Commit graph

765 commits

Author SHA1 Message Date
Alex Schapiro
ca0eddc481 docs(cloud): recommend the Stripe agent wallet as the default payment path 2026-08-27 04:45:19 +00:00
Alex Schapiro
2df99a2873 feat(cli): pass a Stripe payment method to the top-up wallet client 2026-08-26 23:36:42 +00:00
Alex Schapiro
268769fc45 fix(cli): report a leftover temporary secret file instead of hiding it 2026-08-26 23:04:35 +00:00
Alex Schapiro
8d66c66968 feat(cli): manage workspaces and hosted onboarding links from strix cloud 2026-08-26 23:01:36 +00:00
Alex Schapiro
56008a6c50 feat(cli): add the strix cloud command surface for the managed platform 2026-08-26 22:30:09 +00:00
Alex Schapiro
44fb7ac969 fix(login): bound device flow timing values and clean up unreplaced secret temp files 2026-08-26 21:54:04 +00:00
Alex Schapiro
ef722c2ee0 fix(login): show the configured platform host in the sign-in banner 2026-08-26 21:48:05 +00:00
Alex Schapiro
93dc0019fa fix(login): treat overflowing timing values as invalid 2026-08-26 21:43:54 +00:00
Alex Schapiro
5c61a2aee4 fix(login): tolerate malformed selection containers and remove unreadable credential files on logout 2026-08-26 21:32:52 +00:00
Alex Schapiro
baf0ff41fd fix(login): skip the scope prompt when stdin is not a terminal 2026-08-26 21:28:56 +00:00
Alex Schapiro
04a77e50e7 fix(login): reject malformed API token values in sign-in responses 2026-08-26 21:24:57 +00:00
Alex Schapiro
d6ccb7c38a feat(login): interactive workspace and scope selection with presets 2026-08-26 21:23:13 +00:00
Alex Schapiro
67082e21d9 fix(cli): reject sign-in responses without an API token 2026-08-26 21:02:57 +00:00
Alex Schapiro
8dd26f016f fix(cli): handle malformed login responses and credential file failures 2026-08-26 20:56:04 +00:00
Alex Schapiro
6cb78d495a docs: document strix login and managed billing in README, AGENTS, docs, and managed skill 2026-08-26 20:53:13 +00:00
Alex Schapiro
17007bd43c feat(cli): add --scopes flag to strix login 2026-08-26 19:58:21 +00:00
Alex Schapiro
28590a52e0 feat(cli): add strix login for managed platform sign-in (device flow) 2026-08-26 19:35:18 +00:00
alex s
a5856108a7
fix(tui): restore base foreground after ANSI resets (#1169) 2026-08-26 14:11:51 -04:00
devin-ai-integration[bot]
bfaaa904f2
fix(update): re-exec runs the new binary after self-update (endless update-prompt loop) (#1168)
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-25 15:13:35 -07:00
alex s
187f41f36f
Treat literal 'null'/'none' strings as absent for optional tool args (#1164)
* Treat literal 'null'/'none' strings as absent for optional tool args

Models routinely pass the literal string "null" or "none" instead of
omitting an optional argument. Taken at face value it becomes a filter
that matches nothing, so tools like list_notes / list_reports /
list_requests silently return no results.

Coerce such values to None in the central argument-coercion layer, but
only for parameters the schema allows to be null (or that are absent from
a declared "required" list), so required strings keep the literal value.
The list/filter helpers normalize the same values too, so a direct call
can't regress.

* Limit nullish coercion to query tools and keep literal tags

A literal "null"/"none" is only a mistake where the argument is a filter, so
gate the coercion on read-only query tools; a tool that writes keeps the value,
which stops update_note(content="none") from being read as "leave unchanged".

Stop dropping nullish entries from a notes tag filter too: tags are free-form,
so a literal "none" tag stays filterable and mixed tag queries keep every
branch.
2026-08-25 13:21:12 -04:00
yoni-at-strix
f4ef8867f6
Add MCP server support (#1137)
* add a generic MCP client and a config for connecting MCP servers

* Add MCP docs and CLI polish: docs page, startup connect summary, --mcp-config flag, compact tool output

* Add MCP connection notes and per-run selection; clean up on cancel and dedupe names

