# AI use cases for Strix (usestrix/strix) Repo: [usestrix/strix](https://github.com/usestrix/strix) | Use cases: 5 | Page: https://dedupedai.com/use-cases/usestrix-strix/ Strix is an open-source Python tool that uses autonomous AI agents to run penetration tests on your code and deployed apps, validate vulnerabilities with proof-of-concept exploits, and suggest fixes. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Scan your app for exploitable vulnerabilities: https://dedupedai.com/use-cases/usestrix-strix/scan-app-for-vulnerabilities/ - Block insecure code in pull requests: https://dedupedai.com/use-cases/usestrix-strix/block-insecure-pull-requests/ - Test every API endpoint from its OpenAPI spec: https://dedupedai.com/use-cases/usestrix-strix/test-api-from-openapi-spec/ - Run a logged-in grey-box test of your web app: https://dedupedai.com/use-cases/usestrix-strix/run-authenticated-grey-box-test/ - Let a coding agent run pentests and fix findings: https://dedupedai.com/use-cases/usestrix-strix/have-coding-agent-fix-findings/ ## How to scan your app for exploitable vulnerabilities with Strix Repo: [usestrix/strix](https://github.com/usestrix/strix) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Point Strix at a local app directory and get findings that include validated proof-of-concept exploits. **Who it is for:** A developer or small security team that needs a pentest-style check on an application before a release. **The problem:** Manual pentests are slow and static analysis tools report many false positives. **The outcome:** A set of findings from the scan, with exploits validated by the agents, saved to the strix_runs folder. ### Steps 1. Start Docker and confirm it is running. 2. Run `curl -sSL https://strix.ai/install | bash` 3. Run `export STRIX_LLM="openrouter/z-ai/glm-5.3"` and `export LLM_API_KEY="your-api-key"` 4. Run `strix --target ./app-directory` 5. Open the results in the strix_runs folder, or run `strix view` to see them in the local dashboard. ### Prompt to paste into your agent ```text Use the usestrix/strix repo to scan for vulnerabilities by running `strix --target ` with STRIX_LLM and LLM_API_KEY set. Report the findings and the path to the strix_runs output. Verify that each reported finding includes a proof-of-concept or reproduction steps before you summarize it. ``` ### Caveat The README does not state the cost of a scan, so check your LLM provider usage before running large targets. Risk, credentials: The setup requires an LLM API key, which you should store securely and never commit to the repository. Risk, remote script: The install step pipes a script from Strix.ai directly into bash, so review it first if your policy requires it. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/usestrix-strix/scan-app-for-vulnerabilities/ ## How to block insecure code in pull requests with Strix Repo: [usestrix/strix](https://github.com/usestrix/strix) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README Run a quick Strix scan in GitHub Actions on every pull request to catch vulnerabilities before merge. **Who it is for:** A dev team lead who wants a security gate in CI so insecure changes do not reach production. **The problem:** Security review often happens too late, after code is merged and deployed. **The outcome:** A pull request workflow that runs a headless Strix scan and fails when vulnerabilities are found. ### Steps 1. Save the README's strix-penetration-test YAML as a workflow file in .github/workflows/. (inferred, check the README) 2. Add STRIX_LLM and LLM_API_KEY as repository secrets in GitHub. 3. Open a pull request so the workflow runs `strix -n -t ./ --scan-mode quick`. 4. Check the Actions log for the printed findings; the run exits with a non-zero code when vulnerabilities are found. ### Prompt to paste into your agent ```text Add the strix-penetration-test GitHub Actions workflow from the usestrix/strix README to , using the STRIX_LLM and LLM_API_KEY secrets. Open a pull request and report the workflow result. Verify that the workflow step runs `strix -n -t ./ --scan-mode quick` and that a non-zero exit is reported when findings exist. ``` ### Caveat The README says quick reviews in pull requests are scoped to changed files, which is why the checkout uses fetch-depth 0. Risk, credentials: The workflow depends on LLM_API_KEY stored as a GitHub secret, so limit who can read or change repository secrets. Risk, remote script: The workflow installs Strix with curl piped to bash, so pin or review the installer if your CI policy requires it. