Restore technical detail in OSS docs

This commit is contained in:
Alex Schapiro
2026-08-14 18:00:29 +00:00
parent 2bc86902a4
commit b79483c6b7
10 changed files with 41 additions and 23 deletions
+1 -1
View File
@@ -124,7 +124,7 @@
"appearance": {
"default": "dark"
},
"description": "Open-source AI agents for application security",
"description": "Open-source AI Hackers to secure your Apps",
"background": {
"decoration": "grid"
}
+2 -2
View File
@@ -1,9 +1,9 @@
---
title: "Introduction"
description: "Open-source AI agents for application security"
description: "Open-source AI hackers to secure your apps"
---
Strix agents test applications like security professionals. They run code dynamically, find vulnerabilities, and validate each finding with a proof of concept. Strix helps developers and security teams test applications without manual pentesting or static-analysis false positives.
Strix agents are autonomous AI agents that act like real hackers. They run your code dynamically, find vulnerabilities, and validate each vulnerability with a proof of concept. Strix helps developers and security teams that need fast and accurate security testing. They avoid the overhead of a manual pentest and the false positives of a static analysis tool.
<Frame>
<img src="/images/screenshot.png" alt="Strix Demo" />
+4 -4
View File
@@ -81,10 +81,10 @@ jobs:
command: strix -n -t ./ --scan-mode quick
```
<Tip>
All CI platforms require Docker access. Ensure your runner has Docker available.
</Tip>
<Note>
All CI platforms require Docker access. Your runner must have Docker available.
</Note>
<Note>
If diff-scope fails in CI, fetch full git history (for example, `fetch-depth: 0` in GitHub Actions) so merge-base and branch comparison can be resolved.
If diff-scope fails in CI, full git history is required for merge-base and branch comparison. In GitHub Actions, use `fetch-depth: 0`.
</Note>
+20 -3
View File
@@ -30,19 +30,36 @@ npx skills use usestrix/strix@penetration-testing-with-strix | claude
Both options provide machine-readable results. Choose the option that fits your environment.
- **Open-source CLI (self-hosted):** Runs locally in a Docker sandbox with your LLM key. This option is free and local.
- **Open-source CLI (self-hosted):** Runs locally in a Docker sandbox with your LLM key. This option is free, local, and air-gap capable.
- **Managed cloud:** Runs on Strix infrastructure through the [app.strix.ai REST API](https://docs.app.strix.ai). This option needs no Docker, LLM key, or local installation. The Enterprise plan adds dashboards, scheduling, pull request reviews, and PDF or DOCX reports.
Create a managed API token under **Settings > API Access**. The `managed-pentesting-with-strix` skill documents the full flow.
## Agent-Friendly Interfaces
Everything an agent needs is machine-readable:
- **Headless CLI:** `strix -n` runs without the TUI. It exits with `0` for a clean scan, `1` for an error, or `2` for vulnerabilities.
- **REST API:** The managed platform exposes a documented [OpenAPI](https://docs.app.strix.ai/openapi.json) at `https://app.strix.ai/api/v1`.
- **Structured results:** Each run writes reports under `strix_runs/<run-name>/`, including JSON, CSV, SARIF, and Markdown files.
The API supports:
- scans
- vulnerabilities
- assets
- pull request reviews
- schedules
- webhooks
The API uses bearer tokens and scopes.
- **Structured results:** Each self-hosted run writes these files under `strix_runs/<run-name>/`:
- `vulnerabilities.json`
- `vulnerabilities.csv`
- `findings.sarif` in SARIF 2.1.0 format
- Per-finding Markdown files
The cloud exposes the same data as JSON and provides SARIF export.
- **Budget controls:** `--max-budget` and `--max-turns` set cost and turn limits.
- **`AGENTS.md`:** The [repository's agent guide](https://github.com/usestrix/strix/blob/main/AGENTS.md) provides a quick reference.
- **`llms.txt`:** The index is available at [docs.strix.ai/llms.txt](https://docs.strix.ai/llms.txt). The full export is available at [docs.strix.ai/llms-full.txt](https://docs.strix.ai/llms-full.txt).
- **`llms.txt`:** The index is available at [docs.strix.ai/llms.txt](https://docs.strix.ai/llms.txt). The full export is available at [docs.strix.ai/llms-full.txt](https://docs.strix.ai/llms-full.txt). Every page is also available as Markdown by appending `.md` to its URL.
## Example Prompts
+3 -3
View File
@@ -61,6 +61,6 @@ The workflow fails when vulnerabilities are found:
Use `quick` mode for PRs to keep feedback fast. Schedule `deep` scans nightly.
