managed-pentesting-with-strix

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Strix Cloud API (managed, no local infra)

Strix Cloud API（托管式，无需本地基础设施）

Use this when you want Strix's autonomous pentesting without running Docker or an LLM yourself — the scan runs on Strix's infrastructure and results are tracked in a team dashboard. This is the right choice in sandboxed/hosted agent and CI environments, for teams, and for scheduled/continuous testing (downloadable PDF/DOCX reports are an Enterprise-plan feature). For fully local, free, air-gapped, or BYO-LLM runs, use the open-source CLI in the penetration-testing-with-strix skill instead — both share the same engine and SARIF output, so you can mix them.

Full reference: docs.app.strix.ai · OpenAPI:

https://docs.app.strix.ai/openapi.json

当您希望使用Strix的自主渗透测试功能但无需自行运行Docker或LLM时，可使用此API——扫描将在Strix的基础设施上运行，结果会在团队仪表板中跟踪。这是沙箱/托管Agent和CI环境、团队协作以及定时/持续测试场景的理想选择（可下载的PDF/DOCX报告为企业版专属功能）。如果需要完全本地、免费、离线或自带LLM的运行方式，请改用penetration-testing-with-strix技能中的开源CLI——两者共享相同的引擎和SARIF输出，因此您可以混合使用。

完整参考文档：docs.app.strix.ai · OpenAPI：

https://docs.app.strix.ai/openapi.json

Setup

配置步骤

Base URL:
```
https://app.strix.ai/api/v1
```
Auth: every request sends
```
Authorization: Bearer <token>
```
. Tokens are org-scoped.
Get a token: the user creates one in the dashboard at Settings → API Access (app.strix.ai). Ask them for it; never hardcode, log, or commit it. Store it in an env var or the CI secret store.

Scopes (least-privilege): assign only what the integration needs and rotate regularly:

Scope	Grants
`scans:read` / `scans:write`	list/read/report scans · create/rerun/cancel scans
`vulnerabilities:read` / `:write`	read findings · update status & notes
`assets:read` / `:write`	read domains/repos · register/update them
`schedules:read` / `:write`	read schedules · create/trigger recurring scans
`pr_reviews:write`	trigger PR security reviews
`webhooks:read` / `:write`	manage webhook subscriptions
`tokens:write`	create/revoke API tokens

bash

export STRIX_API_TOKEN="<token>"
BASE=https://app.strix.ai/api/v1
auth=(-H "Authorization: Bearer $STRIX_API_TOKEN")

All examples use

jq

to parse JSON. Handle HTTP errors:

bad/expired token,

out of credits,

scope/plan-tier limit,

validation error.

基础URL：
```
https://app.strix.ai/api/v1
```
认证方式：每个请求都需携带
```
Authorization: Bearer <token>
```
。令牌为组织范围。
获取令牌：用户需在仪表板的设置 → API访问（app.strix.ai）页面创建令牌。请向用户索取该令牌；切勿硬编码、记录或提交令牌，应将其存储在环境变量或CI密钥仓库中。

权限范围（最小权限原则）：仅分配集成所需的权限，并定期轮换：

权限范围	授予权限
`scans:read` / `scans:write`	列出/读取/查看扫描报告 · 创建/重新运行/取消扫描
`vulnerabilities:read` / `:write`	读取漏洞结果 · 更新状态与备注
`assets:read` / `:write`	读取域名/代码仓库 · 注册/更新资产
`schedules:read` / `:write`	读取扫描计划 · 创建/触发定期扫描
`pr_reviews:write`	触发PR安全评审
`webhooks:read` / `:write`	管理Webhook订阅
`tokens:write`	创建/撤销API令牌

bash

export STRIX_API_TOKEN="<token>"
BASE=https://app.strix.ai/api/v1
auth=(-H "Authorization: Bearer $STRIX_API_TOKEN")

所有示例均使用

jq

解析JSON。请处理HTTP错误：

表示令牌无效/过期，

表示积分不足，

表示权限/计划层级限制，

表示验证错误。

1. Register the target as an asset

1. 将目标注册为资产

Scans run against registered assets, not raw URLs. Register once, then reuse the returned UUID.

bash

undefined

扫描仅针对已注册资产运行，而非原始URL。只需注册一次，即可重复使用返回的UUID。

bash

undefined

Domain (black-box / live target). Requires domain verification before external scanning.