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/usestrix-strix/block-insecure-pull-requests/ ## How to test every API endpoint from its OpenAPI spec with Strix Repo: [usestrix/strix](https://github.com/usestrix/strix) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Give Strix an OpenAPI, Swagger, or Postman file plus the live base URL to test all declared endpoints. **Who it is for:** A backend engineer who maintains a documented API and wants coverage of every endpoint, not only the ones a crawler finds. **The problem:** Crawling an API misses endpoints that are declared but not linked from any page. **The outcome:** A test run that covers every declared endpoint in the contract against the live base URL. ### Steps 1. Export your API contract as an OpenAPI or Swagger file, or a Postman export. 2. Run `export STRIX_LLM="openrouter/z-ai/glm-5.3"` and `export LLM_API_KEY="your-api-key"` 3. Run `strix --target ./openapi.yaml --target https://api.your-app.com` 4. Review the findings for broken authentication, mass assignment, and rate limiting bypass. ### Prompt to paste into your agent ```text Use the usestrix/strix repo to test the API described by against , running `strix --target --target `. Report the findings by endpoint. Verify that each finding names the endpoint it came from. ``` ### Caveat The README says the spec tells Strix which endpoints to test, but it does not say how it handles endpoints missing from the spec. Risk, credentials: Testing a live API may use real account tokens or data, so use a staging environment you control. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/usestrix-strix/test-api-from-openapi-spec/ ## How to run a logged-in grey-box test of your web app with Strix Repo: [usestrix/strix](https://github.com/usestrix/strix) | Difficulty: Advanced | Time: 45 minutes | Basis: From the README Test a deployed app with test-account credentials so the agents can reach pages behind login. **Who it is for:** A QA or security engineer who needs coverage of authenticated flows such as account pages and checkout. **The problem:** A black-box scan without login cannot reach most of the app's real functionality. **The outcome:** A scan of the authenticated areas of the app, with findings for access control and auth bypass issues. ### Steps 1. Create a dedicated test account on the staging app. 2. Run `export STRIX_LLM="openrouter/z-ai/glm-5.3"` and `export LLM_API_KEY="your-api-key"` 3. Run `strix --target https://your-app.com --instruction "Perform authenticated testing using credentials: user:pass"` 4. Review findings for IDOR, privilege escalation, and auth bypass. ### Prompt to paste into your agent ```text Use the usestrix/strix repo to run an authenticated grey-box test against using the test account , with `strix --target --instruction` and the test credentials. Report the findings. Verify that the test account is a dedicated test account and that no production credentials were used. ``` ### Caveat The README names the --instruction flag for credentials but does not describe how those credentials are stored or handled during the run. Risk, credentials: Passing a username and password in the --instruction string can expose them in shell history and logs, so use a test account only. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/usestrix-strix/run-authenticated-grey-box-test/ ## How to let a coding agent run pentests and fix findings with Strix Repo: [usestrix/strix](https://github.com/usestrix/strix) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Install the Strix skills so Claude Code, Cursor, or Codex can run scans and apply fixes. **Who it is for:** A developer who works with a coding agent and wants the agent to handle security findings end to end. **The problem:** Security findings often sit in a backlog because fixing them takes context switching. **The outcome:** A coding agent that runs Strix against the project, reads the findings, and proposes or applies fixes. ### Steps 1. Run `npx skills add usestrix/strix` in your project. 2. Open your coding agent (Claude Code, Cursor, or Codex) in the project directory. 3. Ask the agent to run a Strix pentest on the project and list the findings. 4. Ask the agent to fix one finding, then run the Strix scan again to confirm it is resolved. ### Prompt to paste into your agent ```text Install the usestrix/strix skills with `npx skills add usestrix/strix`, then run a Strix pentest on . Fix the highest-severity finding and rerun the scan. Verify that the rerun no longer reports that finding before you report success. ``` ### Caveat The README says the skills work with the local CLI or the managed cloud, but the setup steps depend on the agent you use and the README does not detail them per agent. Risk, remote script: The skill install runs npx against a remote package, so check the source before installing it into an agent. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/usestrix-strix/have-coding-agent-fix-findings/