An open-source agent that attacks your app like a real hacker. On defaults a scan can run four hours and write to the real files in your folder
Strix actually runs your app inside a Docker box and attacks it. It does not describe a vulnerability, it builds a working proof that the vulnerability is real and hands it to you with a fix suggestion. Apache licensed, open source, running on your own machine. I verified four things and all four affect your first scan. First, the price: the tool itself is free, but the thing doing the attacking is a language model and its bill is yours, with no spending limit on the defaults. Second, the duration: give it no flags and it runs the deepest mode, which takes one to four hours depending on the target. Third, and this is the one that hurts: when you point it at a local folder, that folder is mounted into the box as writable, so the agent can change your real files. Fourth, Windows: the official docs only give you a bash command, yet a Windows binary is published and I verified on my own machine that it works. Below: three install routes, the command that starts your first scan safely, a way to run it on a ChatGPT subscription instead of a metered API bill, and the legal limit of the tool.
The tool itself
Strix is not a security scanner, it is an autonomous pentest agent. It brings your app up inside Docker, tries real attacks, and validates every vulnerability it finds with a working proof. Apache 2.0 licensed, written in Python. As of 21 September 2026 it has 63,900 stars and 6,900 forks, and the latest published release is 1.6.2, dated 5 September 2026. The repo moves fast: it was updated on the day this was written too.
What is extra below: exactly where it parts ways with a classic scanner, how far the word free actually goes, the install route that works on Windows and is not in the docs, the command that starts your first scan without blowing up your budget or your afternoon, how to drive it from Claude Code, and the tool's own legal warning.
Where it differs from a scanner
Two approaches
Classic scanner
Reads the code, matches patterns
- Gives you a list of suspicious lines
- Does not know if it is actually exploitable
- High false positive rate, and the list stops getting read
Strix
Runs the app, then attacks it
- Exploits what it finds and produces the proof
- What it cannot prove does not reach the report
- Every finding arrives with a remediation suggestion
The attacking is not done by a single model. Separate agents work on recon, exploitation and what comes after, passing findings to each other. Their toolkit is a real pentester's toolkit too: a proxy that can intercept and rewrite requests, a real browser for XSS and session testing, a shell they can run commands in, and a Python box where they write and try proof-of-concept code.
When the scan ends the results are written to disk. A directory named after the run appears under the strix_runs folder, holding a readable pentest report, a separate file per vulnerability, a JSON you can process programmatically, and a SARIF output you can upload to the GitHub security tab.
About the word free
The tool itself really is free and open source, it does not even ask for an account. But the thing doing the attacking is a language model, and you pay for the model. Strix uses yours: you hand it the key, the bill lands on you. I am not giving a figure, because it swings wildly with the model you pick, the size of the target and the mode you choose. Set the limit yourself instead.
There is no spending limit by default
Without the budget flag Strix runs until it is done and has no ceiling. Setting a limit is one flag: max-budget takes a cap in dollars. Keep it low to start, say 10. As the cap gets close the agents are warned to wrap up, so the scan is not cut off mid-way and you still get the report.
There is also a way to run it without opening an API bill at all, documented only in the repo README rather than the docs site. If you have a ChatGPT Plus or Pro subscription, you can run Strix on that subscription. I tried these three commands on the published release and they work.
strix auth login chatgpt
$env:STRIX_LLM = "chatgpt/gpt-5.4"
strix auth statusThe middle line is for PowerShell. On macOS and Linux the same line becomes export STRIX_LLM=chatgpt/gpt-5.4 instead.
Installing it: Docker first
Strix does the attacking inside a Docker box rather than directly on your machine. So Docker has to be installed and running, which on Windows means Docker Desktop. On the first scan it pulls the sandbox image itself; the download is around 1.3 GB and it takes more than that on disk. If you are on a limited connection, start knowing that.
On macOS and Linux the official install is a single line. It downloads a binary into the .strix folder in your home directory and adds a PATH line to your shell config.
curl -sSL https://strix.ai/install | bashThat command does not run on Windows
The line above is a bash command and will not run in PowerShell. The official docs give no Windows route, and inside the repo the request to document a Windows install is still open. But a Windows binary does ship with the published release. I ran the steps below on this machine, it installed and printed its version.