</Tip>
<Tip>
For pull_request workflows, Strix automatically uses changed-files diff-scope in CI/headless runs. If diff resolution fails, ensure full history is fetched (`fetch-depth: 0`) or set `--diff-base`.
</Tip>
<Note>
For `pull_request` workflows, Strix automatically uses changed-files diff-scope in CI/headless runs. If diff resolution fails, fetch full history with `fetch-depth: 0` or set `--diff-base`.
</Note>
+4 -4
View File
@@ -17,7 +17,7 @@ Running Strix with local models allows for completely offline, privacy-first sec
<Note>
Strix requires advanced agent capabilities, including tool use, multi-step planning, and self-correction. Most local models under 70B parameters struggle with these tasks.
Critical assessments often require capable cloud models. Local models suit assessments where privacy has priority.
Critical assessments often require capable cloud models, such as Claude 4.5 Sonnet or GPT-5. Local models suit assessments where privacy has priority.
</Note>
## Ollama
@@ -92,9 +92,9 @@ Configure the inference server to parse tool tokens into structured `tool_calls`
- Set a low temperature, such as `--temp 0.2`, to improve tool-call reliability.
**Ollama**
- Use a recent Ollama version and a model whose template supports tools. Ollama refuses tools when the template lacks tool support.
- For reasoning models such as qwen3, disable **thinking** mode. Thinking mode can move tool calls into `content` instead of `tool_calls`. Disable it in Ollama with a non-thinking model or `think: false`.
- Raise **`num_ctx`** to at least 16k. Strix sends a large system prompt and many tool schemas. A small context can truncate the tool definitions and stop valid calls.
- Use a recent Ollama version and a model whose template supports tools. Ollama returns `tools param requires --jinja flag` when the template lacks tool support.
- For reasoning models such as qwen3, disable **thinking** mode. Thinking mode can move tool calls into `content` instead of `tool_calls`. Disable it in Ollama with a non-thinking model or `think: false` in the model parameters or `Modelfile`.
- Raise **`num_ctx`** to at least 16k to 32k. Strix sends a large system prompt and many tool schemas. A small context can truncate the tool definitions and stop valid calls. A short test prompt can look fine while a real scan fails.
**vLLM**
- Start with `--enable-auto-tool-choice`, a matching `--tool-call-parser` (`hermes`, `qwen3_xml`, or `llama3_json`), and a matching `--reasoning-parser` for reasoning models.
+2 -1
View File
@@ -6,7 +6,8 @@ description: "Install Strix and run your first security scan"
## Prerequisites
- Docker (running)
- An LLM provider configuration from a [supported provider](/llm-providers/overview), such as OpenAI, Anthropic, or Google
- Access to a [supported LLM provider](/llm-providers/overview), such as OpenAI, Anthropic, or Google
- Most providers require an API key. Vertex and Bedrock use cloud credentials.
## Installation
+1 -1
View File
@@ -3,7 +3,7 @@ title: "Browser"
description: "Playwright-powered Chrome for web application testing"
---
Strix uses a headless Chrome browser through Playwright to interact with web applications.
Strix uses a headless Chrome browser through Playwright to interact with web applications in the same way as a real user.
## How It Works
+1 -1
View File
@@ -105,7 +105,7 @@ asyncio.run(main())
## Human-in-the-Loop
Strix exposes the Caido proxy to the host machine during automated scans. The TUI displays the Caido URL in the sidebar.
Strix exposes the Caido proxy to the host machine during automated scans. The TUI displays the Caido URL in the sidebar. Click the URL to copy it, then open it in Caido Desktop.
### Accessing Caido
+3 -3
View File
@@ -89,7 +89,7 @@ strix (--target <target> | --target-list <path>) [options]
threshold is crossed (most relevant with several child agents running
concurrently).
- Cost is a best-effort estimate derived from token usage and model pricing.
providers that do not expose priced usage may under-count.
Providers that do not expose priced usage may under-count.
- For LiteLLM-routed models, Strix enables streaming success callbacks to
capture provider-reported cost. Message content remains excluded, but
third-party LiteLLM callbacks configured in the same process can receive
@@ -148,6 +148,6 @@ strix --target-list ./targets.txt
| Code | Meaning |
|------|---------|
| 0 | Scan completed successfully. In headless mode, no vulnerabilities were found. |
| 1 | A fatal error occurred before or during the scan, such as missing variables, unavailable Docker, invalid configuration, or an unhandled error. |
| 0 | Interactive mode always exits with `0`. In headless mode, `0` means that no vulnerabilities were found. |
| 1 | A fatal error occurred before or during the scan. Causes include missing environment variables, unavailable Docker, an invalid config file, diff-scope resolution failure, or an unhandled error. |
| 2 | Vulnerabilities found (headless mode only) |