Authorization notice. Strix is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.
Credentials. Testing a live API may use real account tokens or data, so use a staging environment you control.
Who it is forA backend engineer who maintains a documented API and wants coverage of every endpoint, not only the ones a crawler finds.
The problemCrawling an API misses endpoints that are declared but not linked from any page.
The outcomeA test run that covers every declared endpoint in the contract against the live base URL.
What you need first
- Docker installed and running
- An LLM API key from a supported provider, or a ChatGPT Plus/Pro subscription sign-in
- The application source directory or a target URL you are authorized to test
- A GitHub repository with Actions enabled, if you want the CI workflow
Steps
- Export your API contract as an OpenAPI or Swagger file, or a Postman export.
- Run
export STRIX_LLM="openrouter/z-ai/glm-5.3"andexport LLM_API_KEY="your-api-key" - Run
strix --target ./openapi.yaml --target https://api.your-app.com - Review the findings for broken authentication, mass assignment, and rate limiting bypass.
Prompt for your agent
Use the usestrix/strix repo to test the API described by <path-to-openapi-file> against <api-base-url>, running `strix --target <path-to-openapi-file> --target <api-base-url>`. Report the findings by endpoint. Verify that each finding names the endpoint it came from.
Caveat. The README says the spec tells Strix which endpoints to test, but it does not say how it handles endpoints missing from the spec.
Use this in your AI agent
Ask your agent
Using the Deduped MCP, get the setup steps for usestrix/strix and "Test every API endpoint from its OpenAPI spec"
Add Deduped to Claude Code once
claude mcp add --transport http deduped https://dedupedai.com/mcp
Every Monday: the 5 hottest repos and exactly how to use them. Free, one email a week, unsubscribe anytime.
Get them freeShare: X LinkedIn Hacker News Email Copy link
Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer