DEDUPED Hot AI repos, turned into use cases Get the Monday 5
70,636 stars · Python

How to use Strix: what you can do with it

Strix is an open-source Python tool that uses autonomous AI agents to run penetration tests on your code and deployed apps, validate vulnerabilities with proof-of-concept exploits, and suggest fixes.

Trended earlier

View repo on GitHub

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer

Authorization notice. This tool is dual-use. Only use it on software, sites and systems you own or have explicit permission to test, and follow the relevant licenses and terms of service.

What do you want to do?

5 use cases

  • Scan your app for exploitable vulnerabilities

    Point Strix at a local app directory and get findings that include validated proof-of-concept exploits.

    View prompt
    Use the usestrix/strix repo to scan <target-app-directory> for vulnerabilities by running `strix --target <target-app-directory>` with STRIX_LLM and LLM_API_KEY set. Report the findings and the path to the strix_runs output. Verify that each reported finding includes a proof-of-concept or reproduction steps before you summarize it.

  • Block insecure code in pull requests

    Run a quick Strix scan in GitHub Actions on every pull request to catch vulnerabilities before merge.

    View prompt
    Add the strix-penetration-test GitHub Actions workflow from the usestrix/strix README to <target-repo>, using the STRIX_LLM and LLM_API_KEY secrets. Open a pull request and report the workflow result. Verify that the workflow step runs `strix -n -t ./ --scan-mode quick` and that a non-zero exit is reported when findings exist.

  • Test every API endpoint from its OpenAPI spec

    Give Strix an OpenAPI, Swagger, or Postman file plus the live base URL to test all declared endpoints.

    View prompt
    Use the usestrix/strix repo to test the API described by <path-to-openapi-file> against <api-base-url>, running `strix --target <path-to-openapi-file> --target <api-base-url>`. Report the findings by endpoint. Verify that each finding names the endpoint it came from.

  • Run a logged-in grey-box test of your web app

    Test a deployed app with test-account credentials so the agents can reach pages behind login.

    View prompt
    Use the usestrix/strix repo to run an authenticated grey-box test against <staging-app-url> using the test account <test-username>, with `strix --target <staging-app-url> --instruction` and the test credentials. Report the findings. Verify that the test account is a dedicated test account and that no production credentials were used.

  • Let a coding agent run pentests and fix findings

    Install the Strix skills so Claude Code, Cursor, or Codex can run scans and apply fixes.

    View prompt
    Install the usestrix/strix skills with `npx skills add usestrix/strix`, then run a Strix pentest on <project-directory>. Fix the highest-severity finding and rerun the scan. Verify that the rerun no longer reports that finding before you report success.

Quick start with Strix

  1. Check you have what it needs: Docker installed and running; An LLM API key from a supported provider, or a ChatGPT Plus/Pro subscription sign-in; The application source directory or a target URL you are authorized to test.
  2. Open usestrix/strix on GitHub and read the README and license.
  3. Start Docker and confirm it is running.
  4. Run curl -sSL https://strix.ai/install | bash
  5. Run export STRIX_LLM="openrouter/z-ai/glm-5.3" and export LLM_API_KEY="your-api-key"
  6. Run strix --target ./app-directory

These steps come from our top use case, Scan your app for exploitable vulnerabilities, which also has a copy-paste agent prompt.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for usestrix/strix

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Strix alternatives · Best AI repos for Security and science

About this repo

  • Who it is forDevelopers and security teams who want automated pentesting of their own applications, with a CI option for pull requests.
  • Why it is hot71k stars, picked up by one AI source we track
  • LanguagePython
  • Sourcegithub.com/usestrix/strix · Back to Hot repos

Requirements

  • Docker installed and running
  • An LLM API key from a supported provider, or a ChatGPT Plus/Pro subscription sign-in
  • The application source directory or a target URL you are authorized to test
  • A GitHub repository with Actions enabled, if you want the CI workflow

Add this badge to your README

Maintain Strix? Show readers where to find these use cases. Use cases on Deduped

Markdown 

[![Use cases on Deduped](https://dedupedai.com/badge/usestrix/strix.svg)](https://dedupedai.com/use-cases/usestrix-strix/?utm_source=github&utm_medium=badge&utm_campaign=usestrix-strix)

HTML 

<a href="https://dedupedai.com/use-cases/usestrix-strix/?utm_source=github&amp;utm_medium=badge&amp;utm_campaign=usestrix-strix"><img src="https://dedupedai.com/badge/usestrix/strix.svg" alt="Use cases on Deduped" height="20"></a>

A static image, no tracking script. About the badge

Questions about Strix

What is Strix?

Strix is an open-source Python tool that uses autonomous AI agents to run penetration tests on your code and deployed apps, validate vulnerabilities with proof-of-concept exploits, and suggest fixes. It is an open-source project on GitHub: https://github.com/usestrix/strix.

Who is Strix for?

Developers and security teams who want automated pentesting of their own applications, with a CI option for pull requests.

What can I do with Strix?

5 use cases so far, for example: Scan your app for exploitable vulnerabilities; Block insecure code in pull requests; Test every API endpoint from its OpenAPI spec. Each has steps and a copy-paste agent prompt.

What do I need to run Strix?

Docker installed and running; An LLM API key from a supported provider, or a ChatGPT Plus/Pro subscription sign-in; The application source directory or a target URL you are authorized to test; A GitHub repository with Actions enabled, if you want the CI workflow.

What are alternatives to Strix?

Other hot AI repos in Security and science: RiftX, Hacker, Codex Privacy Hud, Forge Guardian, Open Keylet.

Is Strix safe to run?

Deduped does not own, audit or vouch for it. Read the README and license, run it on your own systems first and review every command before you run it.