strix-pentest

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Run a Strix pentest

使用Strix执行渗透测试

Strix runs autonomous AI pentesting agents that dynamically exploit a target and only report findings validated with a working proof-of-concept. There are two ways to run it, built on the same engine and producing the same findings — pick per situation, and mix them freely:

Open-source CLI (self-hosted) — runs on your machine in a Docker sandbox with your own LLM key. Free, fully local, BYO-LLM, air-gap capable. Docs: docs.strix.ai.
Cloud API (managed) — runs on Strix's infrastructure via
```
https://app.strix.ai/api/v1
```
. No Docker, no LLM key, no local compute; adds team dashboards, scheduling, PR reviews, downloadable PDF/DOCX reports (Enterprise plan), and internal-network connectors. Docs: docs.app.strix.ai. Full workflow in the strix-cloud-api skill.

Strix运行自主AI渗透测试Agent，可动态利用目标漏洞，仅报告经过可运行概念验证（PoC）验证的检测结果。有两种运行方式，基于同一引擎，生成相同的检测结果——可根据场景选择，也可自由混合使用：

开源CLI（自托管）——在你的机器上通过Docker沙箱运行，需使用你自己的LLM密钥。免费、完全本地化、自带LLM（BYO-LLM）、支持离线环境。文档：docs.strix.ai。
云API（托管）——通过
```
https://app.strix.ai/api/v1
```
在Strix的基础设施上运行。无需Docker、无需LLM密钥、无需本地计算资源；额外提供团队仪表盘、扫描调度、PR评审、可下载PDF/DOCX报告（企业版）以及内部网络连接器。文档：docs.app.strix.ai。完整工作流请查看strix-cloud-api技能。

Which one? (decide, don't default)

如何选择？（按需选择，不要默认）

Choose honestly based on the situation — neither is "better":

Situation	Prefer
No Docker available, or a sandboxed/hosted agent/CI environment	Cloud
User has no LLM key / doesn't want to pay per-token or manage models	Cloud
Team visibility, shareable dashboard, scheduled/continuous scans, PR reviews, downloadable PDF/DOCX report (Enterprise)	Cloud
Scanning internal/private infrastructure not reachable from your machine	Cloud (network connector)
Source must never leave local infra (privacy/air-gap), or fully offline	OSS CLI
Free / one-off / local dev-loop scan, Docker already present	OSS CLI
BYO or self-hosted LLM, or a specific model not offered by the platform	OSS CLI
CI: runner already has Docker and you want a self-contained gate	OSS CLI
CI: no Docker, or you want results tracked centrally	Cloud

Mix them: e.g. use the OSS CLI for the fast local dev-loop while writing/fixing code, and the Cloud for the authoritative, team-visible scan + report + tracking; or gate PRs with the OSS CLI in CI while the Cloud runs scheduled deep scans and PR reviews across the org. Both emit the same SARIF 2.1.0, so findings line up across environments.

If unsure and the user has (or will create) an app.strix.ai account, prefer Cloud — it avoids all local-infra friction. If they want zero signup / full local control, use the OSS CLI.

根据实际场景如实选择——没有哪一种是“更好”的：

场景	推荐选择
无Docker可用，或处于沙箱/托管Agent/CI环境	云API
用户没有LLM密钥 / 不想按token付费或管理模型	云API
需要团队可见性、可共享仪表盘、定时/持续扫描、PR评审、可下载PDF/DOCX报告（企业版）	云API
扫描内部/私有基础设施，且该基础设施无法从你的机器访问	云API（使用网络连接器）
源代码绝不能离开本地基础设施（隐私/离线需求），或完全离线环境	开源CLI
免费 / 一次性 / 本地开发循环扫描，且已安装Docker	开源CLI
使用自带或自托管的LLM，或平台未提供的特定模型	开源CLI
CI场景：运行器已安装Docker，且需要独立的检查 gate	开源CLI
CI场景：无Docker，或需要集中跟踪扫描结果	云API

混合使用示例：在编写/修复代码时，使用开源CLI进行快速本地开发循环扫描；使用云API进行权威的、团队可见的扫描+报告+跟踪；或者在CI中用开源CLI作为PR检查 gate，同时用云API在整个组织范围内运行定时深度扫描和PR评审。两种方式都输出标准SARIF 2.1.0格式，因此不同环境下的检测结果可以对齐。

如果不确定，且用户已有（或将创建）app.strix.ai账户，优先选择云API——它可以避免所有本地基础设施的配置麻烦。如果用户希望无需注册/完全掌控本地环境，则使用开源CLI。

Option A — Open-source CLI (self-hosted)

选项A — 开源CLI（自托管）

Prerequisites

前置条件

Docker running — check with
```
docker info
```
. The first scan pulls the sandbox image automatically.