域名（黑盒/在线目标）。外部扫描前需完成域名验证。

asset_type must be one of: web_app | api | attack_surface.

asset_type必须为以下值之一：web_app | api | attack_surface。

curl -sS "$BASE/domains" "${auth[@]}" -H "Content-Type: application/json"
-d '{"domain":"staging.example.com","asset_type":"web_app"}' | jq '{id:.domain.id, status, reachable, verification}'

Repository (white-box / code review).

full_name

is "owner/name".

代码仓库（白盒/代码评审）。

full_name

格式为"所有者/仓库名"。

Send one repository object, or a bare JSON array for several — not an object

发送单个仓库对象，或直接发送JSON数组（包含多个仓库）——请勿使用包裹"repositories"键的对象（会返回400错误）。

wrapping a "repositories" key (that is rejected with 400).

—

curl -sS "$BASE/repositories" "${auth[@]}" -H "Content-Type: application/json"
-d '[{"full_name":"org/app","provider":"github"}]' | jq '.repositories[] | {id, full_name}'


Look up existing assets instead of re-adding: `GET /domains`, `GET /repositories` (both `assets:read`, paginated with `?page=&limit=`).

curl -sS "$BASE/repositories" "${auth[@]}" -H "Content-Type: application/json"
-d '[{"full_name":"org/app","provider":"github"}]' | jq '.repositories[] | {id, full_name}'


可通过`GET /domains`、`GET /repositories`（均需`assets:read`权限，支持分页参数`?page=&limit=`）查询现有资产，无需重复添加。

2. Launch a scan

2. 启动扫描

POST /scans

(

scans:write

). Provide at least one target via

domain_ids

repository_ids

, or

internal_targets

(internal infra needs a network connector — see docs).

bash

scan_id=$(curl -sS "$BASE/scans" "${auth[@]}" -H "Content-Type: application/json" -d '{
  "engagement_type": "live_test",
  "domain_ids": ["<domain-uuid>"],
  "focus": "IDOR, auth bypass, SSRF",
  "context": "Staging. Test account creds are configured as a test user.",
  "notify_on_completion": true
}' | jq -r .scan_id)
echo "$scan_id"

Useful

CreateScanRequest

fields:

Field	Purpose
`engagement_type`	`live_test` (default), `code_review` , `internal_infra` , `compliance_pentest`
`domain_ids` / `repository_ids` / `internal_targets`	targets (at least one)
`domain_paths` / `repository_branches`	narrow to specific paths / branches
`credentials`	authenticated scanning, incl. `mfa_method` ( `totp` / `email_otp` /…) + `totp_secret`
`headers`	extra HTTP headers (e.g. API keys) for the target
`focus` / `concerns` / `context`	steer the agents
`upload_ids`	attach uploaded source/docs archives for white-box context
`notify_on_completion` / `notification_emails`	email when done

Response is

{ scan_id, title, status }

with

status

pending

调用

POST /scans

（需

scans:write

权限）。需通过

domain_ids

、

repository_ids

或

internal_targets

指定至少一个目标（内部基础设施需要网络连接器——详见文档）。

bash

scan_id=$(curl -sS "$BASE/scans" "${auth[@]}" -H "Content-Type: application/json" -d '{
  "engagement_type": "live_test",
  "domain_ids": ["<domain-uuid>"],
  "focus": "IDOR, auth bypass, SSRF",
  "context": "Staging. Test account creds are configured as a test user.",
  "notify_on_completion": true
}' | jq -r .scan_id)
echo "$scan_id"

CreateScanRequest

常用字段：

字段	用途
`engagement_type`	`live_test` （默认）、 `code_review` 、 `internal_infra` 、 `compliance_pentest`
`domain_ids` / `repository_ids` / `internal_targets`	扫描目标（至少一个）
`domain_paths` / `repository_branches`	限定扫描特定路径/分支
`credentials`	认证扫描，包含 `mfa_method` （ `totp` / `email_otp` /…） + `totp_secret`
`headers`	目标额外HTTP头（如API密钥）
`focus` / `concerns` / `context`	引导Agent扫描方向
`upload_ids`	附加上传的源码/文档包，提供白盒扫描上下文
`notify_on_completion` / `notification_emails`	扫描完成后发送邮件通知

响应格式为

{ scan_id, title, status }

，初始

status

为

pending

。

3. Poll to completion

3. 轮询扫描完成状态

GET /scans/{scanId}

(

scans:read

). Status flow:

pending → running → completed

(or

failed

cancelled

). Poll on an interval — scans take minutes to hours; don't block.

bash

while :; do
  s=$(curl -sS "$BASE/scans/$scan_id" "${auth[@]}" | jq -r .status)
  echo "status=$s"; [[ "$s" =~ ^(completed|failed|cancelled)$ ]] && break
  sleep 60
done

