strix-cloud-api
Drive the managed Strix platform headlessly through the app.strix.ai REST API — create an API token, register domain/repository assets, launch and poll pentest scans, list and triage vulnerabilities, export SARIF, download PDF/DOCX reports (Enterprise plan), start PR reviews, and set up schedules and webhooks. Use when the user wants Strix without local Docker/LLM infra, or wants scans tracked in a team dashboard, on a schedule, or in CI via API.
- Installs
- 120
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/usestrix/strix --skill strix-cloud-api- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads strix-cloud-api automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Strix Cloud API (managed, no local infra)
Use this when you want Strix's autonomous pentesting without running Docker or an LLM yourself — the scan runs on Strix's infrastructure and results are tracked in a team dashboard. This is the right choice in sandboxed/hosted agent and CI environments, for teams, and for scheduled/continuous testing (downloadable PDF/DOCX reports are an Enterprise-plan feature). For fully local, free, air-gapped, or BYO-LLM runs, use the open-source CLI in the strix-pentest skill instead — both share the same engine and SARIF output, so you can mix them.
Full reference: docs.app.strix.ai · OpenAPI: https://docs.app.strix.ai/openapi.json
Setup
-
Base URL:
https://app.strix.ai/api/v1 -
Auth: every request sends
Authorization: Bearer <token>. Tokens are org-scoped. -
Get a token: the user creates one in the dashboard at Settings → API Access (app.strix.ai). Ask them for it; never hardcode, log, or commit it. Store it in an env var or the CI secret store.
-
Scopes (least-privilege): assign only what the integration needs and rotate regularly:
Scope Grants scans:read/scans:writelist/read/report scans · create/rerun/cancel scans vulnerabilities:read/:writeread findings · update status & notes assets:read/:writeread domains/repos · register/update them schedules:read/:writeread schedules · create/trigger recurring scans pr_reviews:writetrigger PR security reviews webhooks:read/:writemanage webhook subscriptions tokens:writecreate/revoke API tokens
export STRIX_API_TOKEN="<token>"
BASE=https://app.strix.ai/api/v1
auth=(-H "Authorization: Bearer $STRIX_API_TOKEN")
All examples use jq to parse JSON. Handle HTTP errors: 401 bad/expired token, 402 out of credits, 403 scope/plan-tier limit, 422 validation error.
1. Register the target as an asset
Scans run against registered assets, not raw URLs. Register once, then reuse the returned UUID.
# Domain (black-box / live target). Requires domain verification before external scanning.
# asset_type must be one of: web_app | api | attack_surface.
curl -sS "$BASE/domains" "${auth[@]}" -H "Content-Type: application/json" \
-d '{"domain":"staging.example.com","asset_type":"web_app"}' | jq '{id:.domain.id, status, reachable, verification}'
# Repository (white-box / code review). `full_name` is "owner/name".
# Send one repository object, or a bare JSON array for several — not an object
# wrapping a "repositories" key (that is rejected with 400).
curl -sS "$BASE/repositories" "${auth[@]}" -H "Content-Type: application/json" \
-d '[{"full_name":"org/app","provider":"github"}]' | jq '.repositories[] | {id, full_name}'
Look up existing assets instead of re-adding: GET /domains, GET /repositories (both assets:read, paginated with ?page=&limit=).
2. Launch a scan
POST /scans (scans:write). Provide at least one target via domain_ids, repository_ids, or internal_targets (internal infra needs a network connector — see docs).
scan_id=$(curl -sS "$BASE/scans" "${auth[@]}" -H "Content-Type: application/json" -d '{
"engagement_type": "live_test",
"domain_ids": ["<domain-uuid>"],
"focus": "IDOR, auth bypass, SSRF",
"context": "Staging. Test account creds are configured as a test user.",
"notify_on_completion": true
}' | jq -r .scan_id)
echo "$scan_id"
Useful CreateScanRequest fields:
| Field | Purpose |
|---|---|
engagement_type | live_test (default), code_review, internal_infra, compliance_pentest |
domain_ids / repository_ids / internal_targets | targets (at least one) |
domain_paths / repository_branches | narrow to specific paths / branches |
credentials | authenticated scanning, incl. mfa_method (totp/email_otp/…) + totp_secret |
headers | extra HTTP headers (e.g. API keys) for the target |
focus / concerns / context | steer the agents |
upload_ids | attach uploaded source/docs archives for white-box context |
notify_on_completion / notification_emails | email when done |
Response is { scan_id, title, status } with status = pending.
3. Poll to completion
GET /scans/{scanId} (scans:read). Status flow: pending → running → completed (or failed / cancelled). Poll on an interval — scans take minutes to hours; don't block.
while :; do
s=$(curl -sS "$BASE/scans/$scan_id" "${auth[@]}" | jq -r .status)
echo "status=$s"; [[ "$s" =~ ^(completed|failed|cancelled)$ ]] && break
sleep 60
done
4. Read findings
The scan-detail response includes executive_summary, methodology, recommendations, a findings severity roll-up, and a vulnerabilities[] array. Each vulnerability carries title, severity, status, cvss, cwe, endpoint, method, impact, technical_analysis, poc_description, poc_script_code, and (for code findings) code_file/code_diff/code_before/code_after.
curl -sS "$BASE/scans/$scan_id" "${auth[@]}" \
| jq '["critical","high","medium","low","info"] as $order
| .vulnerabilities
| sort_by(.severity as $s | $order | index($s))
| .[] | {title, severity, endpoint, cwe}'
Cloud severities are critical | high | medium | low and statuses are open | in_progress | fixed | ignored. Sort by an explicit severity order rather than sort_by(.severity), which sorts alphabetically (critical, high, low, medium).
