Strix

Security teams point Strix at a codebase or running application and get validated vulnerabilities instead of scanner noise: autonomous agents plan an engagement, probe for the OWASP Top 10 plus business-logic flaws, then confirm each finding by building a working proof-of-concept exploit before reporting it. The agents carry real tooling, including an HTTP interception proxy, browser automation for XSS and authentication flows, shell and code execution, and multi-agent orchestration that splits large scopes across cooperating workers, with results collected in a local web dashboard. A one-line install script sets it up; runs require Docker plus an API key for a supported LLM provider such as OpenAI, Anthropic, or Google, and a GitHub Action wires scans into CI/CD. The repository passed 57k stars in 2026, making it one of the fastest-growing security projects on GitHub. Code is Apache 2.0, a commercial cloud and enterprise tier backs the project, and the usual rule applies: only test targets you are authorized to attack.