The most powerful open-source AI autonomous pentesting agent.

Xalgorix is the most comprehensive open-source autonomous penetration testing platform. It combines the power of AI with 70+ security tools to deliver enterprise-grade pentesting — completely free.

TL;DR: Give it a target URL, and Xalgorix will find vulnerabilities, generate a professional PDF report, and send Discord alerts — all automatically.

• 🚀 Autonomous — Give it a target, watch it work. No human intervention needed.
• 🧠 AI-Powered — Leverages LLMs for intelligent decision-making.
• 🔓 100% Free — No SaaS, no per-scan fees, no limits.
• 🏠 Self-Hosted — Your data never leaves your machine.
• ⚡ Lightning Fast — Uses maximum threads, comprehensive flags.
• 🎯 Precision — Only reports exploitable vulnerabilities, not false positives.
• 🛡️ Safe — Blocks destructive commands, rate limiting protects your IP.

• Shannon — Requires source code (white-box only), part of paid Keygraph platform
• Strix — Docker-based, good for bug bounty, no web UI
• PentestGPT — Published at USENIX Security 2024, terminal-only interface
• HexStrike — MCP server integration, 150+ tools via MCP protocol
• PentAGI — Multi-agent Docker system, complex setup required
• Nebula — CLI assistant, good for quick scans but limited methodology

1. 🎯 Most Complete Web UI

   • Only tool with full dashboard, live feed, chat, token tracking
   • See everything in real-time, interact with agent during scan

2. 🔄 Multiple Scan Modes

   • Single: Quick target scan
   • DAST: Deep URL vulnerability testing
   • Wildcard: Subdomain enum → scan each individually
   • Most comprehensive coverage

3. 🔔 Built-in Notifications

   • Discord alerts on start/vuln/complete
   • PDF reports auto-generated

4. 🛡️ Production Ready

   • Rate limiting (protect your IP)
   • Circuit breaker (auto-block failing tools)
   • Queue system (scan multiple targets)
   • Severity filtering (focus on what matters)

5. 🔍 Built-in Research Tools

   • CVE search (NIST NVD)
   • Exploit search (Exploit-DB)
   • Web search (Gemini/Brave/Google)

6. 💰 100% Free & Open Source

   • No SaaS subscription
   • No per-scan fees
   • Your data stays local

# Quick install
go install github.com/xalgord/xalgorix/cmd/xalgorix@latest

# Or build from source
git clone https://github.com/xalgord/xalgorix.git
cd xalgorix
./build.sh --install

# Create ~/.xalgorix.env
nano ~/.xalgorix.env

# Required
XALGORIX_LLM=openai/gpt-4.5
XALGORIX_API_KEY=your_api_key
# OR use Anthropic:
# XALGORIX_LLM=anthropic/claude-sonnet-4.6
# XALGORIX_API_KEY=sk-ant-...

# Optional - for custom providers (MiniMax, Ollama, etc.)
# XALGORIX_API_BASE=https://api.minimax.io/

# Optional
XALGORIX_DISCORD_WEBHOOK=https://discord.com/api/webhooks/...

⚠️ Note: Xalgorix will refuse to start if ~/.xalgorix.env is missing or missing required variables (XALGORIX_LLM and XALGORIX_API_KEY).

# Web UI (recommended)
xalgorix --web

# Or CLI
xalgorix --target https://example.com

💡 Web Search: If GEMINI_API_KEY is set, xalgorix will use Gemini for web search. Otherwise falls back to Brave/Google/Bing/DuckDuckGo scraping.

