# Strix

> Open source agent that tests app security with exploit attempts and PoCs

- Category: Agents & dev (`agents`)
- Tags: `open-source`, `free`
- Official: https://github.com/usestrix/strix
- Wunderlust: https://wunderlust.xyz/r/strix
- Image: https://wunderlust.xyz/media/strix-poster.jpg
- Video preview: https://wunderlust.xyz/media/strix.webm
- Added: 2026-11-05

## What it is

AI pentest tool that runs the app, tries to exploit vulnerabilities and validates findings with proof-of-concept code.

## What it’s for

For finding flaws in applications and APIs before release, including in CI pipelines.

## Benefits

- Covers access control, injection, SSRF/XXE, XSS, business logic and authentication, with OWASP mapping
- Accepts local code, GitHub repositories, URLs, OpenAPI and Postman
- Headless mode for CI that fails when it finds vulnerabilities
- Report with CVSS and remediation guidance

## Caveats

- Use only on systems you own or have written authorization to test; evaluate scope and permissions before running
- The Apache 2.0 core runs locally with Docker and your LLM key, so cost depends on the models you choose; Cloud and Enterprise are separate offerings, with no price stated

## Similar on Wunderlust

- [GitDiagram](https://wunderlust.xyz/r/gitdiagram.md): Generates diagrams from code repositories
- [Unsloth Studio](https://wunderlust.xyz/r/unsloth-studio.md): App for running, chatting with and training AI models locally
- [Supabase](https://wunderlust.xyz/r/supabase.md): Open-source backend platform built on Postgres
- [Orca](https://wunderlust.xyz/r/orca.md): Desktop app that runs several coding agents in parallel, each in its own worktree
- [OpenClaw](https://wunderlust.xyz/r/openclaw.md): Open-source AI assistant that runs on your machine and replies through chat apps
- [Agent Browser](https://wunderlust.xyz/r/agent-browser.md): Tool that gives AI agents web browsing