mirror of
https://github.com/usestrix/strix.git
synced 2026-11-09 13:31:41 -10:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Ian
|
cbe0597772 | ||
|
ian-at-strix
|
d6f4bc5ced | ||
|
Ahmed Allam
|
4ac5dc65e4 | ||
|
Ahmed Allam
|
4bf353fb7b | ||
|
Ahmed Allam
|
f121ab03fb | ||
|
Ahmed Allam
|
2c9e9f3444 |
No files matched your search
@@ -28,7 +28,7 @@ Target-specific workflows built on the same engine:
|
||||
- **Open-source CLI (self-hosted):** free, fully local, BYO LLM key, needs Docker. Best for local dev loops, air-gapped/offline, and full control.
|
||||
```bash
|
||||
curl -sSL https://strix.ai/install | bash # install
|
||||
export STRIX_LLM="openrouter/z-ai/glm-5.3" # any LiteLLM model id
|
||||
export STRIX_LLM="openrouter/z-ai/glm-5.3" # any LiteLLM model id, or vercel_ai_gateway/zai/glm-5.3
|
||||
export LLM_API_KEY="<key>"
|
||||
strix -n -t ./ --scan-mode quick --max-budget 10 # headless scan; always use -n
|
||||
```
|
||||
|
||||
+1
-1
@@ -31,7 +31,7 @@ Thank you for your interest in contributing to Strix! This guide will help you g
|
||||
|
||||
3. **Configure your LLM provider**
|
||||
```bash
|
||||
export STRIX_LLM="openrouter/z-ai/glm-5.3"
|
||||
export STRIX_LLM="openrouter/z-ai/glm-5.3" # or vercel_ai_gateway/zai/glm-5.3
|
||||
export LLM_API_KEY="your-api-key"
|
||||
```
|
||||
|
||||
|
||||
@@ -84,7 +84,8 @@ Strix are autonomous AI penetration testing agents that act just like real hacke
|
||||
curl -sSL https://strix.ai/install | bash
|
||||
|
||||
# Configure your AI provider
|
||||
export STRIX_LLM="openrouter/z-ai/glm-5.3"
|
||||
export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3" # Vercel AI Gateway
|
||||
# export STRIX_LLM="openrouter/z-ai/glm-5.3" # OpenRouter
|
||||
export LLM_API_KEY="your-api-key"
|
||||
|
||||
# Run your first security assessment
|
||||
@@ -296,7 +297,8 @@ jobs:
|
||||
### Configuration
|
||||
|
||||
```bash
|
||||
export STRIX_LLM="openrouter/z-ai/glm-5.3"
|
||||
export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3" # Vercel AI Gateway
|
||||
# export STRIX_LLM="openrouter/z-ai/glm-5.3" # OpenRouter
|
||||
export LLM_API_KEY="your-api-key"
|
||||
|
||||
# Optional
|
||||
@@ -352,12 +354,14 @@ Each server's tools are namespaced by `name`, for example `github_list_issues`.
|
||||
|
||||
**Recommended models for best results:**
|
||||
|
||||
- [Z.ai GLM-5.3 on OpenRouter](https://openrouter.ai/z-ai/glm-5.3) - `openrouter/z-ai/glm-5.3` (the default pick)
|
||||
- [OpenAI GPT-5.4](https://openai.com/api/) - `openai/gpt-5.4`
|
||||
- [Anthropic Claude Sonnet 4.6](https://claude.com/platform/api) - `anthropic/claude-sonnet-4-6`
|
||||
- [Google Gemini 3 Pro Preview](https://cloud.google.com/vertex-ai) - `vertex_ai/gemini-3-pro-preview`
|
||||
- [Z.ai GLM-5.3 on Vercel AI Gateway](https://vercel.com/ai-gateway/models/glm-5.3) - `vercel_ai_gateway/zai/glm-5.3` (recommended)
|
||||
- [Z.ai GLM-5.3 on OpenRouter](https://openrouter.ai/z-ai/glm-5.3) - `openrouter/z-ai/glm-5.3` (recommended)
|
||||
- [DeepSeek V4.1 Flash on OpenRouter](https://openrouter.ai/deepseek/deepseek-v4.1-flash-1017) - `openrouter/deepseek/deepseek-v4.1-flash-1017`
|
||||
- [OpenAI GPT-6.1 Sol](https://openai.com/api/) - `openai/gpt-6.1-sol` (needs [Daybreak](https://openai.com/daybreak/) access)
|
||||
- [Anthropic Claude Opus 5.5](https://claude.com/platform/api) - `anthropic/claude-opus-5-5` (needs [CVP](https://support.claude.com/en/articles/14604842-cyber-verification-program) access)
|
||||
- [Google Gemini 4 Argon](https://cloud.google.com/vertex-ai) - `vertex_ai/gemini-4-argon` (needs [Fairwind](https://deepmind.google/fairwind-program/) access)
|
||||
- [DeepSeek V4 Pro](https://platform.deepseek.com) - `deepseek/deepseek-v4-pro`
|
||||
- [Moonshot Kimi K3](https://platform.kimi.ai) - `moonshot/kimi-k3`
|
||||
- [Moonshot Kimi K3.1 Pro](https://platform.kimi.ai) - `moonshot/kimi-k3.1-pro`
|
||||
|
||||
See the [LLM Providers documentation](https://docs.strix.ai/llm-providers/overview) for all supported providers including Vertex AI, Bedrock, Azure, and local models.