💡 Custom Providers: To use any custom LLM provider, just set XALGORIX_LLM=custom/modelname and XALGORIX_API_BASE=https://your-api-endpoint.com/v1

Xalgorix supports multiple LLM providers:

• OpenAI — openai/gpt-5.4, openai/gpt-5, openai/o1, openai/o3
• Anthropic — anthropic/claude-opus-4.6, anthropic/claude-sonnet-4.6
• DeepSeek — deepseek/deepseek-v4, deepseek/deepseek-v3, deepseek/deepseek-coder
• Google — google/gemini-3.1-pro, google/gemini-2.0-flash
• Groq — hosts Llama 4, Qwen 3, Mixtral (use model name directly)
• Ollama — ollama/llama4, ollama/qwen3 (local)
• MiniMax — minimax/M3, minimax/Text-01

# Focus on specific vulns
"Focus on SQL Injection and IDOR. Skip XSS."

# Traditional authenticated testing
"Login with: admin@email.com / Password123"

# API key authentication
"API: am_us_pod_474368638921786eec2228b27f..., username: agentmail"

# Email-based service testing  
"AgentMail credentials: api_key=xxx, email=user@agentmail.to"

# Bug bounty rules
"This is a HackerOne program. Out of scope: DoS, social engineering."

# Internal network
"Scan 10.0.0.0/24. Focus on SMB and database services."

xalgorix/
├── cmd/xalgorix/          # CLI entry point
├── internal/
│   ├── agent/             # 🤖 Core agent loop
│   ├── config/            # ⚙️ Configuration
│   ├── llm/               # 🧠 LLM client & parser
│   ├── tools/             # 🔧 11 built-in tools
│   │   ├── terminal/      # 💻 Command execution
│   │   ├── browser/      # 🌐 Headless Chrome
│   │   ├── python/       # 🐍 Python scripts
│   │   ├── reporting/     # 📊 Vulnerability reports
│   │   └── ...
│   ├── web/
│   │   ├── server.go      # 🌎 HTTP + WebSocket
│   │   └── static/        # 🎨 Web UI (HTML/CSS/JS)
│   └── tui/               # 📟 Terminal UI
└── skills/                # 📚 Vulnerability knowledge

❌ Filesystem:  rm -rf /, rm -rf ~, mkfs, dd
❌ SQL:         DROP TABLE, DELETE FROM, UPDATE
❌ System:      shutdown, reboot, halt, poweroff
❌ Code:        shutil.rmtree, os.remove

Xalgorix detects obfuscated commands:

After 5 consecutive failures, a tool is temporarily blocked for 60 seconds to prevent wasting time.

1. 🔍 Recon — Subdomains, ports, directories
2. 🦠 Vuln Scan — Nuclei, nmap scripts
3. 📂 Content — Fuzzing, backups, admin panels
4. 🔐 SSL/TLS — Cipher, certificates, headers
5. 🔑 Auth — SQLi login, brute-force, OAuth
6. 💉 Injection — XSS, SQLi, Command, XXE, SSTI
7. 🔄 SSRF — Param fuzzing, cloud metadata
8. 🚪 IDOR — Access control, privilege escalation
9. 🌐 API — GraphQL, REST, rate limiting
10. 📤 Upload — Extension bypass, webshells
11. ⚙️ RCE — Deserialization, Log4j
12. ⏱️ Race — TOCTOU, business logic
13. 🌟 Takeover — Subdomain, CNAME
14. 📧 Email — SPF, DKIM, DMARC
15. ☁️ Cloud — S3, Azure, GCP, K8s
16. 🔌 WebSocket — Origin, injection
17. CMS | WordPress, Joomla, Drupal
18. 🔗 Links — Broken link hijacking
19. 📦 Supply Chain — JS libs, dependencies
20. 📝 Report — JSON + PDF

The auto-generated report includes:

• ✅ Cover page with target & date
• 📊 Executive summary with vuln counts
• 🐛 Vulnerability details (CVSS, PoC, remediation)
• 🔗 Tested endpoints
• 📋 Methodology applied
• ⚠️ Legal disclaimer

~/xalgorix-data/
└── target.com/
    └── 2026-01-15/
        └── example.com_abc123/
            └── scan.json
        └── target.io_def456/
            └── scan.json
└── queue_state.json

• 📅 30-day auto-cleanup
• 💾 Survives page refresh
• 🔄 Queue resume after restart

Pull requests welcome! See CONTRIBUTING.md for guidelines.

MIT License — see LICENSE.