🔥 usestrix/strix：开源 AI 渗透测试工具，发现并修复应用漏洞
英文标题：🔥 usestrix/strix
Strix 是一款开源的自主 AI 渗透测试工具，由多智能体编排驱动，可动态运行代码、发现漏洞并生成有效概念验证（PoC），杜绝误报。它提供开发者友好的命令行界面，支持 CI/CD 集成，能在数小时内完成渗透测试并自动生成修复补丁和合规报告。对于开发者和安全团队，Strix 大幅降低了手动渗透测试的成本与复杂性，将安全左移融入软件开发生命周期。
875.2 KB
2.2 KB
617 B
2.5 KB
1.9 KB
741 B
575 B
553 B
6.6 KB
5.4 KB
5.1 KB
1.6 MB
41.8 KB
中文
Tip
新功能！ Strix 与 GitHub Actions 及 CI/CD 流水线无缝集成。每次拉取请求时自动扫描漏洞，阻止不安全代码进入生产环境——无需设置即可开始。
Strix 是自主 AI 渗透测试代理，行为与真实黑客无异——它们会动态运行你的代码，发现漏洞，并通过实际的概念验证（PoC）来证实漏洞。为开发者和安全团队打造，需要快速、准确的安全测试，而无需手动渗透测试的负担或静态分析工具的高误报。
核心能力：
-
完整渗透测试工具箱——开箱即用的信息侦察、漏洞利用和验证
-
多智能体编排——协作与扩展的 AI 渗透测试团队
-
真实漏洞利用验证——提供有效的 PoC，而非像传统漏洞扫描器那样的误报
-
开发者优先的命令行工具——可执行的发现结果，附带修复指导
-
自动修复与报告——生成补丁和合规就绪的渗透测试报告
-
应用安全测试——检测并验证应用中的关键漏洞
-
快速渗透测试——数小时内完成渗透测试，并附带合规报告
-
漏洞赏金自动化——自动化漏洞赏金研究，生成 PoC 以加快报告速度
-
CI/CD 集成——在 CI/CD 中运行测试，将漏洞阻断在到达生产环境之前
前提条件：
- Docker（正在运行）
- 来自任一受支持的提供商的 LLM API 密钥（OpenAI、Anthropic、Google 等）
安装与首次扫描
# Install Strix
curl -sSL https://strix.ai/install | bash
# Configure your AI provider
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"
# Run your first security assessment
strix --target ./app-directory
Note
首次运行会自动拉取沙箱 Docker 镜像。结果保存在 strix_runs/<run-name> 目录下。
在 app.strix.ai 试用 Strix 全栈渗透测试平台——免费注册，连接你的仓库和域名，几分钟内即可启动渗透测试。
- 附带 PoC 的验证发现——每个漏洞都包含可行的概念验证利用代码和复现步骤
- 一键自动修复——AI 生成的安全补丁，以可直接合并的拉取请求形式提供
- 持续渗透测试——始终开启的漏洞扫描，与你的部署节奏保持同步
- DevSecOps 集成——GitHub、GitLab、Bitbucket、Slack、Jira、Linear 及 CI/CD 流水线
- 持续学习——AI 基于过往发现进行学习，适应你的代码库，并逐步减少误报
Strix 代理配备了一套全面的进攻性安全工具包——即专业渗透测试人员和道德黑客所使用的相同工具：
- HTTP 拦截代理——通过 Caido 进行完整的请求/响应操作和分析
- 浏览器利用——自动化浏览器，用于测试 XSS、CSRF、点击劫持和认证绕过流程
- Shell 与命令执行——用于漏洞利用开发和后渗透的交互式终端
- 自定义漏洞利用运行时——用于编写和验证概念验证漏洞利用的 Python 沙箱
- 信息侦察与 OSINT——自动化攻击面映射、子域名枚举和指纹识别
- 静态与动态代码分析——SAST + DAST 能力，实现全面的应用安全测试
- 漏洞知识库——结构化的发现结果，附带 CVSS 评分和 OWASP 分类
全面的漏洞扫描器
Strix 能识别、验证并利用 OWASP Top 10 及更广泛的多种安全漏洞：
- 失效的访问控制——IDOR、权限提升、认证绕过
- 注入攻击——SQL 注入、NoSQL 注入、操作系统命令注入、SSTI
- 服务端漏洞——SSRF、XXE、不安全的反序列化、RCE
- 客户端攻击——XSS（存储/反射/DOM）、原型污染、CSRF
- 业务逻辑缺陷——竞态条件、支付操纵、工作流绕过
- 认证与会话——JWT 攻击、会话固定、凭据填充向量
- 基础设施与云——配置错误、暴露的服务、云安全问题
- API 安全——失效的认证、批量赋值、速率限制绕过
智能体图谱（多智能体渗透测试）
为全面的自动化渗透测试提供高级多智能体编排：
- 分布式渗透测试——专门的 AI 智能体分别负责侦察、利用和后渗透
- 可扩展的安全测试——跨多个目标并行执行，实现快速、全面的覆盖
- 动态协调——智能体共享发现、串联漏洞，像红队一样协同行动
# Scan a local codebase
strix --target ./app-directory
# Security review of a GitHub repository
strix --target https://github.com/org/repo
# Black-box web application assessment
strix --target https://your-app.com
高级测试场景
