Managed Pentesting With Strix

Strix Cloud (managed, no local infra)

Use this when you want Strix's autonomous pentesting without running Docker or an LLM yourself — the scan runs on Strix's infrastructure and results are tracked in a team dashboard. This is the right choice in sandboxed/hosted agent and CI environments, for teams, and for scheduled/continuous testing (downloadable PDF/DOCX reports are an Enterprise-plan feature). For fully local, free, air-gapped, or BYO-LLM runs, use the open-source CLI in the penetration-testing-with-strix skill instead — both share the same engine and SARIF output, so you can mix them.

There are two equivalent interfaces. Prefer the CLI:

• `strix cloud` CLI — every REST operation has a command in the form strix cloud <resource> <verb>. Install with curl -sSL https://strix.ai/install | bash. Run strix cloud to list all resources and strix cloud <resource> help (or -h) to list a resource's verbs; a bare resource with a safe read operation runs its documented default.
• REST API — base URL https://app.strix.ai/api/v1, Authorization: Bearer <token> on every request. Full reference: [docs.app.strix.ai](https://docs.app.strix.ai) · agent index: https://docs.app.strix.ai/llms.txt · OpenAPI: https://docs.app.strix.ai/openapi.json.

The CLI is equally usable by agents and people. Output is complete JSON when stdout is not a terminal, or when you pass --json; terminal tables favor names, branches, lifecycle states, and numbered selectors. Human lists retain the selectors needed by follow-up commands but omit internal organization/user IDs; a selector too long for the compact table is repeated losslessly in a copyable block. Paginated lists print the next --page or --offset, and detail views preserve useful prose within a safe terminal bound; use --json for the complete record. Token lists label credentials as active, expired, or revoked. Binary downloads are the exception: redirect raw bytes intentionally, or use --output FILE --json to write the file and receive structured metadata. There are no interactive prompts when stdin is not a terminal. Exit codes: 0 success, 1 request/runtime error, 2 invalid usage, 4 authentication or plan limit, 5 payment required.

Every resource group with a safe read operation has a useful default action, and -h or help always shows its verbs. Native tab completion includes resources, verbs, flags, workspace commands, and local paths:

source <(strix completions zsh)       # current zsh session
source <(strix completions bash)      # current bash session
strix completions fish | source       # current fish session

Write commands take request fields as flags. Every write command also accepts one JSON object with --data, which is the way to send fields that have no flag:

strix cloud scans start --data '{"engagement_type":"code_review"}'   # literal JSON
strix cloud scans start --data @request.json                         # read a file
cat request.json | strix cloud scans start --data -                  # read standard input

The platform enforces plan and role limits, and the CLI passes the platform message through. Report downloads need the Enterprise plan. Schedules need the Pro plan. Billing writes need an admin token. A blocked command exits with code 4.

Setup: sign in

Run the device sign-in. It creates the user's account and workspace on first use and stores a personal API token in ~/.strix/platform-auth.json:

strix cloud login
# Non-interactive least-privilege example:
strix cloud login --scopes scans:read scans:write uploads:write billing:read vulnerabilities:read assets:read assets:write
# Or use a stable named profile:
strix cloud login --scope-profile recommended

The user approves the sign-in in the browser. With --scopes (and optionally --workspace <name-or-id>) there are no terminal prompts, so the command works from a non-interactive agent shell. In an interactive terminal without flags, the CLI offers a workspace picker and scope presets (Recommended, Full access, Minimal, Custom). Recommended covers ordinary scans, source uploads, workspace switching, and user-approved credit top-ups; it excludes tokens:write, which must be requested explicitly when credential management is required. Use explicit scopes for a narrower automation token.

• strix cloud whoami is the fast local status. strix cloud session --json verifies the remote device session; strix cloud session scopes shows both effective access and the immutable login ceiling.
• strix cloud logout revokes the remote session before removing the local token. On a network or server failure it keeps the token so the user can retry; --local-only deliberately skips revocation.
• Every other strix cloud command uses the stored token automatically. --token <token> or STRIX_API_TOKEN is a stateless per-command override and never overwrites the stored account. For an override that is itself a CLI session, also pass --workspace-id or set STRIX_WORKSPACE_ID.
• Never hardcode, log, or commit the token. Store it in an env var or the CI secret store.
• Scopes (least-privilege): assign only what the integration needs and rotate regularly:

HTTP errors map to messages and exit codes: 401 bad/expired token (exit 4), 402 out of credits (exit 5), 403 scope/plan-tier limit (exit 4), 422 validation error (exit 1).

Create a time-limited automation token with strix cloud tokens create. Use --rbac-scopes to restrict it to target IDs, tags, or business units; the value is a JSON array of { "type": "target|tag|business_unit", "value": "..." } objects:

strix cloud tokens create --type service --name staging-ci \
  --expires-at 2026-12-31T23:59:59Z \
  --scopes scans:read scans:write \
  --rbac-scopes '[{"type":"tag","value":"staging"}]'

The token secret is returned once. Store it directly in a secret manager and do not print or commit it. --expires-at and --expires-in-days are mutually exclusive.

0. Credits & top-ups

Non-Enterprise scans consume org credits. Enterprise engagements are plan-included and do not debit the wallet. Check the balance before a scan (billing:read):

strix cloud credits

When the balance is too low, buy credits with strix cloud billing topup (billing:write, admin token). The server answers the first request with HTTP 402 and a machine-payment challenge (Stripe Machine Payments Protocol). The CLI pays the challenge with the Stripe Link wallet client when Node.js is available — the user approves the spend in the Link app. The response returns the receipt (credits_granted, duplicate, reference) and the new balance.