AI-Raider：可自托管、支持任意 LLM 的自主 AI 渗透测试智能体

Autonomous AI pentesting. An Apache-2.0 fork of usestrix/strix, reworked to run self-hosted with any LLM.

AI-Raider is a team of autonomous AI agents that pentest like real researchers: they do recon, run code in a sandbox, find vulnerabilities and confirm them with working proof-of-concept exploits, then propose fixes.

Authorized testing only. Run AI-Raider strictly against your own systems or targets you have written permission to test.

Self-host in a couple of minutes (your own key, any LLM, nothing leaves your machine) — see SELF-HOST.md:

git clone https://github.com/MaverickGH/ai-raider && cd ai-raider
./setup.sh            # checks Docker/Python, installs the tool, creates .env
# put your model and key in .env (or the Ollama block — no key needed), then:
./run-scan.sh https://your-staging quick

What it is

Full pentest toolkit out of the box: recon, exploitation, validation.
Multi-agent orchestration: teams of AI pentesters work in parallel.
Real exploit validation, not the false positives of static scanners.
CLI with clear findings and remediation guidance.
Auto-fixes and reports.

Requirements

Python 3.12+
Docker running (the agent sandbox)
An LLM API key (OpenAI, Anthropic, Google, OpenRouter, etc. via LiteLLM)

Install (from source)

uv venv && source .venv/bin/activate
uv pip install -e .
ai-raider --help

Quick start

export AIRAIDER_LLM="openrouter/z-ai/glm-5.3"   # any LiteLLM model id
export LLM_API_KEY="<your key>"

# headless run against an authorized target:
ai-raider -n -t ./path-to-app --scan-mode quick

The interactive TUI needs a Go toolchain to build; headless mode works without it.

Differences from upstream (Strix)

Rebranded to "AI-Raider", CLI command ai-raider, config dir ~/.ai-raider.
Telemetry off by default; cloud upsell removed from prompts.
Bilingual reports: report template labels/headers are English by default or Russian via --report-lang ru (or AIRAIDER_REPORT_LANG); model-produced content is left as-is.
Own sandbox image ai-raider-sandbox:0.1.0 (see containers/build-sandbox.sh), independent of the upstream tag at runtime.
Local models: the run-scan-local.sh preset for Ollama/LM Studio with no cloud key.

Quick commands

./run-scan.sh https://staging.your-domain quick     # cloud model (AIRAIDER_LLM + provider key)
./run-scan-local.sh https://staging.your-domain      # local model (Ollama), no cloud

# own sandbox image:
./containers/build-sandbox.sh          # fast branded build (on top of upstream)
./containers/build-sandbox.sh --full   # fully independent from the Kali Dockerfile (slow)

Config via .env or Keychain

The simplest way is a .env file (cross-platform) — run-scan.sh and run-scan-local.sh pick it up automatically:

cp env.example .env   # then edit: pick one provider block, add your key (or use Ollama)

On macOS you can instead keep the key in the Keychain so it is never exported in plain text — run-scan.sh reads it automatically:

./scripts/keychain-set.sh OPENAI_API_KEY            # paste the key with hidden input
./scripts/keychain-set.sh AIRAIDER_LLM openai/gpt-5.4 # model
./run-scan.sh https://authorized-target standard      # key/model taken from Keychain

Supported: OPENAI_API_KEY, ANTHROPIC_API_KEY, OPENROUTER_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, AIRAIDER_LLM, LLM_API_BASE (Keychain service ai-raider.local.<NAME>). Key values are entered hidden and never printed.

Use in CI (GitHub Actions)

Drop AI-Raider into any workflow with the composite action — it runs the scan and exposes the SARIF report (pin to @v1 for the latest v1.x, or @v1.0.0 to lock an exact release):

- uses: MaverickGH/ai-raider@v1
  id: airaider
  with:
    target: ./                       # URL, domain, IP, or path to code
    scan-mode: quick                 # quick | standard | deep
    model: anthropic/claude-sonnet-5 # any LiteLLM id
    max-budget: "10"
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}   # the provider key for your model

The job fails on validated findings (set fail-on-findings: "false" to only report). Upload the result to code scanning with the action's sarif output:

- uses: github/codeql-action/upload-sarif@v3
  if: always()                       # upload even when the scan step failed on findings
  with:
    sarif_file: ${{ steps.airaider.outputs.sarif }}

Shareable HTML report

Every run also writes a single, self-contained report.html (all CSS inlined, light/dark, bilingual) next to the other artifacts — open it offline or send it to a stakeholder as one file. Rebuild it for an older run, or in another language, without re-scanning:

python3 scripts/export-html.py                 # latest run
python3 scripts/export-html.py --run <dir> --report-lang ru

Export findings to DefectDojo

Every run writes findings.sarif (SARIF 2.1.0) — upload it to GitHub code scanning, or push it straight into DefectDojo:

export DEFECTDOJO_URL=https://defectdojo.example.com
export DEFECTDOJO_API_KEY=...
export DEFECTDOJO_PRODUCT="My App"            # auto-creates product + engagement
export DEFECTDOJO_ENGAGEMENT_NAME="AI-Raider scan"
python3 scripts/export-defectdojo.py          # latest run; --run <dir> / --dry-run also work

Or target an existing engagement with DEFECTDOJO_ENGAGEMENT=<id>.

Notify Slack / Teams / Jira

Post a run's summary (counts by severity, status, cost, top findings) to a chat webhook and/or open Jira issues — stdlib only, no dependencies:

# Chat webhook (Slack / Mattermost / Teams / Google Chat / any JSON endpoint)
export AIRAIDER_WEBHOOK_URL=https://hooks.slack.com/services/XXX/YYY/ZZZ
export AIRAIDER_WEBHOOK_FORMAT=slack            # slack | teams | gchat | json
python3 scripts/notify.py                        # latest run; --run <dir> also works

# Only ping when something serious turns up
python3 scripts/notify.py --min-severity high

# File Jira issues (one summary issue, or one per high/critical with --jira-per-finding)
export JIRA_URL=https://acme.atlassian.net
export JIRA_USER=you@acme.io                      # omit for a bare PAT (Server/DC)
export JIRA_TOKEN=...                             # API token / personal access token
export JIRA_PROJECT=SEC
python3 scripts/notify.py --jira-per-finding

Add --dry-run to preview the message without sending. Wire it after a scan in CI or a cron job.