Strix is an open-source, AI-powered penetration testing tool that orchestrates multiple LLM-driven agents to autonomously discover and validate security vulnerabilities in web applications, APIs, source code, and infrastructure. The system operates as a CLI application with three interface surfaces: a headless/non-interactive mode for CI/CD pipelines, a feature-rich Go Bubble Tea TUI for interactive scanning, and a local React web viewer for reviewing results. Scans run inside Docker sandboxes with a Caido interception proxy sidecar, allowing agents to execute shell commands, browse applications, modify requests, and apply patches. The architecture follows a multi-agent coordination pattern where a root agent delegates tasks to child agents, tracks coverage, manages budgets, and produces comprehensive reports including CVSS-scored vulnerabilities, proof-of-concept exploits, and fix recommendations. The codebase demonstrates strong engineering practices with extensive test coverage, atomic file operations, output bounding, MCP tool integration, and a sophisticated IPC protocol between the Python backend and Go TUI. Key features include: multi-agent orchestration with parent/child messaging and budget enforcement; Docker sandboxed execution with Caido proxy integration; support for multiple LLM providers (OpenAI, Anthropic, LiteLLM, Bedrock, etc.); MCP (Model Context Protocol) tool integration; SARIF and PDF report generation; cloud platform integration for managed scans; and a local web viewer with live transcript and vulnerability triage. The repository is primarily an application but includes data-oriented components like LLM cost tracking, coverage ledgers, and vulnerability deduplication using LLM-based comparison.
Shannon is an autonomous, white-box AI penetration testing platform that orchestrates multi-agent workflows via Temporal to analyze source code, identify attack vectors, and execute real exploits against running web applications. The system is structured as a pnpm monorepo with two primary applications: a CLI (`apps/cli`) that provides the user-facing interface for launching scans, and a worker (`apps/worker`) that runs the actual pentest pipeline inside Docker containers. The architecture follows a multi-agent pipeline pattern with 13 specialized agents (pre-recon, recon, 5 vulnerability analyzers, 5 exploiters, and a report generator) coordinated through Temporal workflows for reliability and resumability. The codebase demonstrates strong software engineering practices with a clear separation of concerns between Temporal orchestration (activities/workflows), pure domain logic (services), and infrastructure concerns. The worker implements a sophisticated DI container pattern, comprehensive audit logging with crash-safe append-only streams, and a custom error classification system that maps errors to Temporal retry behavior. The system supports multiple LLM providers (Anthropic direct, AWS Bedrock, Google Vertex AI, custom proxies) and implements defense-in-depth billing detection, git checkpointing for workspace rollback, and parallel agent execution with mutex-protected shared state. Key architectural strengths include the deterministic renderer pattern (MCP tool calls → markdown without LLM in the loop), the injectable provider interfaces for extensibility, and the sophisticated session management that enables resumable workspaces. The codebase uses TypeScript with strict compiler options, implements a Result type for explicit error handling, and maintains comprehensive type definitions. The CI/CD pipeline includes semantic releases, Docker image signing with cosign, and multi-platform builds. The system processes vulnerability queues through Zod-validated structured outputs and maintains forensic audit trails of all agent executions with timing, cost, and model metadata.