strix
Star of the week, issue #2What it is
Open-source AI pentesting agent — 37K stars — that probes your app for vulnerabilities before someone else does.
Featured in
Issue #2 — Agents earn their keep · — the full issue has that week's other tools, reads, and big-lab releases.
More agents tools we've covered
- DeepSeek Harness (dsh) DeepSeek's own agent harness, MIT, built on Cordis and organised so that everything — including the desktop and the Web UI — is a plugin. `npx @deepseek-ai/dsh web` starts a local server on 127.0.0.1:3080 and opens it; the README labels the whole thing a developer preview and warns in capitals that compatibility-breaking changes are coming.
- Agent Governance Toolkit Microsoft's policy enforcement, agent identity, sandboxing, and audit layer for autonomous agents — one pip install, any framework. It intercepts tool calls and delegations before execution with deterministic fail-closed controls, and claims coverage of all ten OWASP Agentic risks. Python, TypeScript/.NET, Rust, and Go.
- reverse-skill A security-research skill router for coding agents: 40+ reverse-engineering, pentest, and CTF workflows with on-demand tool bootstrapping for Ghidra, Frida, IDA Pro, and radare2. Works with Claude Code, Cursor, Cline, and Kiro.
- qm Multiplayer agent harness for teams, in Slack and on the web. Per-person and shared scopes each get their own memory, files, and permissions; runs Pi, OpenCode, Codex, or Claude Code underneath, self-hosted in your own cloud.