> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Coding Agents

> Use Strix from Claude Code, Cursor, Codex, and other AI agents

Strix is built to be driven by AI coding agents. Install the official agent skills and your agent knows how to run pentests, remediate findings, and wire Strix into CI.

## Install the Skills

Works with any agent that supports the open [SKILL.md standard](https://agentskills.io) — Claude Code, Cursor, Codex, Gemini CLI, OpenCode, and dozens more:

```bash theme={null}
npx skills add usestrix/strix
```

| Skill                                     | What your agent learns                                                                                                             |
| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| `penetration-testing-with-strix`          | Run headless scans against code, URLs, domains, or IPs — self-hosted CLI or managed cloud — with budget caps, and read the results |
| `managed-pentesting-with-strix`           | Drive the managed [app.strix.ai](https://app.strix.ai) platform over REST — no local Docker or LLM key needed                      |
| `fix-security-vulnerabilities-with-strix` | Triage findings, fix root causes, and re-run Strix to verify each fix                                                              |
| `ci-security-scanning-with-strix`         | Add PR security scanning to GitHub Actions or any CI (self-hosted CLI or managed app)                                              |
| `application-security-testing`            | Assess a whole product: choose the right test for each asset, then rank the findings into one remediation plan                     |
| `web-app-penetration-testing`             | Black-box pentest of a live web app or staging site — scope, credentials, and multi-account access-control testing                 |
| `api-security-testing`                    | Test a REST/GraphQL API against the OWASP API Security Top 10 — schema-driven enumeration, BOLA/IDOR, authz                        |
| `owasp-top-10-testing`                    | Systematic OWASP Top 10 assessment with honest per-category coverage                                                               |
| `find-security-vulnerabilities-in-code`   | White-box security review of a repo or working tree, with exploits to confirm findings                                             |

Install a single skill with `npx skills add usestrix/strix --skill penetration-testing-with-strix`, or use one without installing:

```bash theme={null}
npx skills use usestrix/strix@penetration-testing-with-strix | claude
```

## Two ways to run — self-hosted or managed

Both use the same engine and produce the same validated findings and SARIF, so agents can pick per situation or combine them:

* **Open-source CLI (self-hosted)** — runs locally in a Docker sandbox with your own LLM key. Free, fully local, air-gap capable. Best for local dev loops and full control.
* **Managed cloud** — runs on Strix's infrastructure. Drive it with the `strix cloud` CLI (every REST operation has a `strix cloud <resource> <verb>` command) or the [app.strix.ai REST API](https://docs.app.strix.ai) directly. No Docker, no LLM key; adds team dashboards, scheduling, PR reviews, and downloadable PDF/DOCX reports (Enterprise plan). Best in sandboxed/CI environments and for teams. Sign in with `strix cloud login` (browser device sign-in, account created on first use) or create a token in the dashboard under **Settings → API Access**. The `managed-pentesting-with-strix` skill has the full flow.

## Agent-Friendly Interfaces

Everything an agent needs is machine-readable:

* **Headless CLI** — `strix -n` runs without the TUI and exits with `0` (clean), `1` (error), or `2` (vulnerabilities found).
* **Cloud CLI** — `strix cloud` prints JSON when stdout is not a terminal (or with `--json`), never prompts without a TTY, and exits with `0` (success), `1` (error), `2` (usage), `4` (authentication required), or `5` (payment required). Credit top-ups pay the Stripe machine-payment challenge with an agent wallet (`strix cloud billing topup --credits N --yes`). Account setup also runs from the CLI: `strix cloud workspaces list|create|use`, `strix cloud org members invite`, `strix cloud billing subscribe`, `strix cloud billing portal`, and `strix cloud integrations install github`. The last three print a hosted link the user opens to finish the payment or approve the installation.
* **REST API** — the managed platform exposes a documented [OpenAPI](https://docs.app.strix.ai/openapi.json) at `https://app.strix.ai/api/v1` (scans, vulnerabilities, assets, PR reviews, schedules, webhooks) with bearer tokens and scopes.
* **Structured results** — every run writes `vulnerabilities.json`, `vulnerabilities.csv`, `findings.sarif` (SARIF 2.1.0), and per-finding Markdown under `strix_runs/<run-name>/`; the cloud exposes the same as JSON plus SARIF export.
* **Budget controls** — `--max-budget` and `--max-turns` give agents hard cost/time caps.
* **`AGENTS.md`** — the [repository's agent guide](https://github.com/usestrix/strix/blob/main/AGENTS.md) with a quick reference.
* **`llms.txt`** — this documentation is indexed at [docs.strix.ai/llms.txt](https://docs.strix.ai/llms.txt) and fully exported at [docs.strix.ai/llms-full.txt](https://docs.strix.ai/llms-full.txt); every page is also available as Markdown by appending `.md` to its URL.

## Example Prompts

Once the skills are installed, prompts like these just work:

```text theme={null}
Pentest this repo with Strix (quick mode, $10 budget) and summarize the findings.
```

```text theme={null}
Fix all critical and high findings from the last Strix run, then re-scan to verify.
```

```text theme={null}
Add Strix security scanning to our GitHub Actions so every PR gets tested.
```