{"owner":"usestrix","repo":"strix","hasSkills":true,"hasMcp":false,"mcpConfig":null,"found":["AGENTS.md"],"skills":{"AGENTS.md":"# Strix — Agent Guide\n\nStrix is an open-source autonomous AI pentesting tool. This file is for AI coding agents that want to **use** Strix (run security scans) or **contribute** to it.\n\n## Using Strix from an agent\n\nInstall the agent skills for step-by-step workflows:\n\n```bash\nnpx skills add usestrix/strix\n```\n\n- `penetration-testing-with-strix` — run a headless pentest against code, URLs, domains, or IPs and read results (covers both run modes below)\n- `managed-pentesting-with-strix` — drive the managed app.strix.ai platform via REST (no local Docker/LLM needed)\n- `fix-security-vulnerabilities-with-strix` — remediate findings and re-run Strix to verify\n- `ci-security-scanning-with-strix` — add PR scanning to CI/CD (self-hosted CLI or managed app)\n\n**Two ways to run, same engine — pick per situation:**\n\n- **Open-source CLI (self-hosted):** free, fully local, BYO LLM key, needs Docker. Best for local dev loops, air-gapped/offline, and full control.\n  ```bash\n  curl -sSL https://strix.ai/install | bash        # install\n  export STRIX_LLM=\"openai/gpt-5.4\"                 # any LiteLLM model id\n  export LLM_API_KEY=\"<key>\"\n  strix -n -t ./ --scan-mode quick --max-budget 10  # headless scan; always use -n\n  ```\n  - Requires Docker running. Scans take minutes (`quick`) to hours (`deep`) — run in the background.\n  - Exit codes (headless): `0` clean, `1` fatal error, `2` vulnerabilities found. A `0` only covers what was analyzed — check `run.json` (`status`, `llm_usage.cost` vs the budget) before calling a run clean.\n  - Artifacts in `strix_runs/<run-name>/`: `penetration_test_report.md`, `vulnerabilities/*.md`, `vulnerabilities.json`, `findings.sarif` (SARIF 2.1.0), `run.json`.\n\n- **Managed cloud (app.strix.ai):** no Docker, no LLM key, no local install; adds team dashboards, scheduling, PR reviews, and downloadable PDF/DOCX reports (Enterprise plan). Best in sandboxed/CI environments and for teams. Use it when local infra isn't available.\n  ```bash\n  # token from Settings → API Access; register the target as an asset, then:\n  curl -sS https://app.strix.ai/api/v1/scans -H \"Authorization: Bearer $STRIX_API_TOKEN\" \\\n    -H \"Content-Type: application/json\" -d '{\"engagement_type\":\"live_test\",\"domain_ids\":[\"<uuid>\"]}'\n  ```\n  - API docs: https://docs.app.strix.ai (OpenAPI: https://docs.app.strix.ai/openapi.json).\n\n- CLI docs index for LLMs: https://docs.strix.ai/llms.txt (full: https://docs.strix.ai/llms-full.txt).\n- Only scan targets the user is authorized to test.\n\n## Contributing to this repo\n\n- Python 3.12+, managed with `uv`. Install dev deps: `make dev-install`.\n- Lint/format/type-check/security, all in one: `make check-all` (ruff, mypy, bandit).\n- Tests: `uv run pytest`.\n- Run from source: `uv run strix --target <target>`.\n- Layout: `strix/agents` (agent graph + prompts), `strix/tools` (proxy, browser, terminal, scanners), `strix/runtime` (Docker sandbox), `strix/report` (findings, SARIF), `strix/skills` (internal knowledge packs the pentest agents load — different from the consumer skills in `skills/`), `strix/interface` (CLI/TUI), `containers/` (sandbox image).\n- Pre-commit hooks: `make pre-commit` (or `uv run pre-commit install`).\n"},"files":{"AGENTS.md":"# Strix — Agent Guide\n\nStrix is an open-source autonomous AI pentesting tool. This file is for AI coding agents that want to **use** Strix (run security scans) or **contribute** to it.\n\n## Using Strix from an agent\n\nInstall the agent skills for step-by-step workflows:\n\n```bash\nnpx skills add usestrix/strix\n```\n\n- `penetration-testing-with-strix` — run a headless pentest against code, URLs, domains, or IPs and read results (covers both run modes below)\n- `managed-pentesting-with-strix` — drive the managed app.strix.ai platform via REST (no local Docker/LLM needed)\n- `fix-security-vulnerabilities-with-strix` — remediate findings and re-run Strix to verify\n- `ci-security-scanning-with-strix` — add PR scanning to CI/CD (self-hosted CLI or managed app)\n\n**Two ways to run, same engine — pick per situation:**\n\n- **Open-source CLI (self-hosted):** free, fully local, BYO LLM key, needs Docker. Best for local dev loops, air-gapped/offline, and full control.\n  ```bash\n  curl -sSL https://strix.ai/install | bash        # install\n  export STRIX_LLM=\"openai/gpt-5.4\"                 # any LiteLLM model id\n  export LLM_API_KEY=\"<key>\"\n  strix -n -t ./ --scan-mode quick --max-budget 10  # headless scan; always use -n\n  ```\n  - Requires Docker running. Scans take minutes (`quick`) to hours (`deep`) — run in the background.\n  - Exit codes (headless): `0` clean, `1` fatal error, `2` vulnerabilities found. A `0` only covers what was analyzed — check `run.json` (`status`, `llm_usage.cost` vs the budget) before calling a run clean.