Hack your own app

Strix sends a team of AI agents at your app. They act like real attackers, prove each hole is real before reporting it, and suggest a fix.

• Open source
• Apache-2.0
• Needs Docker + an LLM key
• 72k stars on 30 Oct 2026

Made by usestrix. I'm not affiliated with them; I just think it's good.

Set it up in 3 steps

You need Docker running and an API key from an LLM provider. In your terminal:

1. Install Strix

   Paste this:

   Copycurl -sSL https://strix.ai/install | bash

2. Add your AI provider

   This uses OpenRouter. The repo lists other providers. Put your own key in place of your-api-key.

   Copyexport STRIX_LLM="openrouter/z-ai/glm-5.3" export LLM_API_KEY="your-api-key"

3. Run your first scan

   Point it at your app folder. The first run pulls a Docker image, and results land in strix_runs/.

   Copystrix --target ./app-directory

Strix itself is free, but the scan uses your LLM key, so you pay your provider for the tokens. Only test apps you own or have written permission to test.