mirror of
https://github.com/usestrix/strix.git
synced 2026-09-24 00:51:20 +00:00
1b74f806fc
Call out the provenance verifier prerequisite so curl|bash users are not surprised by a fail-closed abort (#1267).
126 lines
3.3 KiB
Text
126 lines
3.3 KiB
Text
---
|
|
title: "Quick Start"
|
|
description: "Install Strix and run your first security scan"
|
|
---
|
|
|
|
## Prerequisites
|
|
|
|
- Docker (running)
|
|
- An LLM API key from any [supported provider](/llm-providers/overview) (OpenAI, Anthropic, Google, etc.)
|
|
- For the curl installer: [GitHub CLI](https://cli.github.com/) (`gh`) or [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) — used to verify Sigstore provenance before extract
|
|
|
|
## Installation
|
|
|
|
<Tabs>
|
|
<Tab title="curl">
|
|
```bash
|
|
curl -sSL https://strix.ai/install | bash
|
|
```
|
|
|
|
The installer downloads the release archive, checks `SHA256SUMS`, then verifies
|
|
Sigstore provenance with `gh` or `cosign` before extracting. To skip those checks
|
|
(not recommended):
|
|
|
|
```bash
|
|
curl -sSL https://strix.ai/install | STRIX_INSTALL_SKIP_VERIFY=1 bash
|
|
```
|
|
</Tab>
|
|
<Tab title="pipx">
|
|
```bash
|
|
pipx install strix-agent
|
|
```
|
|
</Tab>
|
|
</Tabs>
|
|
|
|
## Verify a downloaded release
|
|
|
|
If you download assets from GitHub Releases yourself:
|
|
|
|
```bash
|
|
# Replace VERSION and TARGET (e.g. 1.6.2 and linux-x86_64).
|
|
VERSION=1.6.2
|
|
TARGET=linux-x86_64
|
|
ARCHIVE="strix-${VERSION}-${TARGET}.tar.gz"
|
|
|
|
curl -fsSLO "https://github.com/usestrix/strix/releases/download/v${VERSION}/${ARCHIVE}"
|
|
curl -fsSLO "https://github.com/usestrix/strix/releases/download/v${VERSION}/SHA256SUMS"
|
|
curl -fsSLO "https://github.com/usestrix/strix/releases/download/v${VERSION}/strix-${TARGET}.intoto.jsonl"
|
|
|
|
# 1) Integrity
|
|
sha256sum -c --ignore-missing SHA256SUMS
|
|
|
|
# 2) Provenance (GitHub CLI)
|
|
gh attestation verify "${ARCHIVE}" \
|
|
--repo usestrix/strix \
|
|
--bundle "strix-${TARGET}.intoto.jsonl" \
|
|
--signer-workflow usestrix/strix/.github/workflows/build-release.yml \
|
|
--predicate-type https://slsa.dev/provenance/v1 \
|
|
--deny-self-hosted-runners
|
|
```
|
|
|
|
With `cosign` instead of `gh`:
|
|
|
|
```bash
|
|
cosign verify-blob-attestation \
|
|
--bundle "strix-${TARGET}.intoto.jsonl" \
|
|
--new-bundle-format \
|
|
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
|
--certificate-identity-regexp '^https://github.com/usestrix/strix/.github/workflows/build-release.yml' \
|
|
--type slsaprovenance1 \
|
|
"${ARCHIVE}"
|
|
```
|
|
|
|
## Configuration
|
|
|
|
Set your LLM provider:
|
|
|
|
```bash
|
|
export STRIX_LLM="openrouter/z-ai/glm-5.3"
|
|
export LLM_API_KEY="your-api-key"
|
|
```
|
|
|
|
<Tip>
|
|
For best results, use `openrouter/z-ai/glm-5.3` (the default pick), `openai/gpt-5.4`, `anthropic/claude-opus-4-6`, or `openai/gpt-5.2`.
|
|
</Tip>
|
|
|
|
## Run Your First Scan
|
|
|
|
```bash
|
|
strix --target ./your-app
|
|
```
|
|
|
|
<Note>
|
|
First run pulls the Docker sandbox image automatically. Results are saved to `strix_runs/<run-name>`.
|
|
</Note>
|
|
|
|
## Target Types
|
|
|
|
Strix accepts multiple target types:
|
|
|
|
```bash
|
|
# Local codebase
|
|
strix --target ./app-directory
|
|
|
|
# GitHub repository
|
|
strix --target https://github.com/org/repo
|
|
|
|
# Live web application
|
|
strix --target https://your-app.com
|
|
|
|
# Multiple targets (white-box testing)
|
|
strix -t https://github.com/org/repo -t https://your-app.com
|
|
|
|
# Targets from a file, one target per non-empty, non-comment line
|
|
strix --target-list ./targets.txt
|
|
```
|
|
|
|
## Next Steps
|
|
|
|
<CardGroup cols={2}>
|
|
<Card title="CLI Options" icon="terminal" href="/usage/cli">
|
|
Explore all command-line options.
|
|
</Card>
|
|
<Card title="Scan Modes" icon="gauge" href="/usage/scan-modes">
|
|
Choose the right scan depth.
|
|
</Card>
|
|
</CardGroup>
|