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@ Configure Strix using environment variables or a config file.
|
||||
## LLM Configuration
|
||||
|
||||
<ParamField path="STRIX_LLM" type="string" required>
|
||||
Model name in LiteLLM format (e.g., `openrouter/z-ai/glm-5.3`, `openai/gpt-5.4`).
|
||||
Model name in LiteLLM format (e.g., `openrouter/z-ai/glm-5.3`, `openai/gpt-6.1-sol`).
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="LLM_API_KEY" type="string">
|
||||
|
||||
+1
-1
@@ -35,8 +35,8 @@
|
||||
"llm-providers/overview",
|
||||
"llm-providers/openai",
|
||||
"llm-providers/anthropic",
|
||||
"llm-providers/openrouter",
|
||||
"llm-providers/vercel-ai-gateway",
|
||||
"llm-providers/openrouter",
|
||||
"llm-providers/vertex",
|
||||
"llm-providers/bedrock",
|
||||
"llm-providers/azure",
|
||||
|
||||
+15
-1
@@ -73,7 +73,20 @@ Strix uses a graph of specialized agents for comprehensive security testing:
|
||||
|
||||
## Quick Example
|
||||
|
||||
```bash
|
||||
<CodeGroup>
|
||||
```bash Vercel AI Gateway
|
||||
# Install
|
||||
curl -sSL https://strix.ai/install | bash
|
||||
|
||||
# Configure
|
||||
export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"
|
||||
export LLM_API_KEY="your-api-key"
|
||||
|
||||
# Scan
|
||||
strix --target ./your-app
|
||||
```
|
||||
|
||||
```bash OpenRouter
|
||||
# Install
|
||||
curl -sSL https://strix.ai/install | bash
|
||||
|
||||
@@ -84,6 +97,7 @@ export LLM_API_KEY="your-api-key"
|
||||
# Scan
|
||||
strix --target ./your-app
|
||||
```
|
||||
</CodeGroup>
|
||||
|
||||
## Community
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@ description: "Configure Strix with Claude models"
|
||||
## Setup
|
||||
|
||||
```bash
|
||||
export STRIX_LLM="anthropic/claude-sonnet-4-6"
|
||||
export STRIX_LLM="anthropic/claude-sonnet-5-5"
|
||||
export LLM_API_KEY="sk-ant-..."
|
||||
```
|
||||
|
||||
@@ -14,8 +14,12 @@ export LLM_API_KEY="sk-ant-..."
|
||||
|
||||
| Model | Description |
|
||||
|-------|-------------|
|
||||
| `anthropic/claude-sonnet-4-6` | Best balance of intelligence and speed |
|
||||
| `anthropic/claude-opus-4-6` | Maximum capability for deep analysis |
|
||||
| `anthropic/claude-sonnet-5-5` | Best balance of intelligence and speed |
|
||||
| `anthropic/claude-opus-5-5` | Maximum capability for deep analysis |
|
||||
|
||||
<Note>
|
||||
Security testing with Claude needs the [Cyber Verification Program](https://support.claude.com/en/articles/14604842-cyber-verification-program) (CVP). Without it the safety classifiers block most offensive tasks. Red Team Access covers authorized penetration testing.
