Strix is an open-source, AI-powered penetration testing tool that orchestrates multiple LLM-driven agents to autonomously discover and validate security vulnerabilities in web applications, APIs, source code, and infrastructure. The system operates as a CLI application with three interface surfaces: a headless/non-interactive mode for CI/CD pipelines, a feature-rich Go Bubble Tea TUI for interactive scanning, and a local React web viewer for reviewing results. Scans run inside Docker sandboxes with a Caido interception proxy sidecar, allowing agents to execute shell commands, browse applications, modify requests, and apply patches. The architecture follows a multi-agent coordination pattern where a root agent delegates tasks to child agents, tracks coverage, manages budgets, and produces comprehensive reports including CVSS-scored vulnerabilities, proof-of-concept exploits, and fix recommendations. The codebase demonstrates strong engineering practices with extensive test coverage, atomic file operations, output bounding, MCP tool integration, and a sophisticated IPC protocol between the Python backend and Go TUI. Key features include: multi-agent orchestration with parent/child messaging and budget enforcement; Docker sandboxed execution with Caido proxy integration; support for multiple LLM providers (OpenAI, Anthropic, LiteLLM, Bedrock, etc.); MCP (Model Context Protocol) tool integration; SARIF and PDF report generation; cloud platform integration for managed scans; and a local web viewer with live transcript and vulnerability triage. The repository is primarily an application but includes data-oriented components like LLM cost tracking, coverage ledgers, and vulnerability deduplication using LLM-based comparison.
CyberStrikeAI is a full-stack, AI-native cybersecurity operations platform designed for autonomous penetration testing and red teaming. It orchestrates multiple AI agents using the CloudWeGo Eino ADK framework to plan and execute complex security assessments. The platform manages its own C2 (Command & Control) infrastructure with encrypted beacons and listeners, integrates with over 100 security tools via the Model Context Protocol (MCP), and maintains a persistent knowledge base and project fact graph. It features a comprehensive governance layer including Role-Based Access Control (RBAC), Human-in-the-Loop (HITL) approval workflows, tool execution guards, and detailed audit logging. The architecture is a monolithic Go-like backend serving a web SPA, with plugins for Burp Suite and Chrome. It supports multi-agent orchestration modes (single, deep, plan-execute, supervisor), a graph-based workflow engine, and integrations with various chat platforms (WeChat, Discord, Telegram). The codebase demonstrates high craftsmanship in its execution governance, process isolation, atomic update mechanism, and database schema reconciliation. A significant technical concern is the use of a non-standard Go dialect (featuring `func`, `type`, and `map` literals) tied to the Eino framework. This creates a hard dependency on a specific toolchain and represents a major drift risk from the standard Go ecosystem, limiting portability and the ability to use standard tooling. Despite this, the project is actively maintained with extensive test coverage and a clear focus on production-grade security automation.