* Show errored MCP tool calls as failed in the TUI

* Sanitize namespaced tool names so model APIs accept them

* Show MCP tool calls distinctly in the terminal and the run viewer

* Say what MCP servers are worth connecting for

* Correct the notes docstring to match how notes reach the agent

* keep the mcp tests from reading your shell's STRIX_MCP_* vars
2026-08-24 14:00:16 -04:00
devin-ai-integration[bot]
391d81bea7
feat(agents): evidence discipline, and coverage as a first-class artifact (#961)
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-24 03:34:09 -07:00
devin-ai-integration[bot]
1c499c5b2d
perf: bootstrap Caido concurrently with the scan start (#1143)
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-21 12:09:59 -07:00
devin-ai-integration[bot]
1ce43d1b94
perf: take heavy imports off the startup path and pre-warm them in the background (#1141)
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-20 20:24:08 -07:00
Alex Schapiro
2cc8167814 docs(skills): correct gRPC guidance, a .proto is not a spec target 2026-08-20 19:27:04 -04:00
Alex Schapiro
d6a3ca7e58 docs(skills): document --workspace-file for supporting files 2026-08-20 19:27:04 -04:00
Alex Schapiro
9099710cef docs(skills): fix nonexistent --mount flag, document real targeting flags, add application-security-testing skill
- Remove --mount from two skills: the flag does not exist in the CLI. Local
  paths are mounted writable when passed with -t.
- Document --target-list, --scope-mode, --diff-base, and OpenAPI/Postman
  targets, so agents stop putting spec URLs in --instruction prose.
- Add the application-security-testing skill as the entry point for
  whole-product AppSec requests, routing each asset to the right workflow.
- Drop contractions and Latin abbreviations across the skill prose.
2026-08-20 19:27:04 -04:00
Alex Schapiro
634cb98241 docs(skills): use current OWASP editions (Top 10:2025, API Top 10 2023) 2026-08-20 19:27:04 -04:00
Alex Schapiro
1b36343eea fix(skills): avoid unquoted colon in api-security-testing description 2026-08-20 19:27:04 -04:00
Alex Schapiro
b5ef93e744 feat(skills): add target-specific security testing skills (web app, API, OWASP Top 10, code review) 2026-08-20 19:27:04 -04:00
RAJVARDHAN PATIL
e152c4c7c0
fix(report): raise RuntimeError on non-object run.json (fixes #1109) (#1116) 2026-08-20 13:41:04 -07:00
OpenPay
fe758af4fc
fix(tui): use single space after ordered-list marker (#1043) 2026-08-20 13:40:12 -07:00
oyasumi
deb2057e20
fix(tui): preserve cost when state is truncated (#1086)
Co-authored-by: oyasumi <oyasumi@kantilabs.xyz>
2026-08-20 13:36:01 -07:00
Alex Schapiro
d6f2218756 Drop strict tool schemas on Claude routes 2026-08-20 23:12:23 +03:00
oyasumi
6f88b7d7d5 Require viewer session for run data 2026-08-19 15:25:57 -04:00
oyasumi
8d3693df8c Expose viewer host option 2026-08-19 15:25:57 -04:00
bearsyankees
9cd81e5c76 Add semantic browser and Electron security skills 2026-08-19 12:05:47 -04:00
bearsyankees
e8272c6a21 Add HTTP differential testing tools 2026-08-19 12:04:43 -04:00
bearsyankees
aa5867f5df Add ecosystem supply-chain security skills 2026-08-19 12:03:45 -04:00
bearsyankees
7b8f9cb160 Add argument injection security skill 2026-08-19 12:02:45 -04:00
bearsyankees
2d944a9bcc Add Azure and Entra security skill 2026-08-19 12:01:21 -04:00
alex s
0478a69ab0
feat(skills): cover OWASP LLM Top 10 2026 (#1115) 2026-08-18 18:40:27 -04:00
alex s
8ede419dcc
handle resume tokens gracefully (#1097)
* Fix telemetry deltas for resumed runs

* Fix resumed telemetry duration
2026-08-17 16:55:27 -04:00
Ahmed Allam
a46a60cf6a feat(reporting): require contextual CVSS and usage evidence on dependency reports 2026-08-17 14:35:21 +03:00
Ahmed Allam
918442dbc8 cli: render contextual CVSS vector, advisory score, and reasoning for dependency findings 2026-08-17 13:03:41 +03:00
Ahmed Allam
e442db9c93 Contextual CVSS as a full 8-metric breakdown, computed like a normal finding 2026-08-17 13:03:41 +03:00
Ahmed Allam
9c0d30a0d0 reporting: require the source-to-sink trace in reachability evidence, not just CVSS reasoning 2026-08-17 13:03:41 +03:00
Ahmed Allam
55e6e66030 reporting: surface contextual CVSS in the markdown report; require reasoning only for surviving metrics 2026-08-17 13:03:41 +03:00
Ahmed Allam
99e2d5d826 reporting: drop per-metric contextual CVSS reasoning, keep the summary 2026-08-17 13:03:41 +03:00
Ahmed Allam
310f310e28 feat(reporting): contextual CVSS environmental metrics on dependency reports 2026-08-17 13:03:41 +03:00