What's Changed

• Fix LiteLLM cost model resolution by @bearsyankees in https://github.com/usestrix/strix/pull/1069
• feat: place caller-provided files into the sandbox workspace (extra_files, --workspace-file) by @yoni-at-strix in https://github.com/usestrix/strix/pull/1085
• feat(reporting): contextual CVSS breakdown on dependency reports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1091
• feat(reporting): require contextual CVSS and usage evidence on dependency reports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1092
• handle resume tokens gracefully by @bearsyankees in https://github.com/usestrix/strix/pull/1097
• Add OWASP LLM Top 10 2026 skill coverage by @bearsyankees in https://github.com/usestrix/strix/pull/1115
• Add Azure and Entra security skill by @bearsyankees in https://github.com/usestrix/strix/pull/1119
• Add argument injection security skill by @bearsyankees in https://github.com/usestrix/strix/pull/1120
• Add ecosystem supply-chain security skills by @bearsyankees in https://github.com/usestrix/strix/pull/1121
• Add Hurl and Hypothesis security playbooks by @bearsyankees in https://github.com/usestrix/strix/pull/1122
• Add semantic browser and Electron security skills by @bearsyankees in https://github.com/usestrix/strix/pull/1123
• Expose viewer host option by @kusonooyasumi in https://github.com/usestrix/strix/pull/1127
• Drop strict tool schemas on Claude routes by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1136
• fix(tui): preserve cost when state is truncated by @kusonooyasumi in https://github.com/usestrix/strix/pull/1086
• fix(tui): use single space after ordered-list marker by @OpenPay-App in https://github.com/usestrix/strix/pull/1043
• fix(report): raise RuntimeError on non-object run.json (fixes #1109) by @vardhans07 in https://github.com/usestrix/strix/pull/1116
• better skills by @bearsyankees in https://github.com/usestrix/strix/pull/1139
• perf: take heavy imports off the startup path and pre-warm them in the background by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1141
• perf: bootstrap Caido concurrently with the scan start by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1143
• feat(agents): evidence discipline, and coverage as a first-class artifact by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/961
• Add MCP server support by @yoni-at-strix in https://github.com/usestrix/strix/pull/1137
• Treat literal 'null'/'none' strings as absent for optional tool args by @bearsyankees in https://github.com/usestrix/strix/pull/1164
• fix(update): re-exec runs the new binary after self-update (endless update-prompt loop) by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1168
• fix(tui): restore base foreground after ANSI resets by @bearsyankees in https://github.com/usestrix/strix/pull/1169
• Scope threat models to the current run instead of caching them on disk by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1178
• Reach MCP tools on demand instead of registering every one by @yoni-at-strix in https://github.com/usestrix/strix/pull/1175
• Isolate MCP connections per task and surface connection status in the UIs by @yoni-at-strix in https://github.com/usestrix/strix/pull/1181
• fix(llm): only attach prompt-cache points on routes LiteLLM serves by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1186
• fix(llm): bind dedupe credentials to a provider; send reasoning=max via extra_body by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1187
• fix(report): keep strix.report import-light so it never races the warm-up thread into the agents SDK graph by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1188
• Fix user message retry lifecycle and TUI sync by @0xallam in https://github.com/usestrix/strix/pull/1193
• csv injection hardening by @bearsyankees in https://github.com/usestrix/strix/pull/1203
• fix(viewer): harden PDF report rendering by @kusonooyasumi in https://github.com/usestrix/strix/pull/1192
• fix(runtime): stage extra-file bind mounts where a remote docker daemon can see them by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1211
• Make MCP connections survive transient transport failures by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1184
• feat(cli): strix cloud — managed platform CLI (login, scans, billing, and the rest of the API) by @bearsyankees in https://github.com/usestrix/strix/pull/1177
• pentest skill cloud cli by @bearsyankees in https://github.com/usestrix/strix/pull/1220
• Forward the workspace header through cli by @bearsyankees in https://github.com/usestrix/strix/pull/1221
• report: add update_vulnerability_report so an agent can revise a filed finding by @bearsyankees in https://github.com/usestrix/strix/pull/1210
• chore: release v1.6.0 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1223

New Contributors

• @OpenPay-App made their first contribution in https://github.com/usestrix/strix/pull/1043
• @vardhans07 made their first contribution in https://github.com/usestrix/strix/pull/1116

Full Changelog: https://github.com/usestrix/strix/compare/v1.5.3...v1.6.0