Strix installed — check with

strix --version

. Install if missing:

bash

curl -sSL https://strix.ai/install | bash   # or: pipx install strix-agent

LLM configured — two environment variables:

bash

export STRIX_LLM="openai/gpt-5.4"      # any LiteLLM model id (openai/..., anthropic/..., openrouter/...)
export LLM_API_KEY="<provider api key>"

Ask the user for these if unset. Never hardcode or commit keys.

Docker已运行——通过
```
docker info
```
检查。首次扫描会自动拉取沙箱镜像。

已安装Strix——通过

strix --version

检查。若未安装，执行以下命令：

bash

curl -sSL https://strix.ai/install | bash   # 或：pipx install strix-agent

已配置LLM——需设置两个环境变量：

bash

export STRIX_LLM="openai/gpt-5.4"      # 任何LiteLLM模型ID（openai/..., anthropic/..., openrouter/...）
export LLM_API_KEY="<provider api key>"

如果未设置，向用户索要这些信息。切勿硬编码或提交密钥。

Running a scan

运行扫描

Always use

-n

(non-interactive/headless) — the default TUI blocks agents. Always set

--max-budget

unless the user says otherwise.

bash

undefined

始终使用

-n

（非交互式/无头模式）——默认的TUI会阻塞Agent。除非用户特别说明，否则始终设置

--max-budget

。

bash

undefined

Local code (white-box)

本地代码（白盒测试）

strix -n -t ./ --scan-mode standard --max-budget 10

Deployed app / API (black-box)

已部署的应用 / API（黑盒测试）

strix -n -t https://staging.example.com --max-budget 20

Repo + deployed app together (best coverage)

代码仓库 + 已部署应用联合扫描（覆盖范围最佳）

strix -n -t https://github.com/org/app -t https://staging.example.com

Focused testing with credentials or scope hints

使用凭证或范围提示进行针对性测试

strix -n -t https://app.example.com
--instruction "Use credentials user@example.com:pass123. Focus on IDOR and auth bypass."

Large monorepo: bind-mount instead of copying

大型单体仓库：绑定挂载而非复制

strix -n --mount ./huge-monorepo


Key flags:

| Flag | Meaning |
|---|---|
| `-t, --target` | URL, repo URL, local path, domain, or IP. Repeatable. |
| `-n, --non-interactive` | Headless, exits on completion. Required for agents. |
| `-m, --scan-mode` | `quick` (minutes) / `standard` (~30 min) / `deep` (hours, default). |
| `--instruction` / `--instruction-file` | Credentials, focus areas, scope rules. |
| `--max-budget USD` | Hard LLM spend cap; scan wraps up cleanly at the limit. |
| `--max-turns N` | Per-agent turn cap (default 500). |
| `--resume RUN_NAME` | Resume a prior run from `strix_runs/`. |

Scans take minutes (`quick`) to hours (`deep`). Run them in the background and poll for completion rather than blocking.

strix -n --mount ./huge-monorepo


关键参数说明：

| 参数 | 含义 |
|---|---|
| `-t, --target` | URL、代码仓库URL、本地路径、域名或IP。可重复设置。 |
| `-n, --non-interactive` | 无头模式，完成后自动退出。Agent运行必需。 |
| `-m, --scan-mode` | `quick`（数分钟）/ `standard`（约30分钟）/ `deep`（数小时，默认）。 |
| `--instruction` / `--instruction-file` | 凭证、重点测试领域、范围规则。 |
| `--max-budget USD` | LLM支出硬上限；达到上限后扫描会正常结束。 |
| `--max-turns N` | 每个Agent的交互轮次上限（默认500）。 |
| `--resume RUN_NAME` | 从`strix_runs/`恢复之前的扫描任务。 |

扫描耗时从数分钟（`quick`模式）到数小时（`deep`模式）不等。建议在后台运行扫描，轮询完成状态，而非阻塞等待。

Exit codes (headless)

