Strac Comply

Strix is an open-source AI penetration-testing tool from usestrix that uses autonomous, multi-agent AI pentesters to dynamically run applications, perform reconnaissance and exploitation, and validate vulnerabilities with working proof-of-concept exploits rather than static-analysis findings. Its developer-oriented CLI produces remediation guidance, generated patches, and pentest reports, and it can run scans in CI/CD pipelines to detect insecure changes before deployment. The tool runs in a Docker sandbox and requires an LLM API key; the associated Strix platform supports repository and domain testing, continuous scanning, and integrations with development and issue-tracking workflows.

security-audit is a Cloudflare coding-agent skill that orchestrates multi-phase security audits of codebases. It uses reconnaissance to map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage; assigns isolated agents to coverage-led hunting; sends each unique candidate to a fresh verifier; and records confirmed, needs_validation, and rejected results in machine-readable findings.json validated against a report schema. Independent agents verify final source claims, after which the skill derives target-neutral reports and coverage records. It can be installed with the Skills CLI and requires a tool-using coding agent with parallel sub-agent support, Node.js for its validators, and an OS-enforced sandbox for target-controlled execution. The repository is licensed under MIT.

Codex Security is an OpenAI CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in authorized code repositories. It scans directories and codebases, including repository changes, uses AI-assisted analysis to trace attack paths and apply custom threat models, validates findings, and can generate reviewable patches and exports in SARIF, JSON, and CSV formats. The CLI supports CI use with an API key and can stop builds at a selected severity threshold. The package also supports configurable deep scans, worker and subagent counts, time limits, containerized bulk scans, and a preview findings service. The service stores findings and embeddings in SQLite, provides paginated listings and a read-only dashboard, identifies potential duplicates through embedding similarity, and allows completed findings to be published and deduplicated through the CLI or SDK. It requires Node.js 22.13.0 or later and Python 3.10 or later, and can use OpenAI or other documented inference providers.

OSS Scanner is an Anthropic service that scans enrolled critical open-source repositories for security vulnerabilities. Maintainers enroll a project by opening a pull request that adds a project directory with a configuration file and Dockerfile; the Dockerfile sets up dependencies and builds the project, initially with network access enabled. After the build, the project is moved into an isolated virtual machine with Internet access disabled for the security analysis. Findings are emailed to the configured contacts with reproduction steps and, where available, a proposed patch. Reports are model-generated and are not reviewed by a human. The repository includes validation and local-checking tools for testing the build and no-network audit environment before enrollment.

OpenSSF Scorecard is an open-source security assessment tool developed as part of the Open Source Security Foundation. It evaluates open-source projects and dependencies for software supply-chain risks through automated checks covering source code, build processes, dependencies, testing, and project maintenance. Each check produces a score and risk level, which are combined into an aggregate security-posture score with remediation guidance. Scorecard can run automatically through a GitHub Action on repositories a user controls or manually through its command-line interface, which can assess other repositories and allows users to select checks and control result detail.