|
||||
</Note>
|
||||
|
||||
## Get API Key
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@ description: "Configure Strix with OpenAI models via Azure"
|
||||
## Setup
|
||||
|
||||
```bash
|
||||
export STRIX_LLM="azure/your-gpt5-deployment"
|
||||
export STRIX_LLM="azure/your-gpt6-deployment"
|
||||
export AZURE_API_KEY="your-azure-api-key"
|
||||
export AZURE_API_BASE="https://your-resource.openai.azure.com"
|
||||
export AZURE_API_VERSION="2025-11-01-preview"
|
||||
@@ -24,7 +24,7 @@ export AZURE_API_VERSION="2025-11-01-preview"
|
||||
## Example
|
||||
|
||||
```bash
|
||||
export STRIX_LLM="azure/gpt-5.4-deployment"
|
||||
export STRIX_LLM="azure/gpt-6.1-sol-deployment"
|
||||
export AZURE_API_KEY="abc123..."
|
||||
export AZURE_API_BASE="https://mycompany.openai.azure.com"
|
||||
export AZURE_API_VERSION="2025-11-01-preview"
|
||||
@@ -33,5 +33,9 @@ export AZURE_API_VERSION="2025-11-01-preview"
|
||||
## Prerequisites
|
||||
|
||||
1. Create an Azure OpenAI resource
|
||||
2. Deploy a model (e.g., GPT-5.4)
|
||||
2. Deploy a model such as GPT-6.1 Sol
|
||||
3. Get the endpoint URL and API key from the Azure portal
|
||||
|
||||
<Note>
|
||||
Security testing with OpenAI models needs [Daybreak](https://openai.com/daybreak/) access, also on Azure.
|
||||
</Note>
|
||||
@@ -6,7 +6,7 @@ description: "Configure Strix with models via AWS Bedrock"
|
||||
## Setup
|
||||
|
||||
```bash
|
||||
export STRIX_LLM="bedrock/anthropic.claude-4-5-sonnet-20251022-v1:0"
|
||||
export STRIX_LLM="bedrock/us.anthropic.claude-sonnet-5-5"
|
||||
```
|
||||
|
||||
No API key required—uses AWS credentials from environment.
|
||||
@@ -36,10 +36,13 @@ Automatically uses instance role credentials.
|
||||
|
||||
| Model | Description |
|
||||
|-------|-------------|
|
||||
| `bedrock/anthropic.claude-4-5-sonnet-20251022-v1:0` | Claude 4.5 Sonnet |
|
||||
| `bedrock/anthropic.claude-4-5-opus-20251022-v1:0` | Claude 4.5 Opus |
|
||||
| `bedrock/anthropic.claude-4-5-haiku-20251022-v1:0` | Claude 4.5 Haiku |
|
||||
| `bedrock/amazon.titan-text-premier-v2:0` | Amazon Titan Premier v2 |
|
||||
| `bedrock/us.anthropic.claude-sonnet-5-5` | Claude Sonnet 5.5 |
|
||||
| `bedrock/us.anthropic.claude-opus-5-5` | Claude Opus 5.5 |
|
||||
| `bedrock/us.anthropic.claude-haiku-5-5` | Claude Haiku 5.5 |
|
||||
|
||||
<Note>
|
||||
Security testing with Claude needs the [Cyber Verification Program](https://support.claude.com/en/articles/14604842-cyber-verification-program) (CVP), also on Bedrock.
|
||||
</Note>
|
||||
|
||||
## Prerequisites
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@ description: "Configure Strix with Novita AI models"
|
||||
## Setup
|
||||
|
||||
```bash
|
||||
export STRIX_LLM="openai/moonshotai/kimi-k2.5"
|
||||
export STRIX_LLM="openai/zai-org/glm-5.3"
|
||||
export LLM_API_KEY="your-novita-api-key"
|
||||
export LLM_API_BASE="https://api.novita.ai/openai"
|
||||
```
|
||||
@@ -18,11 +18,12 @@ export LLM_API_BASE="https://api.novita.ai/openai"
|
||||
| Model | Configuration |
|
||||
|-------|---------------|
|
||||
| GLM-5.3 | `openai/zai-org/glm-5.3` |
|
||||
| Kimi K3.1 Pro | `openai/moonshotai/kimi-k3.1-pro` |
|
||||
| Kimi K3 | `openai/moonshotai/kimi-k3` |
|
||||
| DeepSeek V4.1 Flash | `openai/deepseek/deepseek-v4.1-flash-1017` |
|
||||
| DeepSeek V4 Pro | `openai/deepseek/deepseek-v4-pro` |
|
||||
| Kimi K2.5 | `openai/moonshotai/kimi-k2.5` |
|
||||
| GLM-5 | `openai/zai-org/glm-5` |
|
||||
| MiniMax M2.5 | `openai/minimax/minimax-m2.5` |
|
||||
| MiniMax M3.1 Flash | `openai/minimax/minimax-m3.1-flash` |
|
||||
| GLM-5.3 Flash | `openai/zai-org/glm-5.3-flash` |
|
||||
|
||||
## Get API Key
|
||||
|
||||
|
||||
@@ -6,13 +6,23 @@ description: "Configure Strix with OpenAI models"
|
||||
## Setup
|
||||
|
||||
```bash
|
||||
export STRIX_LLM="openai/gpt-5.4"
|
||||
export STRIX_LLM="openai/gpt-6.1-sol"
|
||||
export LLM_API_KEY="sk-..."