无头模式退出码

```
0
```
— finished with no validated vulnerabilities in what was analyzed
```
1
```
— fatal error (missing env vars, Docker down, bad config)
```
2
```
— vulnerabilities found

is not proof of full coverage: if

--max-budget

--max-turns

is reached before the scan completes, it wraps up early and still exits

. When you need assurance the scan finished, give it enough budget and check

strix_runs/<run>/run.json

: a hard budget stop leaves

status: "stopped"

, but an agent that wrapped up early on a budget warning still calls

finish_scan

and records

"completed"

— so also sanity-check the run's cost against

--max-budget

and the report's stated coverage before treating a clean result as full coverage.

```
0
```
— 扫描完成，在已分析范围内未发现经过验证的漏洞
```
1
```
— 致命错误（缺少环境变量、Docker未运行、配置错误）
```
2
```
— 发现漏洞

并不代表完全覆盖：如果在扫描完成前达到

--max-budget

--max-turns

上限，扫描会提前结束，仍返回

。若需要确认扫描已完成，需分配足够的预算，并检查

strix_runs/<run>/run.json

：因预算硬上限停止的扫描会标记

status: "stopped"

，而因预算警告提前结束的Agent仍会调用

finish_scan

并记录

"completed"

——因此在将干净结果视为完全覆盖之前，还需检查扫描的实际成本与

--max-budget

的对比，以及报告中声明的覆盖范围。

Reading results

查看结果

Artifacts land in

strix_runs/<run-name>/

File	Contents
`penetration_test_report.md`	Executive report — read this first.
`vulnerabilities/*.md`	One file per validated finding, with PoC and remediation.
`vulnerabilities.json` / `vulnerabilities.csv`	All findings as structured JSON / CSV index.
`findings.sarif`	SARIF 2.1.0 for GitHub code scanning / ASPM ingestion.
`run.json`	Run metadata, status, targets, usage/cost.

扫描产物会保存在

strix_runs/<run-name>/

目录下：

文件	内容
`penetration_test_report.md`	执行报告——优先查看此文件。
`vulnerabilities/*.md`	每个经过验证的漏洞对应一个文件，包含PoC和修复建议。
`vulnerabilities.json` / `vulnerabilities.csv`	所有漏洞的结构化JSON / CSV索引。
`findings.sarif`	SARIF 2.1.0格式文件，可用于GitHub代码扫描 / ASPM导入。
`run.json`	扫描元数据、状态、目标、使用情况/成本。

Option B — Cloud API (managed, no local infra)

选项B — 云API（托管，无需本地基础设施）

Full details, asset registration, polling, reports, PR reviews, schedules, and webhooks are in the strix-cloud-api skill. Minimal launch-and-poll:

bash

export STRIX_API_TOKEN="<token>"   # org-scoped bearer, from Settings → API Access at app.strix.ai
BASE=https://app.strix.ai/api/v1

完整详情、资产注册、轮询、报告、PR评审、调度和Webhook请查看strix-cloud-api技能。以下是最小化的启动与轮询流程：

bash

export STRIX_API_TOKEN="<token>"   # 组织级Bearer令牌，可在app.strix.ai的Settings → API Access获取
BASE=https://app.strix.ai/api/v1

1. Launch a scan against an already-registered domain/repo asset

1. 针对已注册的域名/代码仓库资产启动扫描

scan_id=$(curl -sS "$BASE/scans"
-H "Authorization: Bearer $STRIX_API_TOKEN" -H "Content-Type: application/json"
-d '{"engagement_type":"live_test","domain_ids":["<domain-uuid>"]}' | jq -r .scan_id)

2. Poll until terminal (pending → running → completed/failed/cancelled)

2. 轮询直到扫描进入终态（pending → running → completed/failed/cancelled）

curl -sS "$BASE/scans/$scan_id" -H "Authorization: Bearer $STRIX_API_TOKEN" | jq '.status'

3. Read validated findings from the scan detail's

vulnerabilities[]

, or export SARIF

3. 从扫描详情的

vulnerabilities[]

中查看经过验证的漏洞，或导出SARIF格式文件

curl -sS "$BASE/scans/$scan_id/sarif" -H "Authorization: Bearer $STRIX_API_TOKEN" -o findings.sarif


Ask the user to create the token (and register the target as a domain/repository asset) if they haven't. If Docker/local prerequisites aren't already satisfied, use this path instead of trying to install infra.

