README.md Modification Review

Overview

The README.md was completely rewritten in a single update. Below is a categorized breakdown of all modifications with before/after comparisons based on codebase exploration.

1. Header & Badges

2. Quick Start Section

3. Run Modes Comparison Table (NEW)

4. Open Source CLI Details (EXPANDED)

5. Strix Cloud CLI (MAJOR EXPANSION - from cloud/spec.py)

6. Agent Skills Integration (NEW SECTION)

7. Features Section (REORGANIZED & EXPANDED)

7.1 Agentic Pentesting Tools

7.2 Comprehensive Vulnerability Scanner

7.3 Graph of Agents (Multi-Agent)

7.4 Skills System (100+ Skills) (NEW - from skills/README.md)

Notable Advanced Skills (from skills/README.md):

• source_aware_whitebox - white-box orchestration
• source_aware_sast - Opengrep/AST/secrets/supply-chain
• browser_security - postMessage, XS-Leaks, service workers
• agentic_system_security - MCP/tool ecosystem
• llm_prompt_injection - direct, indirect, multimodal, memory, tool-result
• argument_injection - CLI option smuggling

7.5 Scan Modes (NEW TABLE)

8. Local Web Viewer (NEW SECTION - from viewer/cli.py)

Features: Findings dashboard, live agent map, past runs, tokened URLs for authorization.

9. Usage Examples (EXPANDED)

9.1 Basic Usage

strix --target ./app-directory             # Local codebase
strix --target https://github.com/org/repo # GitHub repo
strix --target https://your-app.com        # Black-box web app

9.2 API Testing (NEW)

strix --target ./openapi.yaml --target https://api.your-app.com
strix --target postman://<collection-uuid> --target https://api.your-app.com

9.3 Advanced Scenarios (NEW)

strix --target https://your-app.com --instruction "authenticated testing..."
strix -t https://github.com/org/app -t https://your-app.com # Multi-target
strix --target-list ./targets.txt
strix --resume my-run-name
strix -t ./app --max-budget 50 --scan-mode deep
strix -t ./ --scan-mode diff --diff-base origin/main

10. Headless Mode (EXPANDED)

11. CI/CD GitHub Actions (NEW WORKFLOW)

name: strix-penetration-test
on: pull_request

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0 # Full history fetch for diff scope in PR runs
      - run: curl -sSL https://strix.ai/install | bash
      - env:
          STRIX_LLM: ${{ secrets.STRIX_LLM }}
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
        run: strix -n -t ./ --scan-mode quick

12. Configuration (EXPANDED)

12.1 Environment Variables

export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"   # Recommended
export LLM_API_KEY="your-api-key"
export LLM_API_BASE="your-api-base-url"           # For local models (Ollama, LMStudio)

12.2 ChatGPT Subscription Auth (NEW - from main.py/auth_cli.py)

strix auth login chatgpt               # Sign in
export STRIX_LLM="chatgpt/gpt-5.4"     # Use subscription model
strix auth status                      # Show active sign-in

12.3 MCP Server Configuration (NEW - from main.py/config)

// ~/.strix/mcp-servers.json
[
  {
    "name": "github",
    "transport": "http",
    "url": "https://api.githubcopilot.com/mcp/",
    "auth": { "kind": "bearer", "token": "your-token" },
    "allowed_tools": ["list_issues"]
  }
]

Tools namespaced as: github_list_issues

13. Recommended Models (UPDATED with latest models)

14. Documentation Links (COMPREHENSIVE)

15. Legal Disclaimer (ENHANCED)

• Authorized use only warning
• Explicit written permission requirement
• Scope compliance
• No warranty / liability disclaimer

Summary Statistics

Risk Assessment