|
||||
```
|
||||
|
||||
## Available Models
|
||||
|
||||
See [OpenAI Models Documentation](https://platform.openai.com/docs/models) for the full list of available models.
|
||||
| Model | Description |
|
||||
|-------|-------------|
|
||||
| `openai/gpt-6.1-sol` | Best balance of capability and cost for agentic security work |
|
||||
| `openai/gpt-6-astra` | Flagship, maximum capability |
|
||||
| `openai/gpt-6-luna` | Fast and cheap |
|
||||
|
||||
See [OpenAI Models Documentation](https://platform.openai.com/docs/models) for the full list.
|
||||
|
||||
<Note>
|
||||
Security testing with OpenAI models needs [Daybreak](https://openai.com/daybreak/) (Trusted Access for Cyber). Without it the models refuse most offensive tasks. [Request access](https://openai.com/form/enterprise-trusted-access-for-cyber/).
|
||||
</Note>
|
||||
|
||||
## Get API Key
|
||||
|
||||
@@ -25,7 +35,7 @@ See [OpenAI Models Documentation](https://platform.openai.com/docs/models) for t
|
||||
For OpenAI-compatible APIs:
|
||||
|
||||
```bash
|
||||
export STRIX_LLM="openai/gpt-5.4"
|
||||
export STRIX_LLM="openai/gpt-6.1-sol"
|
||||
export LLM_API_KEY="your-key"
|
||||
export LLM_API_BASE="https://your-proxy.com/v1"
|
||||
```
|
||||
@@ -18,13 +18,19 @@ Access any model on OpenRouter using the format `openrouter/<provider>/<model>`:
|
||||
|
||||
| Model | Configuration |
|
||||
|-------|---------------|
|
||||
| GLM-5.3 (default) | `openrouter/z-ai/glm-5.3` |
|
||||
| GPT-5.4 | `openrouter/openai/gpt-5.4` |
|
||||
| Claude Sonnet 4.6 | `openrouter/anthropic/claude-sonnet-4.6` |
|
||||
| Gemini 3 Pro | `openrouter/google/gemini-3-pro-preview` |
|
||||
| GLM-5.3 (recommended) | `openrouter/z-ai/glm-5.3` |
|
||||
| GPT-6.1 Sol | `openrouter/openai/gpt-6.1-sol` |
|
||||
| GPT-6 Astra | `openrouter/openai/gpt-6-astra` |
|
||||
| Claude Opus 5.5 | `openrouter/anthropic/claude-opus-5.5` |
|
||||
| Claude Sonnet 5.5 | `openrouter/anthropic/claude-sonnet-5.5` |
|
||||
| Gemini 4 Argon | `openrouter/google/gemini-4-argon` |
|
||||
| Gemini 3.8 Flash | `openrouter/google/gemini-3.8-flash` |
|
||||
| DeepSeek V4.1 Flash | `openrouter/deepseek/deepseek-v4.1-flash-1017` |
|
||||
| DeepSeek V4 Pro | `openrouter/deepseek/deepseek-v4-pro` |
|
||||
| Kimi K3 | `openrouter/moonshotai/kimi-k3` |
|
||||
| GLM-4.7 | `openrouter/z-ai/glm-4.7` |
|
||||
| Kimi K3.1 Pro | `openrouter/moonshotai/kimi-k3.1-pro` |
|
||||
| GLM-5.3 Flash | `openrouter/z-ai/glm-5.3-flash` |
|
||||
|
||||
OpenAI, Anthropic and Gemini models keep their provider safeguards on OpenRouter. Security testing with them needs [Daybreak](https://openai.com/daybreak/), [CVP](https://support.claude.com/en/articles/14604842-cyber-verification-program) or [Fairwind](https://deepmind.google/fairwind-program/) access.
