mirror of
https://github.com/usestrix/strix.git
synced 2026-09-05 08:06:08 +00:00
de730119f0
* feat(cli): add strix login for managed platform sign-in (device flow) * feat(cli): add --scopes flag to strix login * docs: document strix login and managed billing in README, AGENTS, docs, and managed skill * fix(cli): handle malformed login responses and credential file failures * fix(cli): reject sign-in responses without an API token * feat(login): interactive workspace and scope selection with presets * fix(login): reject malformed API token values in sign-in responses * fix(login): skip the scope prompt when stdin is not a terminal * fix(login): tolerate malformed selection containers and remove unreadable credential files on logout * fix(login): treat overflowing timing values as invalid * fix(login): show the configured platform host in the sign-in banner * fix(login): bound device flow timing values and clean up unreplaced secret temp files * feat(cli): add the strix cloud command surface for the managed platform * feat(cli): manage workspaces and hosted onboarding links from strix cloud * fix(cli): report a leftover temporary secret file instead of hiding it * feat(cli): pass a Stripe payment method to the top-up wallet client * docs(cloud): recommend the Stripe agent wallet as the default payment path * fix(cloud): preserve API auth during MPP payment * fix(cloud): drop knowledge query and settings commands removed from the API * fix(cloud): align agent commands with API contracts * fix(cloud): send required PR review integration fields * fix(cloud): preserve scopes when switching workspaces * fix(cloud): make session command help non-destructive * feat(cloud): improve human navigation and output * feat(cli): add native shell completions * feat(cloud): tailor human list and detail views * feat(cloud): upload local source for managed scans * fix(cloud): infer scan type from local targets * Add agent-friendly managed cloud CLI * Harden cloud CLI type boundaries * Clarify cloud test user MFA options * Correct cloud vulnerability status guidance * Clarify chat file path handling * Allow signed storage upload URLs * Fix provider token request handling * Improve cloud CLI human list views * Make cloud CLI workflows actionable and safe * Make cloud workspace switching session-safe * Preserve CLI session metadata in JSON output * Remove preview protection bypass plumbing from cloud CLI
59 lines
2.8 KiB
Text
59 lines
2.8 KiB
Text
---
|
|
title: "Introduction"
|
|
description: "Managed security testing without local setup"
|
|
---
|
|
|
|
Skip the setup. Run Strix in the cloud at [app.strix.ai](https://app.strix.ai).
|
|
|
|
## Features
|
|
|
|
<CardGroup cols={2}>
|
|
<Card title="No Setup Required" icon="cloud">
|
|
No Docker, API keys, or local installation needed.
|
|
</Card>
|
|
<Card title="Full Reports" icon="file-lines">
|
|
Detailed findings with remediation guidance.
|
|
</Card>
|
|
<Card title="Team Dashboards" icon="users">
|
|
Track vulnerabilities and fixes over time.
|
|
</Card>
|
|
<Card title="GitHub Integration" icon="github">
|
|
Automatic scans on pull requests.
|
|
</Card>
|
|
</CardGroup>
|
|
|
|
## What You Get
|
|
|
|
- **Penetration test reports** — Validated findings with PoCs
|
|
- **Shareable dashboards** — Collaborate with your team
|
|
- **CI/CD integration** — Block risky changes automatically
|
|
- **Continuous monitoring** — Catch new vulnerabilities quickly
|
|
|
|
## Getting Started
|
|
|
|
1. Sign up at [app.strix.ai](https://app.strix.ai)
|
|
2. Connect your repository or enter a target URL
|
|
3. Launch your first scan
|
|
|
|
## Scan Local Source
|
|
|
|
Send a local working tree to the managed white-box scanner without connecting a source-control provider:
|
|
|
|
```bash
|
|
# Review the exact file manifest and capture source.archive_sha256. Nothing is uploaded.
|
|
strix cloud scans start --source . --dry-run --show-files --json
|
|
SOURCE_SHA256="<reviewed source.archive_sha256>"
|
|
|
|
# Repeat the same source-selection flags and approve that exact snapshot.
|
|
strix cloud scans start --source . --approve-sha256 "$SOURCE_SHA256" --wait
|
|
```
|
|
|
|
In a Git repository, Strix includes tracked files and untracked files that are not ignored. Hidden files, `.git`, symlinks, dependencies and build output, secret-like filenames, and nested archives are excluded by default. Use `.strixignore` or repeat `--exclude GLOB` for project-specific exclusions. `--include-hidden`, `--include-sensitive`, and `--include-archives` are explicit opt-ins.
|
|
|
|
The CLI limits individual files, total expanded bytes, archive bytes, and file count. For an agent or CI handoff, repeat the same `--source`, `--exclude`, and `--include-*` flags with `--approve-sha256`; Strix refuses the upload if the rebuilt archive differs from the reviewed digest. `--yes` is a one-invocation approval for the snapshot built at that moment, not a digest-bound two-step approval.
|
|
|
|
The temporary local archive is always removed. After a definitive launch rejection, Strix also deletes the staged remote upload. If a network error, server error, or interruption makes the launch outcome ambiguous, it retains the upload and reports its ID; check `strix cloud scans list` before retrying, then delete an unlinked upload with `strix cloud uploads delete UPLOAD_ID`.
|
|
|
|
<Card title="Try Strix Cloud" icon="rocket" href="https://app.strix.ai">
|
|
Run your first pentest in minutes.
|
|
</Card>
|