---
title: "Quick Start"
description: "Install Strix and run your first security scan"
---

## Prerequisites

- Docker (running)
- An LLM API key from any [supported provider](/llm-providers/overview) (OpenAI, Anthropic, Google, etc.)

## Installation

<Tabs>
  <Tab title="curl">
    ```bash
    curl -sSL https://strix.ai/install | bash
    ```

    The installer downloads the release archive, checks `SHA256SUMS`, then verifies
    Sigstore provenance before extracting. To skip those checks (not recommended):

    ```bash
    STRIX_INSTALL_SKIP_VERIFY=1 curl -sSL https://strix.ai/install | bash
    ```
  </Tab>
  <Tab title="pipx">
    ```bash
    pipx install strix-agent
    ```
  </Tab>
</Tabs>

## Verify a downloaded release

If you download assets from GitHub Releases yourself:

```bash
# Replace VERSION and TARGET (e.g. 1.6.2 and linux-x86_64).
VERSION=1.6.2
TARGET=linux-x86_64
ARCHIVE="strix-${VERSION}-${TARGET}.tar.gz"

curl -fsSLO "https://github.com/usestrix/strix/releases/download/v${VERSION}/${ARCHIVE}"
curl -fsSLO "https://github.com/usestrix/strix/releases/download/v${VERSION}/SHA256SUMS"
curl -fsSLO "https://github.com/usestrix/strix/releases/download/v${VERSION}/strix-${TARGET}.intoto.jsonl"

# 1) Integrity
sha256sum -c --ignore-missing SHA256SUMS

# 2) Provenance (GitHub CLI)
gh attestation verify "${ARCHIVE}" \
  --repo usestrix/strix \
  --bundle "strix-${TARGET}.intoto.jsonl" \
  --signer-workflow usestrix/strix/.github/workflows/build-release.yml \
  --predicate-type https://slsa.dev/provenance/v1 \
  --deny-self-hosted-runners
```

With `cosign` instead of `gh`:

```bash
cosign verify-blob-attestation \
  --bundle "strix-${TARGET}.intoto.jsonl" \
  --new-bundle-format \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/usestrix/strix/.github/workflows/build-release.yml' \
  --type slsaprovenance1 \
  "${ARCHIVE}"
```

## Configuration

Set your LLM provider:

```bash
export STRIX_LLM="openrouter/z-ai/glm-5.3"
export LLM_API_KEY="your-api-key"
```

<Tip>
For best results, use `openrouter/z-ai/glm-5.3` (the default pick), `openai/gpt-5.4`, `anthropic/claude-opus-4-6`, or `openai/gpt-5.2`.
</Tip>

## Run Your First Scan

```bash
strix --target ./your-app
```

<Note>
First run pulls the Docker sandbox image automatically. Results are saved to `strix_runs/<run-name>`.
</Note>

## Target Types

Strix accepts multiple target types:

```bash
# Local codebase
strix --target ./app-directory

# GitHub repository
strix --target https://github.com/org/repo

# Live web application
strix --target https://your-app.com

# Multiple targets (white-box testing)
strix -t https://github.com/org/repo -t https://your-app.com

# Targets from a file, one target per non-empty, non-comment line
strix --target-list ./targets.txt
```

## Next Steps

<CardGroup cols={2}>
  <Card title="CLI Options" icon="terminal" href="/usage/cli">
    Explore all command-line options.
  </Card>
  <Card title="Scan Modes" icon="gauge" href="/usage/scan-modes">
    Choose the right scan depth.
  </Card>
</CardGroup>