调用

GET /scans/{scanId}

（需

scans:read

权限）。状态流转：

pending → running → completed

（或

failed

cancelled

）。请按固定间隔轮询——扫描需耗时数分钟至数小时，请勿阻塞进程。

bash

while :; do
  s=$(curl -sS "$BASE/scans/$scan_id" "${auth[@]}" | jq -r .status)
  echo "status=$s"; [[ "$s" =~ ^(completed|failed|cancelled)$ ]] && break
  sleep 60
done

4. Read findings

4. 读取漏洞结果

The scan-detail response includes

executive_summary

methodology

recommendations

, a

findings

severity roll-up, and a

vulnerabilities[]

array. Each vulnerability carries

title, severity, status, cvss, cwe, endpoint, method, impact, technical_analysis, poc_description, poc_script_code

, and (for code findings)

code_file

code_diff

code_before

code_after

bash

curl -sS "$BASE/scans/$scan_id" "${auth[@]}" \
  | jq '["critical","high","medium","low","info"] as $order
       | .vulnerabilities
       | sort_by(.severity as $s | $order | index($s))
       | .[] | {title, severity, endpoint, cwe}'

Cloud severities are

critical | high | medium | low

and statuses are

open | in_progress | fixed | ignored

. Sort by an explicit severity order rather than

sort_by(.severity)

, which sorts alphabetically (critical, high, low, medium).

Org-wide triage across scans:

GET /vulnerabilities

(

vulnerabilities:read

; filter by severity/status). Update triage state with the vulnerabilities

:write

endpoints. To remediate, hand off to the fix-security-vulnerabilities-with-strix skill.

扫描详情响应包含

executive_summary

、

methodology

、

recommendations

、

findings

严重程度汇总，以及

vulnerabilities[]

数组。每个漏洞对象包含

title, severity, status, cvss, cwe, endpoint, method, impact, technical_analysis, poc_description, poc_script_code

，代码漏洞还包含

code_file

code_diff

code_before

code_after

字段。

bash

curl -sS "$BASE/scans/$scan_id" "${auth[@]}" \
  | jq '["critical","high","medium","low","info"] as $order
       | .vulnerabilities
       | sort_by(.severity as $s | $order | index($s))
       | .[] | {title, severity, endpoint, cwe}'

云端漏洞严重程度分为

critical | high | medium | low

，状态分为

open | in_progress | fixed | ignored

。请按明确的严重程度顺序排序，而非使用

sort_by(.severity)

（会按字母顺序排序：critical, high, low, medium）。

跨扫描的组织级漏洞分类处理：调用

GET /vulnerabilities

（需

vulnerabilities:read

权限；可按严重程度/状态过滤）。使用vulnerabilities的

:write

端点更新漏洞处理状态。如需修复漏洞，请使用fix-security-vulnerabilities-with-strix技能。

5. Export & report

5. 导出与报告

bash

undefined

bash

undefined

SARIF 2.1.0 for GitHub code scanning / ASPM ingestion

导出SARIF 2.1.0格式，用于GitHub代码扫描/ASPM集成

curl -sS "$BASE/scans/$scan_id/sarif" "${auth[@]}" -o findings.sarif

Report. The format and file type are query params (

Accept

is ignored):

下载报告。格式和文件类型通过查询参数指定（

Accept

头会被忽略）：

format=technical (default) | retest | attestation | executive_summary

format=technical（默认） | retest | attestation | executive_summary

type=pdf (default) | docx

type=pdf（默认） | docx

Any report download requires the Enterprise plan; formats beyond

technical

任何报告下载均需企业版计划；除

technical

格式、DOCX格式和白标品牌外的其他功能也为企业版专属。扫描必须完成才能下载报告。

DOCX, and white-label branding are Enterprise-only too. Scan must be completed.

—

curl -sS "$BASE/scans/$scan_id/report?format=technical&type=pdf" "${auth[@]}" -o strix-report.pdf

undefined

curl -sS "$BASE/scans/$scan_id/report?format=technical&type=pdf" "${auth[@]}" -o strix-report.pdf

undefined

6. PR reviews

6. PR评审

Trigger an automated security review of a pull request (

pr_reviews:write

); results appear as PR comments and in the dashboard:

bash

curl -sS "$BASE/pr-reviews/start" "${auth[@]}" -H "Content-Type: application/json" \
  -d '{"repository_full_name":"org/app","pr_number":123}'

List/inspect via

GET /pr-reviews

and

GET /pr-reviews/{id}

. Repo-level PR-review behavior is configured with the repository-settings endpoint.