|
||||
|
||||
## Get API Key
|
||||
|
||||
|
||||
@@ -9,19 +9,33 @@ Strix uses [LiteLLM](https://docs.litellm.ai/docs/providers) for model compatibi
|
||||
|
||||
Set your model and API key:
|
||||
|
||||
| Model | Provider | Configuration |
|
||||
| -------------------- | ----------------- | -------------------------------- |
|
||||
| GLM-5.3 (default) | Z.ai (OpenRouter) | `openrouter/z-ai/glm-5.3` |
|
||||
| GPT-5.4 | OpenAI | `openai/gpt-5.4` |
|
||||
| Claude Sonnet 4.6 | Anthropic | `anthropic/claude-sonnet-4-6` |
|
||||
| Gemini 3 Pro | Google Vertex | `vertex_ai/gemini-3-pro-preview` |
|
||||
| DeepSeek V4 Pro | DeepSeek | `deepseek/deepseek-v4-pro` |
|
||||
| Kimi K3 | Moonshot | `moonshot/kimi-k3` |
|
||||
| Model | Provider | Configuration |
|
||||
| --------------------- | ------------------------- | -------------------------------- |
|
||||
| GLM-5.3 (recommended) | Vercel AI Gateway | `vercel_ai_gateway/zai/glm-5.3` |
|
||||
| GLM-5.3 (recommended) | OpenRouter | `openrouter/z-ai/glm-5.3` |
|
||||
| GPT-6.1 Sol | OpenAI | `openai/gpt-6.1-sol` |
|
||||
| Claude Opus 5.5 | Anthropic | `anthropic/claude-opus-5-5` |
|
||||
| Claude Sonnet 5.5 | Anthropic | `anthropic/claude-sonnet-5-5` |
|
||||
| Gemini 4 Argon | Google Vertex | `vertex_ai/gemini-4-argon` |
|
||||
| DeepSeek V4.1 Flash | DeepSeek | `deepseek/deepseek-flash` |
|
||||
| DeepSeek V4 Pro | DeepSeek | `deepseek/deepseek-v4-pro` |
|
||||
| Kimi K3.1 Pro | Moonshot | `moonshot/kimi-k3.1-pro` |
|
||||
|
||||
```bash
|
||||
<Note>
|
||||
Frontier OpenAI, Anthropic and Gemini models need a cyber access program for security testing: [Daybreak](https://openai.com/daybreak/) for OpenAI, the [Cyber Verification Program](https://support.claude.com/en/articles/14604842-cyber-verification-program) for Anthropic, and the [Fairwind Program](https://deepmind.google/fairwind-program/) for Gemini.
|
||||
</Note>
|
||||
|
||||
<CodeGroup>
|
||||
```bash Vercel AI Gateway
|
||||
export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"
|
||||
export LLM_API_KEY="your-api-key"
|
||||
```
|
||||
|
||||
```bash OpenRouter
|
||||
export STRIX_LLM="openrouter/z-ai/glm-5.3"
|
||||
export LLM_API_KEY="your-api-key"
|
||||
```
|
||||
</CodeGroup>
|
||||
|
||||
## Local Models
|
||||
|
||||
@@ -47,7 +61,7 @@ See the [Local Models guide](/llm-providers/local) for setup instructions and re
|
||||
Access 100+ models through a single API.
|
||||
</Card>
|
||||
<Card title="Vercel AI Gateway" href="/llm-providers/vercel-ai-gateway">
|
||||
Access models from multiple providers through one endpoint.
|
||||
Access 100+ models through one OpenAI-compatible endpoint.
|
||||
</Card>
|
||||
<Card title="Google Vertex AI" href="/llm-providers/vertex">
|
||||
Gemini 3 models via Google Cloud.
|
||||
@@ -69,9 +83,9 @@ Use LiteLLM's `provider/model-name` format:
|
||||
|
||||
```
|
||||
openrouter/z-ai/glm-5.3
|
||||
openai/gpt-5.4
|
||||
anthropic/claude-sonnet-4-6
|
||||
vertex_ai/gemini-3-pro-preview
|
||||
bedrock/anthropic.claude-4-5-sonnet-20251022-v1:0
|
||||
openai/gpt-6.1-sol
|
||||
anthropic/claude-sonnet-5-5
|
||||
vertex_ai/gemini-4-argon
|
||||
bedrock/us.anthropic.claude-sonnet-5-5
|
||||
ollama/llama4
|
||||
```
|
||||
@@ -1,32 +1,47 @@
|
||||
---
|
||||
title: "Vercel AI Gateway"
|
||||
description: "Configure Strix with models via Vercel AI Gateway"
|
||||
description: "Configure Strix with models through Vercel AI Gateway"
|
||||
---
|
||||
|
||||
[Vercel AI Gateway](https://vercel.com/docs/ai-gateway) provides an OpenAI-compatible API for models from multiple providers.
