strix

Run Strix penetration testing scans from the command line

The strix command is the main entry point for running AI-powered penetration tests. You can scan web applications, GitHub repositories, local code, domains, and IP addresses.

Usage

strix [OPTIONS]

Quick Examples

# Web application penetration test
strix --target https://example.com

# GitHub repository analysis
strix --target https://github.com/user/repo

# Local code analysis
strix --target ./my-project

# Multiple targets (white-box testing)
strix --target ./my-project --target https://staging.example.com

Options

-t, --target · string · required

Target to test. Can be:

• URL (e.g., https://example.com)
• GitHub repository (e.g., https://github.com/user/repo or [e-mail]:user/repo.git)
• Local directory path (e.g., ./my-project)
• Domain name (e.g., example.com)
• IP address (e.g., 192.168.1.42)

You can specify this option multiple times for multi-target scans.

--instruction · string

Custom instructions for the penetration test. Use this to:

• Focus on specific vulnerability types (e.g., “Focus on IDOR and XSS”)
• Specify testing approaches (e.g., “Perform thorough authentication testing”)
• Provide test credentials (e.g., “Use credentials: admin:password123”)
• Highlight areas of interest (e.g., “Check login API endpoint for security issues”)

Cannot be used with --instruction-file.

--instruction-file · string

Path to a file containing detailed custom instructions for the penetration test.

Use this when you have lengthy or complex instructions saved in a file.

Example: --instruction-file ./detailed_instructions.txt

Cannot be used with --instruction.

-n, --non-interactive · boolean · default: "false"

Run in non-interactive mode (no TUI, exits on completion).

By default, Strix runs in interactive mode with a text-based user interface (TUI). Use this flag for CI/CD pipelines or automated scanning.

In non-interactive mode:

• No TUI is displayed
• Vulnerabilities are printed to stdout in real-time
• Process exits automatically when scan completes
• Exit code 2 is returned if vulnerabilities are found

-m, --scan-mode · string · default: "deep"

Scan mode controlling depth and thoroughness.

Options:

• quick - Fast CI/CD checks with basic coverage
• standard - Routine testing with balanced speed/depth
• deep - Thorough security reviews (default)

See Scan Modes for detailed comparison.

--config · string

Path to a custom config file (JSON) to use instead of ~/.strix/cli-config.json.

This allows you to maintain multiple configuration profiles for different environments.

-v, --version · boolean

Display the Strix version and exit.

Environment Variables

Strix requires certain environment variables to be configured. See the Configuration guide for details.

Required

• STRIX_LLM - Model name to use with litellm (e.g., openai/gpt-4)

Optional

• LLM_API_KEY - API key for the LLM provider (not needed for local models, Vertex AI, AWS, etc.)
• LLM_API_BASE - Custom API base URL for local models (e.g., Ollama, LMStudio)
• PERPLEXITY_API_KEY - API key for Perplexity AI web search (enables real-time research)
• STRIX_REASONING_EFFORT - Reasoning effort level: none, minimal, low, medium, high, xhigh (default: high)

Output

Strix creates a timestamped directory in strix_runs/ containing:

• Vulnerability reports in JSON and Markdown formats
• Tool execution logs
• Agent activity traces
• Scan metadata and statistics

See Reports for details on output format.

Exit Codes

In non-interactive mode, Strix uses exit codes to indicate scan results:

• 0 - Scan completed successfully, no vulnerabilities found
• 1 - Error occurred during execution
• 2 - Scan completed successfully, vulnerabilities were found

See Exit Codes for integration with CI/CD pipelines.

See Also

• Interactive Mode - Using the TUI interface
• Non-Interactive Mode - Automation and CI/CD integration
• Examples - Common use cases and workflows