---

curl -sS "$BASE/scans/$scan_id/sarif" -H "Authorization: Bearer $STRIX_API_TOKEN" -o findings.sarif


如果用户尚未创建令牌（或未将目标注册为域名/代码仓库资产），请告知用户完成这些操作。如果Docker/本地前置条件未满足，优先使用此方式，而非尝试安装基础设施。

---

Reporting & next steps

报告与后续步骤

Summarize findings by severity (critical/high/medium/low/info) and include the PoC evidence. To remediate and verify fixes (via either path), use the strix-fix-findings skill. To wire scanning into CI/CD, use the strix-ci-setup skill.

按漏洞严重程度（critical/high/medium/low/info）汇总检测结果，并包含PoC证据。如需修复漏洞并验证修复效果（无论使用哪种方式），请使用strix-fix-findings技能。如需将扫描集成到CI/CD流程，请使用strix-ci-setup技能。

Safety

安全提示

Only scan targets the user owns or is authorized to test. The Cloud platform enforces domain verification before external scans; for the OSS CLI, confirm authorization yourself if the target looks like third-party infrastructure.

仅扫描用户拥有或已获得授权测试的目标。云平台在进行外部扫描前会强制验证域名；对于开源CLI，如果目标看起来是第三方基础设施，请自行确认是否获得授权。

strix-pentest

Original

Translation

Run a Strix pentest

使用Strix执行渗透测试

Which one? (decide, don't default)

如何选择？（按需选择，不要默认）

Option A — Open-source CLI (self-hosted)

选项A — 开源CLI（自托管）

Prerequisites

前置条件

Running a scan

运行扫描

Local code (white-box)

本地代码（白盒测试）

Deployed app / API (black-box)

已部署的应用 / API（黑盒测试）

Repo + deployed app together (best coverage)

代码仓库 + 已部署应用联合扫描（覆盖范围最佳）

Focused testing with credentials or scope hints

使用凭证或范围提示进行针对性测试

Large monorepo: bind-mount instead of copying

大型单体仓库：绑定挂载而非复制

Exit codes (headless)

无头模式退出码

Reading results

查看结果

Option B — Cloud API (managed, no local infra)

选项B — 云API（托管，无需本地基础设施）

1. Launch a scan against an already-registered domain/repo asset

1. 针对已注册的域名/代码仓库资产启动扫描

2. Poll until terminal (pending → running → completed/failed/cancelled)

2. 轮询直到扫描进入终态（pending → running → completed/failed/cancelled）

3. Read validated findings from the scan detail's
`vulnerabilities[]`
, or export SARIF

3. 从扫描详情的
`vulnerabilities[]`
中查看经过验证的漏洞，或导出SARIF格式文件

Reporting & next steps

报告与后续步骤

Safety

安全提示

strix-pentest

Original

Translation

Run a Strix pentest

使用Strix执行渗透测试

Which one? (decide, don't default)

如何选择？（按需选择，不要默认）

Option A — Open-source CLI (self-hosted)

选项A — 开源CLI（自托管）

Prerequisites

前置条件

Running a scan

运行扫描

Local code (white-box)

本地代码（白盒测试）

Deployed app / API (black-box)

已部署的应用 / API（黑盒测试）

Repo + deployed app together (best coverage)

代码仓库 + 已部署应用联合扫描（覆盖范围最佳）

Focused testing with credentials or scope hints

使用凭证或范围提示进行针对性测试

Large monorepo: bind-mount instead of copying

大型单体仓库：绑定挂载而非复制

Exit codes (headless)

无头模式退出码

Reading results

查看结果

Option B — Cloud API (managed, no local infra)

选项B — 云API（托管，无需本地基础设施）

1. Launch a scan against an already-registered domain/repo asset

1. 针对已注册的域名/代码仓库资产启动扫描

2. Poll until terminal (pending → running → completed/failed/cancelled)

2. 轮询直到扫描进入终态（pending → running → completed/failed/cancelled）

3. Read validated findings from the scan detail's vulnerabilities[], or export SARIF

3. 从扫描详情的vulnerabilities[]中查看经过验证的漏洞，或导出SARIF格式文件

Reporting & next steps

报告与后续步骤

Safety

安全提示

3. Read validated findings from the scan detail's
`vulnerabilities[]`
, or export SARIF

3. 从扫描详情的
`vulnerabilities[]`
中查看经过验证的漏洞，或导出SARIF格式文件