|
||||
[Vercel AI Gateway](https://vercel.com/docs/ai-gateway) provides access to 100+ models from multiple providers through one OpenAI-compatible API.
|
||||
|
||||
## Setup
|
||||
|
||||
Create an [AI Gateway API key](https://vercel.com/docs/ai-gateway/authentication-and-byok), then configure Strix:
|
||||
|
||||
```bash
|
||||
export STRIX_LLM="openai/anthropic/claude-opus-5"
|
||||
export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"
|
||||
export LLM_API_KEY="your-ai-gateway-api-key"
|
||||
export LLM_API_BASE="https://ai-gateway.vercel.sh/v1"
|
||||
```
|
||||
|
||||
The first `openai/` segment tells Strix to use its OpenAI-compatible client. The remaining value is the [AI Gateway model ID](https://vercel.com/docs/ai-gateway/models-and-providers).
|
||||
The `vercel_ai_gateway/` prefix selects the Gateway. The remaining value is the [AI Gateway model ID](https://vercel.com/docs/ai-gateway/models-and-providers).
|
||||
|
||||
## Available Models
|
||||
|
||||
Use any language model returned by the AI Gateway models endpoint:
|
||||
Access any model on the Gateway using the format `vercel_ai_gateway/<provider>/<model>`:
|
||||
|
||||
| Model | Configuration |
|
||||
|-------|---------------|
|
||||
| GLM-5.3 (recommended) | `vercel_ai_gateway/zai/glm-5.3` |
|
||||
| GPT-6.1 Sol | `vercel_ai_gateway/openai/gpt-6.1-sol` |
|
||||
| GPT-6 Astra | `vercel_ai_gateway/openai/gpt-6-astra` |
|
||||
| Claude Opus 5.5 | `vercel_ai_gateway/anthropic/claude-opus-5.5` |
|
||||
| Claude Sonnet 5.5 | `vercel_ai_gateway/anthropic/claude-sonnet-5.5` |
|
||||
| Gemini 4 Argon | `vercel_ai_gateway/google/gemini-4-argon` |
|
||||
| Gemini 3.8 Flash | `vercel_ai_gateway/google/gemini-3.8-flash` |
|
||||
| DeepSeek V4.1 Flash | `vercel_ai_gateway/deepseek/deepseek-v4.1-flash-1017` |
|
||||
| DeepSeek V4 Pro | `vercel_ai_gateway/deepseek/deepseek-v4-pro` |
|
||||
| Kimi K3.1 Pro | `vercel_ai_gateway/moonshotai/kimi-k3.1-pro` |
|
||||
| GLM-5.3 Flash | `vercel_ai_gateway/zai/glm-5.3-flash` |
|
||||
|
||||
OpenAI, Anthropic and Gemini models keep their provider safeguards on the Gateway. Security testing with them needs [Daybreak](https://openai.com/daybreak/), [CVP](https://support.claude.com/en/articles/14604842-cyber-verification-program) or [Fairwind](https://deepmind.google/fairwind-program/) access.
|
||||
|
||||
The full list is at the [AI Gateway models page](https://vercel.com/ai-gateway/models) or the models endpoint:
|
||||
|
||||
```text
|
||||
https://ai-gateway.vercel.sh/v1/models
|
||||
```
|
||||
|
||||
Prefix its model ID with `openai/` when setting `STRIX_LLM`. For example, the Gateway model ID `anthropic/claude-opus-5` becomes `openai/anthropic/claude-opus-5` in Strix.