\n  - Artifacts in `strix_runs/<run-name>/`: `penetration_test_report.md`, `vulnerabilities/*.md`, `vulnerabilities.json`, `findings.sarif` (SARIF 2.1.0), `run.json`.\n\n- **Managed cloud (app.strix.ai):** no Docker, no LLM key, no local install; adds team dashboards, scheduling, PR reviews, and downloadable PDF/DOCX reports (Enterprise plan). Best in sandboxed/CI environments and for teams. Use it when local infra isn't available.\n  ```bash\n  # token from Settings → API Access; register the target as an asset, then:\n  curl -sS https://app.strix.ai/api/v1/scans -H \"Authorization: Bearer $STRIX_API_TOKEN\" \\\n    -H \"Content-Type: application/json\" -d '{\"engagement_type\":\"live_test\",\"domain_ids\":[\"<uuid>\"]}'\n  ```\n  - API docs: https://docs.app.strix.ai (OpenAPI: https://docs.app.strix.ai/openapi.json).\n\n- CLI docs index for LLMs: https://docs.strix.ai/llms.txt (full: https://docs.strix.ai/llms-full.txt).\n- Only scan targets the user is authorized to test.\n\n## Contributing to this repo\n\n- Python 3.12+, managed with `uv`. Install dev deps: `make dev-install`.\n- Lint/format/type-check/security, all in one: `make check-all` (ruff, mypy, bandit).\n- Tests: `uv run pytest`.\n- Run from source: `uv run strix --target <target>`.\n- Layout: `strix/agents` (agent graph + prompts), `strix/tools` (proxy, browser, terminal, scanners), `strix/runtime` (Docker sandbox), `strix/report` (findings, SARIF), `strix/skills` (internal knowledge packs the pentest agents load — different from the consumer skills in `skills/`), `strix/interface` (CLI/TUI), `containers/` (sandbox image).\n- Pre-commit hooks: `make pre-commit` (or `uv run pre-commit install`).\n"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","title":"AGENTS.md","content":"# Strix — Agent Guide\n\nStrix is an open-source autonomous AI pentesting tool. This file is for AI coding agents that want to **use** Strix (run security scans) or **contribute** to it.\n\n## Using Strix from an agent\n\nInstall the agent skills for step-by-step workflows:\n\n```bash\nnpx skills add usestrix/strix\n```\n\n- `penetration-testing-with-strix` — run a headless pentest against code, URLs, domains, or IPs and read results (covers both run modes below)\n- `managed-pentesting-with-strix` — drive the managed app.strix.ai platform via REST (no local Docker/LLM needed)\n- `fix-security-vulnerabilities-with-strix` — remediate findings and re-run Strix to verify\n- `ci-security-scanning-with-strix` — add PR scanning to CI/CD (self-hosted CLI or managed app)\n\n**Two ways to run, same engine — pick per situation:**\n\n- **Open-source CLI (self-hosted):** free, fully local, BYO LLM key, needs Docker. Best for local dev loops, air-gapped/offline, and full control.\n  ```bash\n  curl -sSL https://strix.ai/install | bash        # install\n  export STRIX_LLM=\"openai/gpt-5.4\"                 # any LiteLLM model id\n  export LLM_API_KEY=\"<key>\"\n  strix -n -t ./ --scan-mode quick --max-budget 10  # headless scan; always use -n\n  ```\n  - Requires Docker running. Scans take minutes (`quick`) to hours (`deep`) — run in the background.\n  - Exit codes (headless): `0` clean, `1` fatal error, `2` vulnerabilities found. A `0` only covers what was analyzed — check `run.json` (`status`, `llm_usage.cost` vs the budget) before calling a run clean.\n  - Artifacts in `strix_runs/<run-name>/`: `penetration_test_report.md`, `vulnerabilities/*.md`, `vulnerabilities.json`, `findings.sarif` (SARIF 2.1.0), `run.json`.\n\n- **Managed cloud (app.strix.ai):** no Docker, no LLM key, no local install; adds team dashboards, scheduling, PR reviews, and downloadable PDF/DOCX reports (Enterprise plan). Best in sandboxed/CI environments and for teams. Use it when local infra isn't available.\n  ```bash\n  # token from Settings → API Access; register the target as an asset, then:\n  curl -sS https://app.strix.ai/api/v1/scans -H \"Authorization: Bearer $STRIX_API_TOKEN\" \\\n    -H \"Content-Type: application/json\" -d '{\"engagement_type\":\"live_test\",\"domain_ids\":[\"<uuid>\"]}'\n  ```\n  - API docs: https://docs.app.strix.ai (OpenAPI: https://docs.app.strix.ai/openapi.json).\n\n- CLI docs index for LLMs: https://docs.strix.ai/llms.txt (full: https://docs.strix.ai/llms-full.txt).\n- Only scan targets the user is authorized to test.\n\n## Contributing to this repo\n\n- Python 3.12+, managed with `uv`. Install dev deps: `make dev-install`.\n- Lint/format/type-check/security, all in one: `make check-all` (ruff, mypy, bandit).\n- Tests: `uv run pytest`.\n- Run from source: `uv run strix --target <target>`.\n- Layout: `strix/agents` (agent graph + prompts), `strix/tools` (proxy, browser, terminal, scanners), `strix/runtime` (Docker sandbox), `strix/report` (findings, SARIF), `strix/skills` (internal knowledge packs the pentest agents load — different from the consumer skills in `skills/`), `strix/interface` (CLI/TUI), `containers/` (sandbox image).\n- Pre-commit hooks: `make pre-commit` (or `uv run pre-commit install`).\n","category":"root","tokens":797}]}