Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/usestrix/strix/llms.txt

Use this file to discover all available pages before exploring further.

The strix command is the main entry point for running AI-powered penetration tests. You can scan web applications, GitHub repositories, local code, domains, and IP addresses.

​
Usage

strix [OPTIONS]

​
Quick Examples

# Web application penetration test
strix --target https://example.com

# GitHub repository analysis
strix --target https://github.com/user/repo

# Local code analysis
strix --target ./my-project

# Multiple targets (white-box testing)
strix --target ./my-project --target https://staging.example.com

​
Options

​
-t, --target
string
required
Target to test. Can be:
  • URL (e.g., https://example.com)
  • GitHub repository (e.g., https://github.com/user/repo or git@github.com:user/repo.git)
  • Local directory path (e.g., ./my-project)
  • Domain name (e.g., example.com)
  • IP address (e.g., 192.168.1.42)
You can specify this option multiple times for multi-target scans.
​
--instruction
string
Custom instructions for the penetration test. Use this to:
  • Focus on specific vulnerability types (e.g., “Focus on IDOR and XSS”)
  • Specify testing approaches (e.g., “Perform thorough authentication testing”)
  • Provide test credentials (e.g., “Use credentials: admin:password123”)
  • Highlight areas of interest (e.g., “Check login API endpoint for security issues”)
Cannot be used with --instruction-file.
​
--instruction-file
string
Path to a file containing detailed custom instructions for the penetration test.Use this when you have lengthy or complex instructions saved in a file.Example: --instruction-file ./detailed_instructions.txtCannot be used with --instruction.
​
-n, --non-interactive
boolean
default:"false"
Run in non-interactive mode (no TUI, exits on completion).By default, Strix runs in interactive mode with a text-based user interface (TUI). Use this flag for CI/CD pipelines or automated scanning.In non-interactive mode:
  • No TUI is displayed
  • Vulnerabilities are printed to stdout in real-time
  • Process exits automatically when scan completes
  • Exit code 2 is returned if vulnerabilities are found
​
-m, --scan-mode
string
default:"deep"
Scan mode controlling depth and thoroughness.Options:
  • quick - Fast CI/CD checks with basic coverage
  • standard - Routine testing with balanced speed/depth
  • deep - Thorough security reviews (default)
See Scan Modes for detailed comparison.
​
--config
string
Path to a custom config file (JSON) to use instead of ~/.strix/cli-config.json.This allows you to maintain multiple configuration profiles for different environments.
​
-v, --version
boolean
Display the Strix version and exit.

​
Environment Variables

Strix requires certain environment variables to be configured. See the Configuration guide for details.

​
Required

  • STRIX_LLM - Model name to use with litellm (e.g., openai/gpt-4)

​
Optional

  • LLM_API_KEY - API key for the LLM provider (not needed for local models, Vertex AI, AWS, etc.)
  • LLM_API_BASE - Custom API base URL for local models (e.g., Ollama, LMStudio)
  • PERPLEXITY_API_KEY - API key for Perplexity AI web search (enables real-time research)
  • STRIX_REASONING_EFFORT - Reasoning effort level: none, minimal, low, medium, high, xhigh (default: high)

​
Output

Strix creates a timestamped directory in strix_runs/ containing:
  • Vulnerability reports in JSON and Markdown formats
  • Tool execution logs
  • Agent activity traces
  • Scan metadata and statistics
See Reports for details on output format.

​
Exit Codes

In non-interactive mode, Strix uses exit codes to indicate scan results:
  • 0 - Scan completed successfully, no vulnerabilities found
  • 1 - Error occurred during execution
  • 2 - Scan completed successfully, vulnerabilities were found
See Exit Codes for integration with CI/CD pipelines.

​
See Also