|
||||
|
||||
## Get API Key
|
||||
|
||||
1. Open the [AI Gateway API key settings](https://vercel.com/docs/ai-gateway/authentication-and-byok)
|
||||
@@ -35,5 +50,6 @@ Prefix its model ID with `openai/` when setting `STRIX_LLM`. For example, the Ga
|
||||
|
||||
## Benefits
|
||||
|
||||
- Access models from multiple providers through one endpoint
|
||||
- Track Gateway usage and cost in Vercel
|
||||
- **Single API** — Access models from OpenAI, Anthropic, Google, Z.ai, and more
|
||||
- **Bring your own keys** — Route through your own provider accounts when you want
|
||||
- **Cost tracking** — Monitor Gateway usage and cost in Vercel
|
||||
@@ -6,7 +6,7 @@ description: "Configure Strix with Gemini models via Google Cloud"
|
||||
## Setup
|
||||
|
||||
```bash
|
||||
export STRIX_LLM="vertex_ai/gemini-3-pro-preview"
|
||||
export STRIX_LLM="vertex_ai/gemini-4-argon"
|
||||
```
|
||||
|
||||
No API key required—uses Google Cloud Application Default Credentials.
|
||||
@@ -29,8 +29,12 @@ export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"
|
||||
|
||||
| Model | Description |
|
||||
|-------|-------------|
|
||||
| `vertex_ai/gemini-3-pro-preview` | Best overall performance for security testing |
|
||||
| `vertex_ai/gemini-3-flash-preview` | Faster and cheaper |
|
||||
| `vertex_ai/gemini-4-argon` | Best overall performance for security testing |
|
||||
| `vertex_ai/gemini-3.8-flash` | Faster and cheaper |
|
||||
|
||||
<Note>
|
||||
Security testing with Gemini needs the [Fairwind Program](https://deepmind.google/fairwind-program/). Without it the cyber guardrails block most offensive tasks.
|
||||
</Note>
|
||||
|
||||
## Project Configuration
|
||||
|
||||
|
||||
+11
-4
@@ -25,15 +25,22 @@ description: "Install Strix and run your first security scan"
|
||||
|
||||
## Configuration
|
||||
|
||||
Set your LLM provider:
|
||||
Set your LLM provider. We recommend GLM-5.3 through [Vercel AI Gateway](/llm-providers/vercel-ai-gateway) or [OpenRouter](/llm-providers/openrouter):
|
||||
|
||||
```bash
|
||||
export STRIX_LLM="openrouter/z-ai/glm-5.3"
|
||||
<CodeGroup>
|
||||
```bash Vercel AI Gateway
|
||||
export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"
|
||||
export LLM_API_KEY="your-api-key"
|
||||
```
|
||||
|
||||
```bash OpenRouter
|
||||
export STRIX_LLM="openrouter/z-ai/glm-5.3"
|
||||
export LLM_API_KEY="your-api-key"
|
||||
```
|
||||
</CodeGroup>
|
||||
|
||||
<Tip>
|
||||
For best results, use `openrouter/z-ai/glm-5.3` (the default pick), `openai/gpt-5.4`, `anthropic/claude-opus-4-6`, or `openai/gpt-5.2`.
|
||||
For best results, use `zai/glm-5.3`, `deepseek/deepseek-v4.1-flash-1017`, `anthropic/claude-opus-5-5` (needs [CVP](https://support.claude.com/en/articles/14604842-cyber-verification-program) access), or `openai/gpt-6.1-sol` (needs [Daybreak](https://openai.com/daybreak/) access).
|
||||
</Tip>
|
||||
|
||||
## Run Your First Scan
|
||||
|
||||
@@ -63,7 +63,7 @@ jobs:
|
||||
fi
|
||||
```
|
||||
|
||||
Then tell the user to add two repository secrets: `STRIX_LLM` (model id, for example `openai/gpt-5.4`) and `LLM_API_KEY` (the provider key). Do not create these values yourself.
|
||||
Then tell the user to add two repository secrets: `STRIX_LLM` (model id, for example `openrouter/z-ai/glm-5.3`) and `LLM_API_KEY` (the provider key). Do not create these values yourself.
|
||||
|
||||
Notes:
|
||||
- In CI/headless runs Strix automatically scopes to the PR's changed files (`--scope-mode auto`). If diff resolution fails, keep `fetch-depth: 0` or set `--diff-base` to the PR's actual base branch — use `origin/${{ github.base_ref }}` in GitHub Actions rather than a hard-coded `origin/main`, since repos use different default branches.
|
||||
|
||||
@@ -47,7 +47,7 @@ If unsure and the user has (or will create) an app.strix.ai account, prefer **Cl
|
||||
```
|
||||
3. **LLM configured** — two environment variables:
|
||||
```bash
|
||||
export STRIX_LLM="openai/gpt-5.4" # any LiteLLM model id (openai/..., anthropic/..., openrouter/...)
|
||||
export STRIX_LLM="openrouter/z-ai/glm-5.3" # any LiteLLM model id (openai/..., anthropic/..., openrouter/...)
