Metadata-Version: 2.4
Name: stryx-cli
Version: 0.1.2
Summary: AI-Powered Dynamic Application Security Testing (DAST) -- part of the MEDUSA security platform
Author-email: Akhilesh Varma <akhverm@gmail.com>
License: Apache-2.0
Project-URL: Homepage, https://github.com/Medusa-Security/stryx
Project-URL: Repository, https://github.com/Medusa-Security/stryx
Project-URL: Issues, https://github.com/Medusa-Security/stryx/issues
Project-URL: Documentation, https://github.com/Medusa-Security/stryx/blob/main/docs/USAGE.md
Project-URL: Changelog, https://github.com/Medusa-Security/stryx/blob/main/CHANGELOG.md
Keywords: security,dast,dynamic-analysis,vulnerability-scanner,penetration-testing,web-security,api-security,owasp,sast,application-security
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Testing
Classifier: Topic :: System :: Networking
Classifier: Framework :: AsyncIO
Classifier: Typing :: Typed
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: click<9,>=8.1
Requires-Dist: rich<14,>=13.0
Requires-Dist: httpx[socks]<1,>=0.25
Requires-Dist: pydantic<3,>=2.0
Requires-Dist: pyyaml<7,>=6.0
Requires-Dist: jinja2<4,>=3.1
Requires-Dist: openai<2,>=1.0
Requires-Dist: anthropic<1,>=0.25
Requires-Dist: groq<1,>=0.4
Provides-Extra: dev
Requires-Dist: pytest>=7.0; extra == "dev"
Requires-Dist: pytest-asyncio>=0.21; extra == "dev"
Requires-Dist: black>=23.0; extra == "dev"
Requires-Dist: ruff>=0.1.0; extra == "dev"
Requires-Dist: fastapi>=0.100; extra == "dev"
Requires-Dist: uvicorn>=0.20; extra == "dev"
Requires-Dist: respx>=0.21; extra == "dev"
Provides-Extra: xml
Requires-Dist: lxml<6,>=4.9; extra == "xml"
Provides-Extra: all
Requires-Dist: stryx[xml]; extra == "all"
Dynamic: license-file

# STRYX

**AI-Powered Dynamic Application Security Testing (DAST)**

[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
[![Python Version](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
[![Build Status](https://github.com/medusa-Security/stryx/actions/workflows/ci.yml/badge.svg)](https://github.com/medusa-Security/stryx/actions)

STRYX is a developer-first, AI-assisted DAST engine that crawls, maps, and tests the live attack surface of web applications. It discovers hidden endpoints, simulates real attacker behavior, and detects exploitable vulnerabilities with minimal false positives. Every finding carries full evidence (request, response, status code, payload, confidence score) -- no heuristic-only results.

**Design philosophy: high signal, low noise.**

## How It Fits Into MEDUSA

- **Remy** -- SAST, analyzes source code pre-deployment.
- **STRYX** -- DAST, validates a running application's live attack surface and exploitability.
- **MEDUSA** -- Aggregates findings from both, correlates static and runtime issues, estimates business impact, provides centralized security management.

## Architecture

```
CLI -> Configuration -> Attack Orchestrator -> { Endpoint Discovery }
                                                        |
                                         Authentication Engine
                                         Authorization Engine
                                         Injection Engine
                                         API Fuzzer
                                         AI Attack Planner
                                         Evidence Collector
                                         Report Generator
                                                        |
                                              Target Application
```

## Installation

```bash
# From PyPI
pip install stryx

# From source
git clone https://github.com/Medusa-Security/stryx.git
cd stryx
pip install -e .
```

## Quickstart

```bash
# Run a full scan
stryx scan http://localhost:8000

# Output:
# STRYX Scan Results
# Target: http://localhost:8000
# Total Findings: 3
# Breakdown: CRITICAL: 1 | HIGH: 1 | MEDIUM: 1
```

