Strix
Open source penetration testing agent that attacks a running application instead of reading its code. It explores, forms attack hypotheses, executes them in a sandbox, and reports only what it managed to exploit. It also installs as a skill set readable by Claude Code, so you can run a scan then have the fix written in the same session.
Strengths
- Validates by real exploitation: what it reports was obtained, not inferred from a code pattern
- Installable as a Claude Code skill set, so finding and fixing happen in the same session
- Open source and runnable locally in a sandbox, without shipping your application to a third-party service
Limitations
- Run too early on an immature application, it produces an unmanageable list that discourages more than it guides
- Use strictly bounded to what you own or have written authorisation for
- Model token cost on every run, non-trivial over a wide perimeter
Best for
- Checking what remains exploitable on an application already through a pass on the obvious flaws
- Wiring a security check into a development loop rather than into a one-off audit