|
||||
export LLM_API_KEY="<provider api key>"
|
||||
```
|
||||
Ask the user for these if unset. Never hardcode or commit keys.
|
||||
|
||||
@@ -181,9 +181,12 @@ def _compose_root_instructions_override(
|
||||
supports_images: bool,
|
||||
report_tool: str,
|
||||
coverage_tools: bool,
|
||||
replace_scan_prompt: bool = False,
|
||||
) -> str | None:
|
||||
if root_instructions_override is None:
|
||||
return None
|
||||
if replace_scan_prompt:
|
||||
return f"{root_instructions_override}\n\n{render_scope_prompt(system_prompt_context)}"
|
||||
|
||||
base_instructions = render_system_prompt(
|
||||
skills=skills,
|
||||
@@ -225,6 +228,7 @@ async def run_strix_scan(
|
||||
cleanup_on_exit: bool = True,
|
||||
event_sink: StreamEventSink | None = None,
|
||||
root_instructions_override: str | None = None,
|
||||
replace_root_scan_prompt: bool = False,
|
||||
extra_system_prompt_context: dict[str, Any] | None = None,
|
||||
status_sink: StatusSink | None = None,
|
||||
mcp_connection_requests: list[McpConnectionRequest] | None = None,
|
||||
@@ -238,6 +242,8 @@ async def run_strix_scan(
|
||||
|
||||
``root_instructions_override`` adds root scan instructions to the rendered
|
||||
root prompt without replacing the system-verified scope block.
|
||||
``replace_root_scan_prompt=True`` makes it the root's whole prompt, followed
|
||||
by the scope, instead of adding it to the rendered scan prompt.
|
||||
``extra_files`` entries (``{"workspace_path", "content"}``) are placed into
|
||||
the sandbox workspace at session bring-up; see
|
||||
:func:`strix.runtime.session_manager.create_or_reuse`.
|
||||
@@ -521,6 +527,7 @@ async def run_strix_scan(
|
||||
supports_images=supports_images,
|
||||
report_tool=report_tool.name,
|
||||
coverage_tools=coverage_tools,
|
||||
replace_scan_prompt=replace_root_scan_prompt,
|
||||
)
|
||||
|
||||
root_agent = build_strix_agent(
|
||||
|
||||
@@ -68,6 +68,7 @@ def _patch_engine_scaffold(
|
||||
extra_body=None,
|
||||
),
|
||||
runtime=types.SimpleNamespace(max_context_images=3),
|
||||
telemetry=types.SimpleNamespace(run_record_timings=False),
|
||||
)
|
||||
monkeypatch.setattr(runner, "load_settings", lambda: settings)
|
||||
monkeypatch.setattr(runner, "configure_sdk_model_defaults", lambda _settings: None)
|
||||
@@ -161,6 +162,36 @@ async def test_root_prompt_options_flow_into_root_agent(
|
||||
}
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_replace_root_scan_prompt_drops_the_scan_prompt(
|
||||
monkeypatch: pytest.MonkeyPatch,
|
||||
tmp_path: Any,
|
||||
) -> None:
|
||||
scope_context = {
|
||||
"scope_source": "user_scan_config",
|
||||
"authorized_targets": [
|
||||
{"type": "web_application", "value": "https://example.com", "workspace_path": ""},
|
||||
],
|
||||
}
|
||||
captured = _patch_engine_scaffold(monkeypatch, tmp_path, scope_context)
|
||||
|
||||
await runner.run_strix_scan(
|
||||
scan_config={"targets": [], "scan_mode": "deep"},
|
||||
scan_id="scan-replace",
|
||||
image="img",
|
||||
coordinator=AgentCoordinator(),
|
||||
root_instructions_override="CUSTOM SCAN PROMPT",
|
||||
replace_root_scan_prompt=True,
|
||||
)
|
||||
|
||||
instructions_override = captured["kwargs"]["instructions_override"]
|
||||
assert instructions_override.startswith("CUSTOM SCAN PROMPT")
|
||||
assert instructions_override.count("SCOPE:") == 1
|
||||
assert "https://example.com" in instructions_override
|
||||
assert "<root_scan_instructions_override>" not in instructions_override
|
||||
assert "application security validation agent" not in instructions_override
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_extra_system_prompt_context_cannot_override_scope_context(
|
||||
monkeypatch: pytest.MonkeyPatch,
|
||||
|
||||
Reference in new issue
Block a user