## Core Modules

| Module | Purpose |
|--------|---------|
| Endpoint Discovery | Crawls targets, extracts APIs from OpenAPI/Swagger, sitemaps, JS files, GraphQL |
| Authentication Scanner | Tests missing auth, weak JWTs, session fixation, cookie security |
| Authorization Scanner | Tests IDOR, privilege escalation, admin access, multi-tenant escape |
| Injection Engine | SQL, NoSQL, command, SSRF, path traversal, XXE, SSTI, LDAP injection |
| API Fuzzer | Parameter mutation, boundary values, type confusion, nested JSON |
| CORS Scanner | Detects misconfigured CORS policies and origin reflection |
| GraphQL Scanner | Tests introspection exposure, query depth limiting |
| AI Attack Planner | Constructs multi-step attack chains across findings |
| Evidence Engine | Enforces evidence requirements on every finding |

## CLI Reference

### Commands

| Command | Description |
|---------|-------------|
| `stryx scan <url>` | Run full security scan |
| `stryx crawl <url>` | Crawl and discover endpoints |
| `stryx auth <url>` | Run authentication tests |
| `stryx fuzz <url>` | Run API fuzzing tests |
| `stryx report <url>` | Generate reports |
| `stryx config` | View/update configuration |
| `stryx providers` | List supported AI providers |
| `stryx update` | Update STRYX |

### Flags

| Flag | Description |
|------|-------------|
| `--deep` | Enable deep scanning |
| `--json <file>` | Output JSON report |
| `--html <file>` | Output HTML report |
| `--markdown <file>` | Output Markdown report |
| `--threads <n>` | Concurrent threads (1-200) |
| `--timeout <s>` | HTTP timeout in seconds |
| `--headers <json>` | Custom headers |
| `--cookies <str>` | Authentication cookies |
| `--proxy <url>` | HTTP proxy |
| `--wordlist <file>` | Custom wordlist |
| `--rate <n>` | Requests per second limit |

## Configuration

```yaml
provider: groq
model: llama-3.3-70b-versatile
threads: 20
timeout: 10
crawl_depth: 5
respect_robots: false
ai_attack_planning: true
modules:
  auth: true
  authorization: true
  injection: true
  fuzzing: true
```

Supported AI providers: Groq, OpenAI, Anthropic, OpenRouter, Ollama, XAI, NVIDIA NIM.

## Sample Report

```
+--------------------------------------------------------------------+
| STRYX Scan Results                                                 |
| Target: http://localhost:8000                                      |
| Total Findings: 3                                                  |
| Breakdown: CRITICAL: 1 | HIGH: 1 | MEDIUM: 1                     |
+--------------------------------------------------------------------+

[#] [CRITICAL] Unauthenticated access to /admin
    Endpoint: http://localhost:8000/admin
    CWE: CWE-306 | Scanner: auth
    Confidence: 70%
    Evidence: GET http://localhost:8000/admin -> 200
```

## Roadmap

### v0.1 (this build)

- [ ] HTTP crawler
- [ ] Endpoint discovery
- [ ] Authentication scanning
- [ ] Authorization testing
- [ ] Basic injection testing
- [ ] JSON/HTML reports

### v0.5

- [ ] Browser automation
- [ ] GraphQL support
- [ ] Multi-threaded fuzzing
- [ ] AI attack planning
- [ ] Custom payloads
- [ ] Plugin SDK

### v1.0

- [ ] Autonomous attack chaining
- [ ] Headless browser exploitation
- [ ] CI/CD integration
- [ ] Distributed scanning
- [ ] Cloud dashboards (MEDUSA integration)
- [ ] AI-powered exploit reasoning

## Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

## Security Policy

See [SECURITY.md](SECURITY.md) for reporting vulnerabilities in STRYX itself.

## License

Apache License 2.0. See [LICENSE](LICENSE).

## Author

Built by Akhilesh Varma (ak495867) under Medusa Security.
