
  • Authorization to test the target systems
Details

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream (linked)

curl -sSL https://strix.ai/install | bash export STRIX_LLM="openrouter/z-ai/glm-5.3" strix --target ./app-directory
Quoted from README.md#L84-91 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

note
derived from the code, not tested in the lab; run only against authorised targets, keep execution inside the Docker sandbox, and set STRIX_TELEMETRY=0 to turn off the default telemetry

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.MarkdownJSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit 55bc079 on 2026-10-25: 63 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, runs commands, sends data out, according to the capabilities read.

The author states the repo publishes nine consumer skills for coding agents. README.md L135

Partly listed: The managed cloud CLI (strix cloud) and the local web viewer (strix view) are separate product surfaces, not agent tools, and are not listed as capability groups.

GroupWhat it coversEffectOn by default
shell (exec_command / write_stdin)Runs shell commands and programs in the sandbox (nmap, ffuf, python3, agent-browser) through exec_command and write_stdin. README.md L2-4reads, changes, runs commands, sends data outyes
Browser ExploitationRuns an automated browser for testing XSS, CSRF, clickjacking and auth bypass flows. README.md L148reads, runs commands, sends data outyes
MCP connectorsConnects to user-listed MCP servers (stdio or http) and calls their tools during a run (list_mcps, call_mcp). README.md L325reads, runs commands, sends data outno, optional
HTTP Interception ProxyManipulates and analyses HTTP requests and responses through the Caido interception proxy. README.md L147reads, changes, sends data outyes
web_searchRuns real-time web searches through Exa or Perplexity (web_search). tool.py L321reads, sends data outno, optional
apply_patchEdits files in the sandbox through apply_patch, the agent's only first-class file-editing tool. README.md L2-3changesyes
Vulnerability Knowledge BaseStructures findings with CVSS scoring and OWASP classification. README.md L153reads, changesyes
Multi-agent orchestrationRuns teams of AI pentester agents that collaborate and scale. README.md L51reads, changesyes
threat_modelGives the agents threat-model tools from strix.tools.threat_model. factory.py L65reads, changesyes

Where it sends data and who can connect to it

9 outside connections found in the files read: LLM provider, targets you name, PostHog, Scarf, Perplexity, PyPI, Strix Cloud (app.strix.ai), ghcr.io.

4 listeners in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

The code is split into strix/agents (agent graph and prompts), strix/tools (proxy, browser, terminal, scanners), strix/runtime (Docker sandbox), strix/report (findings, SARIF), strix/interface (CLI/TUI) and containers/ (sandbox image). AGENTS.md L68

Your machine

Programs and files on the machine where you run the tool.

Container on your machine

Parts inside a container that the tool starts on your machine.

Outside your machine

Remote services: vendor APIs, model providers, targets, telemetry endpoints. Data sent here leaves your machine.

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 3 (privileged), read from the code. Not run in our lab yet.

RightAuthor sayswhat the author saysCode showswhat static analysis findsRun showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

  • Files · 2SKILL.md L83 author states a local target path is mounted writable so agents may modify it
  • Network · 2README.md L374 author states Strix sends real traffic to whatever target the user points it at
  • Execution · 2README.md L149 author declares a shell and command-execution capability for the agent
  • Secrets · 1README.md L78 author states one LLM provider API key is needed
  • Persistence · 2README.md L295 author states Strix writes its configuration to the home directory
  • Approval · 2README.md L244 author documents a headless mode that runs with no interactive approval

Code shows: the evidence

  • Files · 2SKILL.md L83 a user-chosen host directory is bind-mounted writable into the sandbox
  • Network · 3docker-entrypoint.sh L41 the sandbox runs the Caido HTTP interception proxy as a listener on all interfaces, beyond contacting target URLs
    docker_client.py L217-220 Docker publishes that port only on host interface 127.0.0.1
  • Execution · 3Dockerfile L36 the agent user is given passwordless sudo inside the sandbox on top of a free shell
  • Secrets · 2settings.py L38-189 reads several provider API-key environment variables
  • Persistence · 3install.sh L213-218 the installer appends a PATH export to the user's shell rc file, a persistence vector
  • Approval · 2SKILL.md L57 the skill instructs agents to always run the headless mode, which executes without per-step approval

Valid for commit 55bc079 (v1.7.0) · checked 2026-10-19 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

What you need and what the documented installer does

KindWhat
AI clientStandalone (own model access)
Container runtimeDocker installed and running to host the sandbox container. install.sh L181
Model keyAn LLM API key from a supported provider (OpenAI, Anthropic, Google, etc.). README.md L78
AuthorisationAuthorization to test the target systems. README.md L374

What the documented installer does

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

AutonomyHow much the tool decides on its own, from 0 (every step is yours) to 5 (runs a whole task unattended), as the author describes it.
level 3 of 5
Source
github.com/usestrix/strix · Apache-2.0 · manifest pyproject.toml
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.
55bc079 · v1.7.0 · last upstream push 2026-10-18 · no release since the pinned commit (current v1.7.0)
In the catalog
listed · added 2026-10-19 · last checked 2026-10-19 · next check 2027-01-17 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.
cisco-skill-scanner: not run, pending
Changes
none since the entry was added on 2026-10-19
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.
v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdownas JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit 55bc079, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit 55bc079 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (63 of 63), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "Strix". Agentic Security Field Guide, checked 2026-10-19, method reach-v0.1. https://readbeforerun.ai/catalog/usestrix-strix/

The method · the rules

For maintainers

Badge for your README (reach 3 · not run yet):

[![reach 3 · not run yet](https://readbeforerun.ai/badge/usestrix-strix.svg)](https://readbeforerun.ai/catalog/usestrix-strix/)

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

Claim the entry with a fieldguide.yaml in your repository: planned.

Other tools for the same task

Task: Web and API testing. The task pages compare every tool side by side.
  1. 21223?
    Webapp Testing ChecklistSkill · by AccessITGroup · reach 3, privilegedDraft · awaiting review

    Agent skill that walks an authorized web application test through the OWASP WSTG checklist and writes a findings report.

    Can add autostart, users or keys · write outside the project · run shell commands or eval · +1 more · Approval: no evidence · not run yet · checked 2026-10-21

    Code shows
  2. 222222
    hackingBuddyGPTAgent · by ipa-lab · reach 2, openDraft · awaiting review

    Open-source framework for building LLM-driven security-testing agents, with use cases for Linux privilege escalation and web API testing.

    Can write outside the project · talk to any host · run shell commands or eval · +3 more · not run yet · checked 2026-10-19

    Code shows
  3. 222123
    ShannonAgent · by KeygraphHQ · reach 3, privilegedDraft · awaiting review

    Autonomous white-box AI penetration tester for web apps and APIs; reports only vulnerabilities it proves by exploitation.

    Can bypass approval · write outside the project · talk to any host · +2 more · not run yet · checked 2026-10-19

    Code shows