# Grey-box authenticated testing
strix --target https://your-app.com --instruction "Perform authenticated testing using credentials: user:pass"
# Multi-target testing (source code + deployed app)
strix -t https://github.com/org/app -t https://your-app.com
# White-box source-aware scan (local repository)
strix --target ./app-directory --scan-mode standard
# Focused testing with custom instructions
strix --target api.your-app.com --instruction "Focus on business logic flaws and IDOR vulnerabilities"
# Provide detailed instructions through file (e.g., rules of engagement, scope, exclusions)
strix --target api.your-app.com --instruction-file ./instruction.md
# Force PR diff-scope against a specific base branch
strix -n --target ./ --scan-mode quick --scope-mode diff --diff-base origin/main
使用 -n/--non-interactive 标志可在无交互 UI 的情况下编程运行 Strix——非常适合服务器和自动化任务。命令行工具会实时打印漏洞发现结果和最终报告，然后退出。发现漏洞时以非零退出码退出。
strix -n --target https://your-app.com
Strix 可添加到你的流水线中，通过轻量级的 GitHub Actions 工作流在拉取请求上运行安全测试：
name: strix-penetration-test
on:
pull_request:
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Install Strix
run: curl -sSL https://strix.ai/install | bash
- name: Run Strix
env:
STRIX_LLM: ${{ secrets.STRIX_LLM }}
LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
run: strix -n -t ./ --scan-mode quick
Tip
在 CI 拉取请求运行时，Strix 会自动将快速审查范围限定到已更改的文件。若 diff 作用域无法解析，请确保检出使用完整历史（fetch-depth: 0）或显式传递 --diff-base。
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"
# Optional
export LLM_API_BASE="your-api-base-url" # if using a local model, e.g. Ollama, LMStudio
export PERPLEXITY_API_KEY="your-api-key" # for search capabilities
export STRIX_REASONING_EFFORT="high" # control thinking effort (default: high, quick scan: medium)
Note
Strix 会自动将配置保存至 ~/.strix/cli-config.json，因此你无需每次运行时重新输入。
为获得最佳效果推荐的模型：
请参阅 LLM 提供商文档 了解所有受支持的提供商，包括 Vertex AI、Bedrock、Azure 和本地模型。
获取同样体验的 Strix 企业级 控制能力：SSO（SAML/OIDC）、自定义合规就绪渗透测试报告（SOC 2、ISO 27001、PCI DSS）、专属支持与 SLA、自定义部署选项（VPC/自托管）、BYOK 模型支持，以及针对你的环境优化的专属 AI 渗透测试代理。了解更多。
完整文档请访问 docs.strix.ai——包含使用、CI/CD 集成、技能和高级配置的详细指南。
欢迎贡献代码、文档和新的技能——请参阅我们的贡献指南开始，或提交pull request/issue。
加入我们的社区
有问题？发现 bug？想要贡献？加入我们的 Discord！
喜欢 Strix？ 在 GitHub 上给我们一个 ⭐！
Strix 构建在开源项目的杰出工作之上，例如 LiteLLM、Caido、Nuclei、Playwright 和 Textual。非常感谢它们的维护者！
Warning
只能测试你拥有或有权限测试的应用。你有责任以合乎道德和合法的方式使用 Strix。
English / 原文
Tip
New! Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches production - Get started with no setup required.
