usestrix/strix is an AI-based open source penetration testing tool that finds and fixes vulnerabilities in applications. The repository's latest release is v1.7.0. It applies LLM agents to the security domain, and its goal extends to fixing the vulnerabilities it actually finds.
How this tool actually works is the center of the repository. The README explains that Strix runs the application directly to find vulnerabilities and verifies the results through a real attack reproduction procedure. Reconnaissance, attack, and validation tools each investigate the target, attempt vulnerabilities with actual attacks, and confirm the results. Multiple agents collaborate, and it states they can produce remediation guidance and reports and connect to CI/CD. It is written in Python and released under the Apache-2.0 license. Local execution requires Docker and an API key for a supported language model provider, and results are stored in a per-run folder. The repository was created on August 5, 2025, and has 70,228 GitHub stars.
The evidence stops here. The evaluation record leaves only the momentum item at 10.0 on a 10-point scale, and gives no scores for the novelty, technology, and quality items. The README distinguishes local open source execution from cloud and enterprise options, and the boundary that can be verified directly extends only to local execution, which requires Docker and a provider API key to start. The change log for v1.7.0 is not recorded in any confirmed source. The tool's structure and requirements can be read, but what this release changed cannot be known.