From b79483c6b705a87848a5eb646b8a6ddcef77e7e9 Mon Sep 17 00:00:00 2001 From: Alex Schapiro Date: Fri, 14 Aug 2026 18:00:29 +0000 Subject: [PATCH] Restore technical detail in OSS docs --- docs/docs.json | 2 +- docs/index.mdx | 4 ++-- docs/integrations/ci-cd.mdx | 8 ++++---- docs/integrations/coding-agents.mdx | 23 ++++++++++++++++++++--- docs/integrations/github-actions.mdx | 6 +++--- docs/llm-providers/local.mdx | 8 ++++---- docs/quickstart.mdx | 3 ++- docs/tools/browser.mdx | 2 +- docs/tools/proxy.mdx | 2 +- docs/usage/cli.mdx | 6 +++--- 10 files changed, 41 insertions(+), 23 deletions(-) diff --git a/docs/docs.json b/docs/docs.json index a6dafa42..de23c158 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -124,7 +124,7 @@ "appearance": { "default": "dark" }, - "description": "Open-source AI agents for application security", + "description": "Open-source AI Hackers to secure your Apps", "background": { "decoration": "grid" } diff --git a/docs/index.mdx b/docs/index.mdx index 8463971d..6b86503e 100644 --- a/docs/index.mdx +++ b/docs/index.mdx @@ -1,9 +1,9 @@ --- title: "Introduction" -description: "Open-source AI agents for application security" +description: "Open-source AI hackers to secure your apps" --- -Strix agents test applications like security professionals. They run code dynamically, find vulnerabilities, and validate each finding with a proof of concept. Strix helps developers and security teams test applications without manual pentesting or static-analysis false positives. +Strix agents are autonomous AI agents that act like real hackers. They run your code dynamically, find vulnerabilities, and validate each vulnerability with a proof of concept. Strix helps developers and security teams that need fast and accurate security testing. They avoid the overhead of a manual pentest and the false positives of a static analysis tool. Strix Demo diff --git a/docs/integrations/ci-cd.mdx b/docs/integrations/ci-cd.mdx index 79e7e7ea..4ce67049 100644 --- a/docs/integrations/ci-cd.mdx +++ b/docs/integrations/ci-cd.mdx @@ -81,10 +81,10 @@ jobs: command: strix -n -t ./ --scan-mode quick ``` - -All CI platforms require Docker access. Ensure your runner has Docker available. - + +All CI platforms require Docker access. Your runner must have Docker available. + -If diff-scope fails in CI, fetch full git history (for example, `fetch-depth: 0` in GitHub Actions) so merge-base and branch comparison can be resolved. +If diff-scope fails in CI, full git history is required for merge-base and branch comparison. In GitHub Actions, use `fetch-depth: 0`. diff --git a/docs/integrations/coding-agents.mdx b/docs/integrations/coding-agents.mdx index 8b3bdae8..d1394b31 100644 --- a/docs/integrations/coding-agents.mdx +++ b/docs/integrations/coding-agents.mdx @@ -30,19 +30,36 @@ npx skills use usestrix/strix@penetration-testing-with-strix | claude Both options provide machine-readable results. Choose the option that fits your environment. -- **Open-source CLI (self-hosted):** Runs locally in a Docker sandbox with your LLM key. This option is free and local. +- **Open-source CLI (self-hosted):** Runs locally in a Docker sandbox with your LLM key. This option is free, local, and air-gap capable. - **Managed cloud:** Runs on Strix infrastructure through the [app.strix.ai REST API](https://docs.app.strix.ai). This option needs no Docker, LLM key, or local installation. The Enterprise plan adds dashboards, scheduling, pull request reviews, and PDF or DOCX reports. +Create a managed API token under **Settings > API Access**. The `managed-pentesting-with-strix` skill documents the full flow. + ## Agent-Friendly Interfaces Everything an agent needs is machine-readable: - **Headless CLI:** `strix -n` runs without the TUI. It exits with `0` for a clean scan, `1` for an error, or `2` for vulnerabilities. - **REST API:** The managed platform exposes a documented [OpenAPI](https://docs.app.strix.ai/openapi.json) at `https://app.strix.ai/api/v1`. -- **Structured results:** Each run writes reports under `strix_runs//`, including JSON, CSV, SARIF, and Markdown files. + The API supports: + - scans + - vulnerabilities + - assets + - pull request reviews + - schedules + - webhooks + + The API uses bearer tokens and scopes. +- **Structured results:** Each self-hosted run writes these files under `strix_runs//`: + - `vulnerabilities.json` + - `vulnerabilities.csv` + - `findings.sarif` in SARIF 2.1.0 format + - Per-finding Markdown files + + The cloud exposes the same data as JSON and provides SARIF export. - **Budget controls:** `--max-budget` and `--max-turns` set cost and turn limits. - **`AGENTS.md`:** The [repository's agent guide](https://github.com/usestrix/strix/blob/main/AGENTS.md) provides a quick reference. -- **`llms.txt`:** The index is available at [docs.strix.ai/llms.txt](https://docs.strix.ai/llms.txt). The full export is available at [docs.strix.ai/llms-full.txt](https://docs.strix.ai/llms-full.txt). +- **`llms.txt`:** The index is available at [docs.strix.ai/llms.txt](https://docs.strix.ai/llms.txt). The full export is available at [docs.strix.ai/llms-full.txt](https://docs.strix.ai/llms-full.txt). Every page is also available as Markdown by appending `.md` to its URL. ## Example Prompts diff --git a/docs/integrations/github-actions.mdx b/docs/integrations/github-actions.mdx index c96a5372..db13f961 100644 --- a/docs/integrations/github-actions.mdx +++ b/docs/integrations/github-actions.mdx @@ -61,6 +61,6 @@ The workflow fails when vulnerabilities are found: Use `quick` mode for PRs to keep feedback fast. Schedule `deep` scans nightly. - -For