Overview
StrixOC runs your code dynamically, finds vulnerabilities, and validates them through real proofs-of-concept. Multi-agent orchestration lets a team of AI pentesters collaborate and scale. Used internally as a reference implementation for SecOpent's adapter path and as a fast-feedback channel for new case-DSL primitives before they land in production.
GitHub Actions / CI integrations and a developer-first CLI keep the loop short. Open-source LLM providers supported; no vendor lock-in.
Pain → Solution → Value
Penetration testing is sold as a once-a-year snapshot — expensive, slow to schedule, and stale the moment the application ships. StrixOC replaces the annual engagement with an autonomous agent team that runs per release, exploits what it finds, and outputs Pydantic-validated, signed findings.
What changes for the team
A wider view of the same loop. Each card zooms into the corresponding column above.
Annual pentest is stale on arrival
- Expensive, slow to schedule, dependent on senior-tester time on your attack surface.
- Between engagements the app keeps shipping — new endpoints, deps, auth paths — none tested.
- Static scanners fill the gap with noise: thousands of unvalidated alerts.
Autonomous red team on tap
- Agent teams (openai-agents SDK + LiteLLM) collaborate like a real red team — recon, exploit, report.
- Operator-defined scope; every step validated against Pydantic — agents cannot drift.
- Agents propose and generate fixes — not just findings.
Continuous coverage, lower cost curve
- Pentesting becomes continuous: a run costs LLM tokens + minutes, not a consulting engagement.
- Time-to-discovery drops from months to the length of a single run.
- Apache-2.0, self-hostable, no single-vendor LLM dependency — cost curve under your control.
Product architecture
Operator declares the boundary from the CLI.
Agent maps routes, params, auth flows, dependencies.
Real exploitation attempts, inside safety rails.
Pydantic-validated findings, ready for CI or tickets.
Every run moves through the same five participants.
Capabilities
By the numbers
- Real PoC validation
- Multi-agent orchestration
- Developer-first CLI
- Auto-fix + reporting
- GitHub Actions integration
- Open-source LLM providers