Strix Install Guide: Deploy an AI Penetration Testing Agent on Ubuntu VPS (2026)

In 2026, Strix has become one of the most popular open-source AI penetration testing tools on GitHub. It uses multi-agent collaboration to simulate real attacker behavior—not only finding vulnerabilities, but validating each finding with a reproducible PoC (proof of concept), dramatically reducing the false-positive rate of traditional scanners.

This is a hands-on install guide for security engineers and DevSecOps teams: deploy Strix on an Ubuntu VPS from scratch, configure your LLM, run your first scan, and automate boot-to-ready with cloud-init.

Legal notice: Strix may only be used against targets you own or have written authorization to test. Unauthorized penetration testing may violate the law; you are solely responsible for your use.

What is Strix? Who is it for?

Strix is an open-source AI penetration testing framework under the Apache 2.0 license. Unlike traditional SAST/DAST scanners, its agents:

• Run targets dynamically—scan local code directories, GitHub repos, or live web applications
• Collaborate across agents—reconnaissance, exploitation, and validation are split across agents, similar to a real red team
• Validate with PoCs—every vulnerability includes reproducible attack steps; no PoC, no report
• Developer-friendly—one CLI command, results written to strix_runs/, open a local dashboard with strix view

Typical use cases:

Why Ubuntu VPS instead of your local machine?

Strix runs on Linux, macOS, or Windows (WSL2), but deploying the agent on a dedicated VPS has clear advantages:

1. Traffic isolation—unusual requests from penetration testing do not exit through your corporate network, reducing the risk of IP blocks
2. Spin up and destroy on demand—delete the instance when done; no scan artifacts or sensitive API keys left behind
3. Dedicated resources—Docker sandbox containers are memory-hungry; an 8 GB VPS is more stable than running in the background on a laptop
4. Automation-friendly—cloud-init scripts work across cloud providers; spin up a pentest machine in 5 minutes

Ubuntu 22.04 / 24.04 LTS is the preferred choice: strong Docker support, rich community docs, and the Strix install script is best validated on Debian-based distros.

Requirements and VPS sizing

Official minimum requirements

• OS: Linux (this guide uses Ubuntu 24.04 LTS)
• Python: 3.12+ (handled by the install script)
• Docker: installed with daemon running
• Memory: 4 GB minimum, 8 GB recommended
• Disk: 5 GB+ (sandbox image ~2 GB; scan results extra)
• LLM API key: any supported provider—OpenAI, Anthropic, Google, etc.

Recommended VPS specs

When choosing a VPS:

• Pick a region with low latency to your target app (Singapore/Tokyo for APAC targets)
• Confirm the provider allows outbound penetration testing traffic (some budget VPS providers block port scanning)
• Use SSH keys for login; disable password authentication

Manual install: six steps to deploy

The commands below assume you have SSH access to a fresh Ubuntu 24.04 VPS (root or a user with sudo).

Step 1: Update the system

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl git ca-certificates gnupg

Step 2: Install Docker Engine

# Add Docker official GPG key and repository
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "${VERSION_CODENAME}") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin

# Add current user to docker group (avoid sudo every time)
sudo usermod -aG docker $USER
newgrp docker

# Verify Docker is running
docker ps

Step 3: Install Strix

curl -sSL https://strix.ai/install | bash

The install script sets up a Python virtual environment and adds strix to PATH. Verify installation:

strix --version

Step 4: (Optional) Pre-pull the sandbox image

The first scan automatically downloads a ~2 GB Docker sandbox image. Pre-pulling avoids a long wait during the scan:

docker pull ghcr.io/usestrix/sandbox:latest

Step 5: Configure LLM

See the next section for details.

Step 6: Run your first scan

See the "Run your first security assessment" section.

Configure your LLM provider

Strix agent reasoning depends entirely on a large language model. Configure with two environment variables:

# Choose model (format: provider/model-name)
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="sk-your-api-key-here"

Common provider examples

Optional environment variables

# Reasoning depth (default high; use medium for quick scans)
export STRIX_REASONING_EFFORT="high"

# Enable web search (Perplexity)
export PERPLEXITY_API_KEY="pplx-your-key"

# Local model API base URL
export LLM_API_BASE="http://localhost:11434/v1"

Configuration is saved automatically to ~/.strix/cli-config.json so you do not need to re-enter it on the next login.