# Docker Desktop must be running
$zip = "$env:TEMP\strix.zip"
$bin = "$HOME\.strix\bin"
Invoke-WebRequest "https://github.com/usestrix/strix/releases/download/v1.6.2/strix-1.6.2-windows-x86_64.zip" -OutFile $zip
New-Item -ItemType Directory -Force -Path $bin | Out-Null
Expand-Archive -Path $zip -DestinationPath $bin -Force
Move-Item "$bin\strix-1.6.2-windows-x86_64.exe" "$bin\strix.exe" -Force
# add it to PATH for good, then close and reopen the terminal
$user = [Environment]::GetEnvironmentVariable("Path", "User")
[Environment]::SetEnvironmentVariable("Path", "$user;$bin", "User")Why the PATH line is written that way: if you read the env:Path variable and save it back, you copy the machine-wide entries into your own user setting too and your PATH swells over time. The form above reads only your user PATH and appends to it. The version number appears inside the command, so when a newer release lands you update the places that say 1.6.2.
There is a third route: if you have Python 3.12 or newer, you can install the package with pipx. One caveat, if you later run the curl command above, that install script removes the pipx version and puts the binary in its place. Do not try to keep both.
pipx install strix-agentOnce it is installed you point it at a model. Strix saves this into the .strix folder in your home directory, so you do not retype it before every scan.
# Windows PowerShell
$env:STRIX_LLM = "openrouter/z-ai/glm-5.3"
$env:LLM_API_KEY = "your-key"
# macOS and Linux
export STRIX_LLM="openrouter/z-ai/glm-5.3"
export LLM_API_KEY="your-key"Three traps before your first scan
If you run it with no flags
The default mode is the deepest one. It takes one to four hours depending on the target, and all of that time is model spend.
Pick quick mode for the first run. It takes minutes and shows you cheaply whether the tool actually works for you. Run the deep scan once you know the target.
When you target a local folder, that folder is mounted into the box as writable. The agent can change your real files; only the .git folder is kept out of it.
Commit or stash your work before the scan. Then if the agent touched something you see it in git diff and undo it with one command.
There is no spending ceiling. You pay for as long as the model works, until the scan stops on its own.
Set a dollar ceiling with the max-budget flag. As the limit approaches the agents wrap up and you still get the report.
This starting command covers all three. The first flag turns off the interface, prints the results to the terminal and exits.
strix -n -t ./ --scan-mode quick --max-budget 10In headless mode the exit code means something too: zero is clean, one is an error, two means vulnerabilities were found. That is why wiring Strix into CI is easy, the pipeline breaks when something is found. And the target does not have to be a folder; you can give it a GitHub repository address, a live site, an API spec, or several of those at once.
# a GitHub repository
strix -t https://github.com/user/repo --max-budget 10
# a live site, with credentials
strix -t https://myapp.com --instruction "Log in with these credentials: user:pass" --max-budget 10
# source code and the live app together
strix -t https://github.com/user/repo -t https://myapp.com --max-budget 25If you want to see the results in a browser, the strix view command opens the most recent run in a local dashboard. The dashboard stays on your machine, but the address carries an access token at the end, so if you share that link the other side can see the scan results.
Driving it from Claude Code and Cursor
You do not have to run Strix by hand in a terminal. The repo ships nine ready skills that install into Claude Code, Cursor or Codex. Once installed you can tell your agent to run a pentest, fix the vulnerabilities it finds, or set up scanning in CI, and it writes the commands itself.
npx skills add usestrix/strixFour of the nine are for driving the tool itself: running a pentest, fixing findings, setting up CI scanning, and using the cloud version. The other five are split by target: a live web app, API security, the OWASP Top 10, a code review over a repository, and a wide review covering a whole product.
There is a door in the other direction too. You can connect MCP servers to Strix itself; drop an mcp-servers.json into the .strix folder in your home directory and that server's tools land in the agent's hands during a scan.
Know the limit before you use it
Only against your own systems
Strix genuinely attacks the target, it does not simulate. So you can only run it against systems you own or have written permission to test. That is the repo's own warning too: unauthorised testing is illegal in most jurisdictions and the responsibility sits with whoever runs the tool. Your own project, your own site, your own API is fine. Someone else's site is not.
Two smaller settings, both on by default. First, telemetry: Strix sends usage data, and setting STRIX_TELEMETRY to 0 is enough to turn it off. Second, reasoning effort: in deep mode the model's effort is set to the highest level, and that is one of the quiet multipliers on your bill.
Finally, let us put the expectation where it belongs. Strix does not replace a security team, it produces a pentest report and that report only covers what it looked at. A clean result does not mean your app is secure, it means no provable vulnerability was found in this scan. That is good enough to run a pass before you ship, not good enough to be your only security measure.
DOA: Yapay Zeka ve Otomasyon
Installing these tools on your own is one thing; actually building with them is another. The community has people using these daily and people building systems from scratch.
If you want a system that actually runs in your business, let's talk for 10 minutes; I'll look at what you're trying to build and tell you which path fits. Free, and not a sales pitch.
Book a 10-minute callIf you'd rather learn this alongside people doing the same work instead of on your own, the community is always open:
Join the communityThis is an affiliate link.