mirror of
https://github.com/usestrix/strix.git
synced 2026-08-28 05:25:00 +00:00
67 lines
5.1 KiB
Text
67 lines
5.1 KiB
Text
---
|
|
title: "Coding Agents"
|
|
description: "Use Strix from Claude Code, Cursor, Codex, and other AI agents"
|
|
---
|
|
|
|
Strix is built to be driven by AI coding agents. Install the official agent skills and your agent knows how to run pentests, remediate findings, and wire Strix into CI.
|
|
|
|
## Install the Skills
|
|
|
|
Works with any agent that supports the open [SKILL.md standard](https://agentskills.io) — Claude Code, Cursor, Codex, Gemini CLI, OpenCode, and dozens more:
|
|
|
|
```bash
|
|
npx skills add usestrix/strix
|
|
```
|
|
|
|
| Skill | What your agent learns |
|
|
|-------|------------------------|
|
|
| `penetration-testing-with-strix` | Run headless scans against code, URLs, domains, or IPs — self-hosted CLI or managed cloud — with budget caps, and read the results |
|
|
| `managed-pentesting-with-strix` | Drive the managed [app.strix.ai](https://app.strix.ai) platform over REST — no local Docker or LLM key needed |
|
|
| `fix-security-vulnerabilities-with-strix` | Triage findings, fix root causes, and re-run Strix to verify each fix |
|
|
| `ci-security-scanning-with-strix` | Add PR security scanning to GitHub Actions or any CI (self-hosted CLI or managed app) |
|
|
| `application-security-testing` | Assess a whole product: choose the right test for each asset, then rank the findings into one remediation plan |
|
|
| `web-app-penetration-testing` | Black-box pentest of a live web app or staging site — scope, credentials, and multi-account access-control testing |
|
|
| `api-security-testing` | Test a REST/GraphQL API against the OWASP API Security Top 10 — schema-driven enumeration, BOLA/IDOR, authz |
|
|
| `owasp-top-10-testing` | Systematic OWASP Top 10 assessment with honest per-category coverage |
|
|
| `find-security-vulnerabilities-in-code` | White-box security review of a repo or working tree, with exploits to confirm findings |
|
|
|
|
Install a single skill with `npx skills add usestrix/strix --skill penetration-testing-with-strix`, or use one without installing:
|
|
|
|
```bash
|
|
npx skills use usestrix/strix@penetration-testing-with-strix | claude
|
|
```
|
|
|
|
## Two ways to run — self-hosted or managed
|
|
|
|
Both use the same engine and produce the same validated findings and SARIF, so agents can pick per situation or combine them:
|
|
|
|
- **Open-source CLI (self-hosted)** — runs locally in a Docker sandbox with your own LLM key. Free, fully local, air-gap capable. Best for local dev loops and full control.
|
|
- **Managed cloud** — runs on Strix's infrastructure. Drive it with the `strix cloud` CLI (every REST operation has a `strix cloud <resource> <verb>` command) or the [app.strix.ai REST API](https://docs.app.strix.ai) directly. No Docker, no LLM key; adds team dashboards, scheduling, PR reviews, and downloadable PDF/DOCX reports (Enterprise plan). Best in sandboxed/CI environments and for teams. Sign in with `strix cloud login` (browser device sign-in, account created on first use) or create a token in the dashboard under **Settings → API Access**. The `managed-pentesting-with-strix` skill has the full flow.
|
|
|
|
## Agent-Friendly Interfaces
|
|
|
|
Everything an agent needs is machine-readable:
|
|
|
|
- **Headless CLI** — `strix -n` runs without the TUI and exits with `0` (clean), `1` (error), or `2` (vulnerabilities found).
|
|
- **Cloud CLI** — `strix cloud` prints JSON when stdout is not a terminal (or with `--json`), never prompts without a TTY, and exits with `0` (success), `1` (error), `2` (usage), `4` (authentication required), or `5` (payment required). Credit top-ups pay the Stripe machine-payment challenge with an agent wallet (`strix cloud billing topup --credits N --yes`). Account setup also runs from the CLI: `strix cloud workspaces list|create|use`, `strix cloud org members invite`, `strix cloud billing subscribe`, `strix cloud billing portal`, and `strix cloud integrations install github`. The last three print a hosted link the user opens to finish the payment or approve the installation.
|
|
- **REST API** — the managed platform exposes a documented [OpenAPI](https://docs.app.strix.ai/openapi.json) at `https://app.strix.ai/api/v1` (scans, vulnerabilities, assets, PR reviews, schedules, webhooks) with bearer tokens and scopes.
|
|
- **Structured results** — every run writes `vulnerabilities.json`, `vulnerabilities.csv`, `findings.sarif` (SARIF 2.1.0), and per-finding Markdown under `strix_runs/<run-name>/`; the cloud exposes the same as JSON plus SARIF export.
|
|
- **Budget controls** — `--max-budget` and `--max-turns` give agents hard cost/time caps.
|
|
- **`AGENTS.md`** — the [repository's agent guide](https://github.com/usestrix/strix/blob/main/AGENTS.md) with a quick reference.
|
|
- **`llms.txt`** — this documentation is indexed at [docs.strix.ai/llms.txt](https://docs.strix.ai/llms.txt) and fully exported at [docs.strix.ai/llms-full.txt](https://docs.strix.ai/llms-full.txt); every page is also available as Markdown by appending `.md` to its URL.
|
|
|
|
## Example Prompts
|
|
|
|
Once the skills are installed, prompts like these just work:
|
|
|
|
```text
|
|
Pentest this repo with Strix (quick mode, $10 budget) and summarize the findings.
|
|
```
|
|
|
|
```text
|
|
Fix all critical and high findings from the last Strix run, then re-scan to verify.
|
|
```
|
|
|
|
```text
|
|
Add Strix security scanning to our GitHub Actions so every PR gets tested.
|
|
```
|