Run your first security assessment

Black-box web application scan

# Scan an authorized target URL
strix --target https://your-app.example.com

# Non-interactive mode (for VPS / CI)
strix -n --target https://your-app.example.com

White-box code audit

# Scan a local project directory
strix --target ./my-app

# Scan a GitHub repository
strix --target https://github.com/your-org/your-repo

Gray-box testing with authentication

strix --target https://your-app.example.com \
  --instruction "Log in with test account admin:TestPass123, then focus on IDOR and privilege escalation"

View scan results

During a scan, Strix writes results in real time to strix_runs/<run-name>/. When finished:

# Open the web dashboard for the most recent scan
strix view

# Open a specific run
strix view my-run-name

strix view starts a web server bound to 127.0.0.1. If you are on a remote VPS, use SSH port forwarding to view it:

# Run on your local machine (maps the VPS dashboard to localhost)
ssh -L 8787:127.0.0.1:8787 user@your-vps-ip

Then open the URL printed in the terminal in your local browser.

cloud-init one-shot bootstrap script

If you frequently create and destroy pentest VPS instances, bundle the steps above into a cloud-init script that runs at instance creation:

#!/bin/bash
# cloud-init: Strix pentest VPS bootstrap
# Replace LLM configuration below before use

set -euo pipefail
export DEBIAN_FRONTEND=noninteractive

# ── System update ──
apt-get update -y
apt-get upgrade -y
apt-get install -y curl git ca-certificates gnupg

# ── Install Docker ──
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
chmod a+r /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo ${VERSION_CODENAME}) stable" > /etc/apt/sources.list.d/docker.list
apt-get update -y
apt-get install -y docker-ce docker-ce-cli containerd.io

# ── Install Strix ──
curl -sSL https://strix.ai/install | bash

# ── Configure LLM (replace with your key) ──
cat >> /root/.bashrc <<'EOF'
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="REPLACE_WITH_YOUR_KEY"
EOF

# ── Pre-pull sandbox image ──
docker pull ghcr.io/usestrix/sandbox:latest

echo "✅ Strix pentest VPS ready. SSH in and run: strix --target <url>"

Advanced usage and CI/CD integration

Scan modes

# Quick scan (good for PR gates, lower cost)
strix -n -t ./ --scan-mode quick

# Standard deep scan
strix -n -t ./ --scan-mode standard

# Scan PR diff only (requires git history)
strix -n -t ./ --scan-mode quick --scope-mode diff --diff-base origin/main

GitHub Actions example

name: strix-penetration-test

on:
  pull_request:

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install Strix
        run: curl -sSL https://strix.ai/install | bash

      - name: Run Strix
        env:
          STRIX_LLM: ${{ secrets.STRIX_LLM }}
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
        run: strix -n -t ./ --scan-mode quick

In CI, Strix exits with a non-zero code when vulnerabilities are found, blocking merges of unsafe code.

Multi-target batch scanning

# Scan a code repo and live environment together
strix -t https://github.com/org/app -t https://app.example.com

# Read targets from a file
strix --target-list ./targets.txt

VPS hardening recommendations

Your pentest VPS needs protection too—it holds LLM API keys, and agents run arbitrary commands inside sandboxes:

1. Firewall: allow SSH (22) only; close all other inbound ports
2. SSH hardening: disable password login, key-only auth; consider a non-standard port
3. API key isolation: create a dedicated LLM API key for Strix with usage limits
4. Regular teardown: destroy the VPS after assessments to avoid long-term exposure
5. Log audit: keep /var/log/cloud-init-output.log for install troubleshooting

# Basic UFW rules example
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable

Troubleshooting

sudo usermod -aG docker $USER
newgrp docker
# or reconnect via SSH

# Pull manually and check network
docker pull ghcr.io/usestrix/sandbox:latest

# If ghcr.io is unreachable, configure a Docker mirror (varies by provider)

echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc
strix --version

# View cloud-init logs
sudo cat /var/log/cloud-init-output.log
sudo journalctl -u cloud-init --no-pager

Summary

The core path to deploy Strix on Ubuntu VPS is straightforward:

1. Provision an 8 GB Ubuntu VPS and install Docker
2. Run curl -sSL https://strix.ai/install | bash
3. Configure STRIX_LLM and LLM_API_KEY
4. Run strix --target <url> against an authorized target
5. View PoC-backed vulnerability reports with strix view

With a cloud-init script, you can spin up a dedicated pentest machine on any cloud provider in 5 minutes—tear it down when done, zero residue. For teams that need continuous security gates, GitHub Actions integration runs AI penetration testing on every PR automatically.

This article is based on Strix official documentation and the latest release as of July 2026. The tool updates frequently—refer to docs.strix.ai for the source of truth.