pull_request workflows, Strix automatically uses changed-files diff-scope in CI/headless runs. If diff resolution fails, ensure full history is fetched (`fetch-depth: 0`) or set `--diff-base`. - + +For `pull_request` workflows, Strix automatically uses changed-files diff-scope in CI/headless runs. If diff resolution fails, fetch full history with `fetch-depth: 0` or set `--diff-base`. + diff --git a/docs/llm-providers/local.mdx b/docs/llm-providers/local.mdx index 22530cac..e3143dba 100644 --- a/docs/llm-providers/local.mdx +++ b/docs/llm-providers/local.mdx @@ -17,7 +17,7 @@ Running Strix with local models allows for completely offline, privacy-first sec Strix requires advanced agent capabilities, including tool use, multi-step planning, and self-correction. Most local models under 70B parameters struggle with these tasks. -Critical assessments often require capable cloud models. Local models suit assessments where privacy has priority. +Critical assessments often require capable cloud models, such as Claude 4.5 Sonnet or GPT-5. Local models suit assessments where privacy has priority. ## Ollama @@ -92,9 +92,9 @@ Configure the inference server to parse tool tokens into structured `tool_calls` - Set a low temperature, such as `--temp 0.2`, to improve tool-call reliability. **Ollama** -- Use a recent Ollama version and a model whose template supports tools. Ollama refuses tools when the template lacks tool support. -- For reasoning models such as qwen3, disable **thinking** mode. Thinking mode can move tool calls into `content` instead of `tool_calls`. Disable it in Ollama with a non-thinking model or `think: false`. -- Raise **`num_ctx`** to at least 16k. Strix sends a large system prompt and many tool schemas. A small context can truncate the tool definitions and stop valid calls. +- Use a recent Ollama version and a model whose template supports tools. Ollama returns `tools param requires --jinja flag` when the template lacks tool support. +- For reasoning models such as qwen3, disable **thinking** mode. Thinking mode can move tool calls into `content` instead of `tool_calls`. Disable it in Ollama with a non-thinking model or `think: false` in the model parameters or `Modelfile`. +- Raise **`num_ctx`** to at least 16k to 32k. Strix sends a large system prompt and many tool schemas. A small context can truncate the tool definitions and stop valid calls. A short test prompt can look fine while a real scan fails. **vLLM** - Start with `--enable-auto-tool-choice`, a matching `--tool-call-parser` (`hermes`, `qwen3_xml`, or `llama3_json`), and a matching `--reasoning-parser` for reasoning models. diff --git a/docs/quickstart.mdx b/docs/quickstart.mdx index 33833ff4..7aded604 100644 --- a/docs/quickstart.mdx +++ b/docs/quickstart.mdx @@ -6,7 +6,8 @@ description: "Install Strix and run your first security scan" ## Prerequisites - Docker (running) -- An LLM provider configuration from a [supported provider](/llm-providers/overview), such as OpenAI, Anthropic, or Google +- Access to a [supported LLM provider](/llm-providers/overview), such as OpenAI, Anthropic, or Google +- Most providers require an API key. Vertex and Bedrock use cloud credentials. ## Installation diff --git a/docs/tools/browser.mdx b/docs/tools/browser.mdx index 3bd26516..e337e699 100644 --- a/docs/tools/browser.mdx +++ b/docs/tools/browser.mdx @@ -3,7 +3,7 @@ title: "Browser" description: "Playwright-powered Chrome for web application testing" --- -Strix uses a headless Chrome browser through Playwright to interact with web applications. +Strix uses a headless Chrome browser through Playwright to interact with web applications in the same way as a real user. ## How It Works diff --git a/docs/tools/proxy.mdx b/docs/tools/proxy.mdx index 78a64093..748b1887 100644 --- a/docs/tools/proxy.mdx +++ b/docs/tools/proxy.mdx @@ -105,7 +105,7 @@ asyncio.run(main()) ## Human-in-the-Loop -Strix exposes the Caido proxy to the host machine during automated scans. The TUI displays the Caido URL in the sidebar. +Strix exposes the Caido proxy to the host machine during automated scans. The TUI displays the Caido URL in the sidebar. Click the URL to copy it, then open it in Caido Desktop. ### Accessing Caido diff --git a/docs/usage/cli.mdx b/docs/usage/cli.mdx index c61ec702..b2b623c2 100644 --- a/docs/usage/cli.mdx +++ b/docs/usage/cli.mdx @@ -89,7 +89,7 @@ strix (--target | --target-list ) [options] threshold is crossed (most relevant with several child agents running concurrently). - Cost is a best-effort estimate derived from token usage and model pricing. - providers that do not expose priced usage may under-count. + Providers that do not expose priced usage may under-count. - For LiteLLM-routed models, Strix enables streaming success callbacks to capture provider-reported cost. Message content remains excluded, but third-party LiteLLM callbacks configured in the same process can receive @@ -148,6 +148,6 @@ strix --target-list ./targets.txt | Code | Meaning | |------|---------| -| 0 | Scan completed successfully. In headless mode, no vulnerabilities were found. | -| 1 | A fatal error occurred before or during the scan, such as missing variables, unavailable Docker, invalid configuration, or an unhandled error. | +| 0 | Interactive mode always exits with `0`. In headless mode, `0` means that no vulnerabilities were found. | +| 1 | A fatal error occurred before or during the scan. Causes include missing environment variables, unavailable Docker, an invalid config file, diff-scope resolution failure, or an unhandled error. | | 2 | Vulnerabilities found (headless mode only) |