Strix are autonomous AI penetration testing agents that act just like real hackers - they run your code dynamically, find vulnerabilities, and validate them through actual proofs-of-concept. Built for developers and security teams who need fast, accurate security testing without the overhead of manual pentesting or the false positives of static analysis tools.
Key Capabilities:
-
Full pentesting toolkit - reconnaissance, exploitation, and validation out of the box
-
Multi-agent orchestration - teams of AI pentesters that collaborate and scale
-
Real exploit validation - working PoCs, not false positives like legacy vulnerability scanners
-
Developer‑first CLI - actionable findings with remediation guidance
-
Auto‑fix & reporting - generate patches and compliance-ready pentest reports
-
Application Security Testing - Detect and validate critical vulnerabilities in your applications
-
Rapid Penetration Testing - Get penetration tests done in hours, not weeks, with compliance reports
-
Bug Bounty Automation - Automate bug bounty research and generate PoCs for faster reporting
-
CI/CD Integration - Run tests in CI/CD to block vulnerabilities before reaching production
Prerequisites:
- Docker (running)
- An LLM API key from any supported provider (OpenAI, Anthropic, Google, etc.)
Installation & First Scan
# Install Strix
curl -sSL https://strix.ai/install | bash
# Configure your AI provider
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"
# Run your first security assessment
strix --target ./app-directory
Note
First run automatically pulls the sandbox Docker image. Results are saved to strix_runs/<run-name>
Try the Strix full-stack penetration testing platform at app.strix.ai - sign up for free, connect your repos and domains, and launch a pentest in minutes.
- Validated findings with PoCs - every vulnerability includes a working proof-of-concept exploit and reproduction steps
- One-click autofix - AI-generated security patches as ready-to-merge pull requests
- Continuous pentesting - always-on vulnerability scanning that keeps pace with your deployments
- DevSecOps integrations - GitHub, GitLab, Bitbucket, Slack, Jira, Linear, and CI/CD pipelines
- Continuous learning - AI that builds on past findings, adapts to your codebase, and reduces false positives over time
Strix agents come equipped with a comprehensive offensive security toolkit - the same tools used by professional penetration testers and ethical hackers:
- HTTP Interception Proxy - Full request/response manipulation and analysis with Caido
- Browser Exploitation - Automated browser for testing XSS, CSRF, clickjacking, and auth bypass flows
- Shell & Command Execution - Interactive terminal for exploit development and post-exploitation
- Custom Exploit Runtime - Python sandbox for writing and validating proof-of-concept exploits
- Reconnaissance & OSINT - Automated attack surface mapping, subdomain enumeration, and fingerprinting
- Static & Dynamic Code Analysis - SAST + DAST capabilities for comprehensive application security testing
- Vulnerability Knowledge Base - Structured findings with CVSS scoring and OWASP classification
Comprehensive Vulnerability Scanner
Strix identifies, validates, and exploits a wide range of security vulnerabilities across the OWASP Top 10 and beyond:
- Broken Access Control - IDOR, privilege escalation, auth bypass
- Injection Attacks - SQL injection, NoSQL injection, OS command injection, SSTI
- Server-Side Vulnerabilities - SSRF, XXE, insecure deserialization, RCE
- Client-Side Attacks - XSS (stored/reflected/DOM), prototype pollution, CSRF
- Business Logic Flaws - Race conditions, payment manipulation, workflow bypass
- Authentication & Session - JWT attacks, session fixation, credential stuffing vectors
- Infrastructure & Cloud - Misconfigurations, exposed services, cloud security issues
- API Security - Broken authentication, mass assignment, rate limiting bypass
Graph of Agents (Multi-Agent Pentesting)
