How bayurzx/strix works
Purpose and Entry Points
Strix is a local-first, AI-driven penetration-testing CLI. It accepts source repositories, live URLs, API specifications, and target lists; coordinates LLM agents to test and validate vulnerabilities; then persists findings, transcripts, and reports locally. Primary command dispatch and scan setup are in strix/interface/main.py, strix/interface/cli.py, and strix/interface/scan_setup.py. Packaging/container entry points are defined by pyproject.toml and containers/docker-entrypoint.sh.
CLI-to-Scan Control Flow
CLI arguments, environment/configuration, auth, target normalization, and interactive/non-interactive choices are collected before execution. strix/config/loader.py, strix/config/models.py, and strix/interface/cli_args.py form the configuration boundary; strix/core/inputs.py interprets targets including API specs. strix/core/runner.py owns scan lifecycle—setup, execution, interruption/rate-limit handling, teardown, and output—while strix/core/sessions.py provides durable run/session state.
Agent Orchestration and LLM Boundary
The scan is performed by a coordinated graph of specialized agents. Agent construction, prompt assembly, and tool registration reside in strix/agents/factory.py, strix/agents/prompt.py, and strix/core/agents.py. Execution/retry behavior is centralized in strix/core/execution.py. LLM context budgeting and compaction are isolated in strix/llm/context_budget.py and strix/llm/compaction.py, while provider model/auth settings are represented under strix/config/; supported external LLMs include OpenAI, Anthropic, Google/Vertex, Bedrock, Azure, and local endpoints.
Agent Capabilities and Security Runtime
Agents act through a controlled tool layer rather than directly through the UI. Key capabilities include shell/browser execution, HTTP proxy interaction, web search, patching, skills, notes, reporting, and structured completion: strix/tools/proxy/tools.py, strix/tools/reporting/tool.py, and strix/tools/agents_graph/tools.py. Domain knowledge and scan-mode instructions are file-based skills loaded from strix/skills/scan_modes/, strix/skills/vulnerabilities/, and strix/skills/tooling/. Docker-backed sandbox/proxy lifecycle and status boundaries are implemented in strix/runtime/docker_client.py, strix/runtime/session_manager.py, and strix/runtime/caido_bootstrap.py; Caido is the interception-proxy integration.
Persistent Findings and Export Pipeline
Run artifacts are written to disk as the authoritative local data store. Reporting state, deduplication, usage tracking, and report writing are handled in strix/report/state.py, strix/report/dedupe.py, and strix/report/writer.py. Findings can be exported as SARIF through strix/report/sarif.py; PDF generation belongs to strix/interface/viewer/report_pdf.py. This separates agent-produced evidence/PoCs from final presentation and CI-consumable results.
Interactive and Browser Presentation
The Python scan process can stream structured events to a Go terminal UI through a backend protocol/server boundary: strix/interface/tui/backend/server.py, strix/interface/tui/backend/protocol.py, and strix/interface/tui/cmd/strix-tui/main.go. The Go client renders agent activity, findings, and live controls. Separately, strix view launches a loopback, token-protected local viewer server in strix/interface/viewer/server.py, reading persisted run files and serving the prebuilt React UI rooted at strix/interface/viewer/frontend/src/App.tsx. The viewer supports run history, live agent graphs/transcripts, finding details, steering, and reporting without uploading scan data.
Operational Integrations
The project is primarily Python, with a Go Bubble Tea TUI and TypeScript/React/Vite viewer frontend. Docker is material infrastructure for isolated scanning; GitHub repositories and Postman API collections are supported target sources. Optional web search uses Perplexity credentials; telemetry modules integrate PostHog and Scarf via strix/telemetry/posthog.py and strix/telemetry/scarf.py. CI distribution/release automation is defined in .github/workflows/build-release.yml, and packaged skills expose the CLI and managed-cloud workflows to external coding agents under skills/.
Components 20
Entry & Control
- CLI dispatch
strix/interface/main.py - Configuration & auth
strix/config/loader.py - Target intake · Normalizes repositories, URLs, target lists, and API specifications.
strix/core/inputs.py
Scan Runtime
- Scan runner · Owns setup, execution, interruption handling, teardown, and output.
strix/core/runner.py - Durable sessions
strix/core/sessions.py - Docker & Caido runtime · Manages isolated execution and interception-proxy lifecycle.
strix/runtime/session_manager.py
Agents & Tools
- Agent graph · Builds specialized agents, prompts, and registered tools.
strix/agents/factory.py - Agent execution · Centralizes agent execution and retries.
strix/core/execution.py - LLM context control · Budgets and compacts model context.
strix/llm/context_budget.py - Controlled tools · Provides proxy, reporting, graph, shell, browser, and other controlled actions.
strix/tools/agents_graph/tools.py - Security skills · Scan-mode, vulnerability, and tooling instructions.
Artifacts & Reports
- Local run artifacts · Persists findings, evidence, transcripts, and usage locally.
strix/report/state.py - Report pipeline · Deduplicates findings and writes final reports.
strix/report/writer.py - SARIF & PDF export
strix/report/sarif.py
Local Presentation
- TUI event backend · Streams structured scan events and receives live controls.
strix/interface/tui/backend/server.py - Terminal UI
strix/interface/tui/cmd/strix-tui/main.go - Local viewer server · Reads local run files and serves viewer APIs.
strix/interface/viewer/server.py - React viewer · Shows run history, graphs, transcripts, findings, steering, and reports.
strix/interface/viewer/frontend/src/App.tsx
External Services
- LLM providers · OpenAI, Anthropic, Google/Vertex, Bedrock, Azure, and local endpoints.
- Optional telemetry
strix/telemetry/posthog.py
Connections 23
- CLI dispatch → Configuration & auth: loads
- CLI dispatch → Target intake: accepts
- CLI dispatch → Scan runner: starts scan
- Configuration & auth → Scan runner: scan settings
- Target intake → Scan runner: normalized targets
- Scan runner → Durable sessions: creates and updates
- Scan runner → Docker & Caido runtime: provisions
- Scan runner → Agent graph: coordinates
- Agent graph → Agent execution: runs agents
- Agent graph → Security skills: loads instructions
- Agent execution → LLM context control: manages context
- LLM context control → LLM providers: model calls
- Agent execution → Controlled tools: invokes
- Controlled tools → Docker & Caido runtime: sandbox and proxy actions
- Agent execution → Local run artifacts: writes evidence and transcripts
- Scan runner → Local run artifacts: persists run output
- Local run artifacts → Report pipeline: findings and evidence
- Report pipeline → SARIF & PDF export: generates
- Scan runner → TUI event backend: streams events
- TUI event backend → Terminal UI: protocol
- Local run artifacts → Local viewer server: reads local runs
- Local viewer server → React viewer: serves
- CLI dispatch → Optional telemetry: optional events