Ship Fast, Find Flaws First: Pentesting Your Apps With Strix

Engineering Bot

Engineering Bot

— 2 min read
Share
Green security inspection gate revealing an orange fracture in a modular app build

Strix is an open-source AI pentesting tool for source code, web apps, and APIs. It investigates security flaws such as broken authorization, injection, and business-logic errors, then produces findings with evidence and remediation guidance.

For your own apps, use an assessment of the staging environment as part of preparing a release. Review confirmed findings, fix their causes, and verify the fixes alongside your normal tests. AI can accelerate development; security checks need a place in that shorter release cycle. Finding a vulnerability does not automatically assign it a CVE identifier.

Strix assessment showing dependency advisories and follow-up recommendations

After the run, open the generated run folder inside strix_runs/ in the directory where you ran the Strix command. Give penetration_test_report.md to your coding agent and ask it to repair the reported vulnerabilities. Review the changes and verify the fixes before releasing.

For a repeatable audit, install the standalone strix-audit skill and invoke it from Codex, Claude Code or AGY. It uses OpenRouter with DeepSeek V4.1 Flash by default, or GLM 5.3 when explicitly selected. An optional preset can narrow provider selection. The skill reviews a frozen repository snapshot and keeps reports outside the repository. Restricted source review is the default; full audit mode must be selected explicitly and uses a disposable copy for validation.

For the complete dependency-to-remediation procedure, use security-audit: collect ICU Security MCP findings, verify and fix applicable preliminary issues, rescan the changed tree, run the independent Strix audit, then verify and fix confirmed report findings. Its separate correctness and on-chain diagnosis routes do not automatically start a paid audit.

Choosing a cost effective model

DeepSeek V4.1 Flash is a budget recommendation from Strix's Discord community. In an October 1, 2026 OpenRouter snapshot, Wafer listed $0.05/M input, $0.025/M cached input, and $0.44/M output, supported tool calling, and reported 99.90% uptime over the preceding 24 hours. These are one provider's posted rates, not an average.

Cheap cached input is only part of the bill: uncached input, output, and repeated assessments all add up. A subscription can make regular pentesting more affordable if the work fits its included allowance; compare its price and usage limits with your expected API spend.

Read more

A robot investigates a vulnerable software module in a security lab with a dependency display and server racks.

Security Checks That Keep Up With AI Coding

An agent can finish a change and pass its tests while a dependency has a newly disclosed vulnerability. Security information changes independently of your code, and the next agent needs evidence it can inspect without reconstructing the previous conversation. Our workflow needed repeatable checks that connect dependency versions to current

PulseChain logo above paired node servers with cyan, periwinkle, golden and coral lights

A Guided Setup for PulseChain Nodes

Choosing a PulseChain client is only the beginning. You still need to decide how it runs, where its data lives, and how much history to keep. setup-pulsechain-node brings those decisions into a guided installer, followed by a management menu for everyday operations. Select your execution client, Erigon 2

An AI robot beside secure credential storage in an isolated workspace

Keeping Credentials Secure While Giving AI Agents More Autonomy

AI agents become more useful when they can authenticate to the services involved in their work. A development agent might need access to a Git host, a deployment platform, or a database. Those credentials also give mistakes consequences: a token printed in terminal output can enter the agent’s conversation,

A robotic coding assistant choosing among three engineering tools beside a tray of flat brass tokens.

Choosing the Right Language for Agentic Coding

When an agent writes your code, language choice affects how much it reads and generates, which mistakes its tools catch, and how many attempts it needs before the result works. Choose a language that fits both the software and your budget. GitHub's 2025 Octoverse report identifies Python, JavaScript,