Advanced multi-agent orchestration for comprehensive automated penetration testing:
- Distributed Pentesting - Specialized AI agents for recon, exploitation, and post-exploitation
- Scalable Security Testing - Parallel execution across multiple targets for fast, comprehensive coverage
- Dynamic Coordination - Agents share discoveries, chain vulnerabilities, and collaborate like a red team
# Scan a local codebase
strix --target ./app-directory
# Security review of a GitHub repository
strix --target https://github.com/org/repo
# Black-box web application assessment
strix --target https://your-app.com
Advanced Testing Scenarios
# Grey-box authenticated testing
strix --target https://your-app.com --instruction "Perform authenticated testing using credentials: user:pass"
# Multi-target testing (source code + deployed app)
strix -t https://github.com/org/app -t https://your-app.com
# White-box source-aware scan (local repository)
strix --target ./app-directory --scan-mode standard
# Focused testing with custom instructions
strix --target api.your-app.com --instruction "Focus on business logic flaws and IDOR vulnerabilities"
# Provide detailed instructions through file (e.g., rules of engagement, scope, exclusions)
strix --target api.your-app.com --instruction-file ./instruction.md
# Force PR diff-scope against a specific base branch
strix -n --target ./ --scan-mode quick --scope-mode diff --diff-base origin/main
Run Strix programmatically without interactive UI using the -n/--non-interactive flag - perfect for servers and automated jobs. The CLI prints real-time vulnerability findings and the final report before exiting. Exits with non-zero code when vulnerabilities are found.
strix -n --target https://your-app.com
Strix can be added to your pipeline to run a security test on pull requests with a lightweight GitHub Actions workflow:
name: strix-penetration-test
on:
pull_request:
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Install Strix
run: curl -sSL https://strix.ai/install | bash
- name: Run Strix
env:
STRIX_LLM: ${{ secrets.STRIX_LLM }}
LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
run: strix -n -t ./ --scan-mode quick
Tip
In CI pull request runs, Strix automatically scopes quick reviews to changed files. If diff-scope cannot resolve, ensure checkout uses full history (fetch-depth: 0) or pass --diff-base explicitly.
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"
# Optional
export LLM_API_BASE="your-api-base-url" # if using a local model, e.g. Ollama, LMStudio
export PERPLEXITY_API_KEY="your-api-key" # for search capabilities
export STRIX_REASONING_EFFORT="high" # control thinking effort (default: high, quick scan: medium)
Note
Strix automatically saves your configuration to ~/.strix/cli-config.json, so you don't have to re-enter it on every run.
Recommended models for best results:
See the LLM Providers documentation for all supported providers including Vertex AI, Bedrock, Azure, and local models.
Get the same Strix experience with enterprise-grade controls: SSO (SAML/OIDC), custom compliance-ready penetration testing reports (SOC 2, ISO 27001, PCI DSS), dedicated support & SLA, custom deployment options (VPC/self-hosted), BYOK model support, and tailored AI pentesting agents optimized for your environment. Learn more.
Full documentation is available at docs.strix.ai - including detailed guides for usage, CI/CD integrations, skills, and advanced configuration.
We welcome contributions of code, docs, and new skills - check out our Contributing Guide to get started or open a pull request/issue.
Join Our Community
Have questions? Found a bug? Want to contribute? Join our Discord!
Love Strix? Give us a ⭐ on GitHub!
Strix builds on the incredible work of open-source projects like LiteLLM, Caido, Nuclei, Playwright, and Textual. Huge thanks to their maintainers!
Warning
Only test apps you own or have permission to test. You are responsible for using Strix ethically and legally.