Org-wide triage across scans: GET /vulnerabilities (vulnerabilities:read; filter by severity/status). Update triage state with the vulnerabilities :write endpoints. To remediate, hand off to the strix-fix-findings skill.
5. Export & report
# SARIF 2.1.0 for GitHub code scanning / ASPM ingestion
curl -sS "$BASE/scans/$scan_id/sarif" "${auth[@]}" -o findings.sarif
# Report. The format and file type are query params (`Accept` is ignored):
# format=technical (default) | retest | attestation | executive_summary
# type=pdf (default) | docx
# Any report download requires the Enterprise plan; formats beyond `technical`,
# DOCX, and white-label branding are Enterprise-only too. Scan must be completed.
curl -sS "$BASE/scans/$scan_id/report?format=technical&type=pdf" "${auth[@]}" -o strix-report.pdf
6. PR reviews
Trigger an automated security review of a pull request (pr_reviews:write); results appear as PR comments and in the dashboard:
curl -sS "$BASE/pr-reviews/start" "${auth[@]}" -H "Content-Type: application/json" \
-d '{"repository_full_name":"org/app","pr_number":123}'
List/inspect via GET /pr-reviews and GET /pr-reviews/{id}. Repo-level PR-review behavior is configured with the repository-settings endpoint.
7. Continuous testing (schedules & webhooks)
- Schedules (
schedules:write, Pro plan): create recurring scans and trigger them on demand — the managed equivalent of a cron-driven CLI loop. - Webhooks (
webhooks:write): subscribe to pentest/vulnerability lifecycle events (e.g.scan.completed,vulnerability.created) to push results into Slack, ticketing, or your own pipeline instead of polling.
See the schedules and webhooks sections at docs.app.strix.ai for payloads.
Safety
Only scan assets the user's organization owns or is authorized to test. External domain scans require verification (DNS/file/meta-tag) enforced by the platform — don't try to bypass it.
FAQ
What does the strix-cloud-api skill do?
Drive the managed Strix platform headlessly through the app.strix.ai REST API — create an API token, register domain/repository assets, launch and poll pentest scans, list and triage vulnerabilities, export SARIF, download PDF/DOCX reports (Enterprise plan), start PR reviews, and set up schedules and webhooks. Use when the user wants Strix without local Docker/LLM infra, or wants scans tracked in a team dashboard, on a schedule, or in CI via API.
How do I install strix-cloud-api?
Run npx skills add https://github.com/usestrix/strix --skill strix-cloud-api in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/strix-cloud-api/ (personal) or .claude/skills/strix-cloud-api/ (project).
Which AI agents can use strix-cloud-api?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is strix-cloud-api safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains strix-cloud-api?
It is published by usestrix in usestrix/strix. It has 120 recorded installs.
More from usestrix/strix
penetration-testing-with-strix
usestrix/strix
Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth/access-control flaws, IDOR, business logic) instead of just flagging them. Runs self-hosted with the open-source CLI or via the managed app.strix.ai cloud, and returns validated findings with proof-of-concept exploits (Markdown, JSON, CSV, SARIF). Use when the user asks to pentest, hack, security-scan, security-audit, or find vulnerabilities in an app, API, website, or repo.
fix-security-vulnerabilities-with-strix
usestrix/strix
Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit. Handles injection, XSS, SSRF, broken access control, IDOR, and other validated findings. Use after a Strix scan reports findings, or when the user asks to remediate, patch, or fix security issues from a strixruns report, vulnerabilities.json, findings.sarif, or a cloud scan.
ci-security-scanning-with-strix
usestrix/strix
Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it merges, with results as PR comments and SARIF uploaded to code scanning. Covers both the self-hosted open-source CLI (runs in your runner) and the managed app.strix.ai platform (GitHub/GitLab app or API, no runner infra). Use when the user asks to add security scanning, SAST/DAST, pentesting, vulnerability checks, or automated security review to their CI pipeline, pre-merge gate, or PR workflow.
managed-pentesting-with-strix
usestrix/strix
Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the strix cloud CLI or REST API — no local Docker or LLM key needed. Safely review and upload local source, register assets, launch and poll scans, triage vulnerabilities, export SARIF, download compliance reports, start PR reviews, buy credits, and set up schedules or webhooks. Use for managed, continuous, scheduled, team-tracked, or sandboxed-agent security testing.
web-app-penetration-testing
usestrix/strix
Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match. Runs with Strix, either the self-hosted open-source CLI or the managed app.strix.ai cloud. Use when the user asks to pentest, hack, security-test, or audit their web app, website, web application, or staging site.
api-security-testing
usestrix/strix
Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level authorization, unrestricted resource consumption, SSRF, injection, and auth/token flaws. Every finding comes with a working proof-of-concept request. Use when the user asks to pentest, security-test, audit, or find vulnerabilities in an API, endpoint, or backend service.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.