触发拉取请求的自动化安全评审（需

pr_reviews:write

权限）；结果将作为PR评论显示，并同步至仪表板：

bash

curl -sS "$BASE/pr-reviews/start" "${auth[@]}" -H "Content-Type: application/json" \
  -d '{"repository_full_name":"org/app","pr_number":123}'

可通过

GET /pr-reviews

和

GET /pr-reviews/{id}

列出/查看PR评审详情。仓库级PR评审行为可通过仓库设置端点配置。

7. Continuous testing (schedules & webhooks)

7. 持续测试（计划与Webhook）

Schedules (
```
schedules:write
```
, Pro plan): create recurring scans and trigger them on demand — the managed equivalent of a cron-driven CLI loop.
Webhooks (
```
webhooks:write
```
): subscribe to pentest/vulnerability lifecycle events (e.g.
```
scan.completed
```
,
```
vulnerability.created
```
) to push results into Slack, ticketing, or your own pipeline instead of polling.

See the schedules and webhooks sections at docs.app.strix.ai for payloads.

扫描计划（需
```
schedules:write
```
权限，专业版计划）：创建定期扫描并按需触发——相当于托管版的cron驱动CLI循环。
Webhook（需
```
webhooks:write
```
权限）：订阅渗透测试/漏洞生命周期事件（如
```
scan.completed
```
、
```
vulnerability.created
```
），将结果推送至Slack、工单系统或自有流水线，无需轮询。

关于负载格式，请查看docs.app.strix.ai中的计划与Webhook章节。

Safety

安全注意事项

Only scan assets the user's organization owns or is authorized to test. External domain scans require verification (DNS/file/meta-tag) enforced by the platform — don't try to bypass it.

仅扫描用户组织拥有或已获授权测试的资产。外部域名扫描需通过平台强制验证（DNS/文件/元标签）——请勿尝试绕过验证。

managed-pentesting-with-strix

Original

Translation

Strix Cloud API (managed, no local infra)

Strix Cloud API（托管式，无需本地基础设施）

Setup

配置步骤

1. Register the target as an asset

1. 将目标注册为资产

Domain (black-box / live target). Requires domain verification before external scanning.

域名（黑盒/在线目标）。外部扫描前需完成域名验证。

asset_type must be one of: web_app | api | attack_surface.

asset_type必须为以下值之一：web_app | api | attack_surface。

Repository (white-box / code review). full_name is "owner/name".

代码仓库（白盒/代码评审）。full_name格式为"所有者/仓库名"。

Send one repository object, or a bare JSON array for several — not an object

发送单个仓库对象，或直接发送JSON数组（包含多个仓库）——请勿使用包裹"repositories"键的对象（会返回400错误）。

wrapping a "repositories" key (that is rejected with 400).

2. Launch a scan

2. 启动扫描

3. Poll to completion

3. 轮询扫描完成状态

4. Read findings

4. 读取漏洞结果

5. Export & report

5. 导出与报告

SARIF 2.1.0 for GitHub code scanning / ASPM ingestion

导出SARIF 2.1.0格式，用于GitHub代码扫描/ASPM集成

Report. The format and file type are query params (Accept is ignored):

下载报告。格式和文件类型通过查询参数指定（Accept头会被忽略）：

format=technical (default) | retest | attestation | executive_summary

format=technical（默认） | retest | attestation | executive_summary

type=pdf (default) | docx

type=pdf（默认） | docx

Any report download requires the Enterprise plan; formats beyond technical,

任何报告下载均需企业版计划；除technical格式、DOCX格式和白标品牌外的其他功能也为企业版专属。扫描必须完成才能下载报告。

DOCX, and white-label branding are Enterprise-only too. Scan must be completed.

6. PR reviews

6. PR评审

7. Continuous testing (schedules & webhooks)

7. 持续测试（计划与Webhook）

Safety

安全注意事项

Repository (white-box / code review).
`full_name`
is "owner/name".

代码仓库（白盒/代码评审）。
`full_name`
格式为"所有者/仓库名"。

Report. The format and file type are query params (
`Accept`
is ignored):

下载报告。格式和文件类型通过查询参数指定（
`Accept`
头会被忽略）：

Any report download requires the Enterprise plan; formats beyond
`technical`
,

任何报告下载均需企业版计划；除
`technical`
格式、DOCX格式和白标品牌外的其他功能也为企业版专属。扫描必须完成才能下载报告。