STRYX

AI-Powered Dynamic Application Security Testing (DAST)

STRYX is a developer-first, AI-assisted DAST engine that crawls, maps, and tests the live attack surface of web applications. It discovers hidden endpoints, simulates real attacker behavior, and detects exploitable vulnerabilities with minimal false positives. Every finding carries full evidence (request, response, status code, payload, confidence score) -- no heuristic-only results.

Design philosophy: high signal, low noise.

How It Fits Into MEDUSA

• Remy -- SAST, analyzes source code pre-deployment.
• STRYX -- DAST, validates a running application's live attack surface and exploitability.
• MEDUSA -- Aggregates findings from both, correlates static and runtime issues, estimates business impact, provides centralized security management.

Architecture

CLI -> Configuration -> Attack Orchestrator -> { Endpoint Discovery }
                                                        |
                                         Authentication Engine
                                         Authorization Engine
                                         Injection Engine
                                         API Fuzzer
                                         AI Attack Planner
                                         Evidence Collector
                                         Report Generator
                                                        |
                                              Target Application

Installation

# From PyPI
pip install stryx

# From source
git clone https://github.com/Medusa-Security/stryx.git
cd stryx
pip install -e .

Quickstart

# Run a full scan
stryx scan http://localhost:8000

# Output:
# STRYX Scan Results
# Target: http://localhost:8000
# Total Findings: 3
# Breakdown: CRITICAL: 1 | HIGH: 1 | MEDIUM: 1

Core Modules

CLI Reference

Commands

Flags

Configuration

provider: groq
model: llama-3.3-70b-versatile
threads: 20
timeout: 10
crawl_depth: 5
respect_robots: false
ai_attack_planning: true
modules:
  auth: true
  authorization: true
  injection: true
  fuzzing: true

Supported AI providers: Groq, OpenAI, Anthropic, OpenRouter, Ollama, XAI, NVIDIA NIM.

Sample Report

+--------------------------------------------------------------------+
| STRYX Scan Results                                                 |
| Target: http://localhost:8000                                      |
| Total Findings: 3                                                  |
| Breakdown: CRITICAL: 1 | HIGH: 1 | MEDIUM: 1                     |
+--------------------------------------------------------------------+

[#] [CRITICAL] Unauthenticated access to /admin
    Endpoint: http://localhost:8000/admin
    CWE: CWE-306 | Scanner: auth
    Confidence: 70%
    Evidence: GET http://localhost:8000/admin -> 200

Roadmap

v0.1 (this build)

• HTTP crawler
• Endpoint discovery
• Authentication scanning
• Authorization testing
• Basic injection testing
• JSON/HTML reports

v0.5

• Browser automation
• GraphQL support
• Multi-threaded fuzzing
• AI attack planning
• Custom payloads
• Plugin SDK

v1.0

• Autonomous attack chaining
• Headless browser exploitation
• CI/CD integration
• Distributed scanning
• Cloud dashboards (MEDUSA integration)
• AI-powered exploit reasoning

Contributing

See CONTRIBUTING.md for guidelines.

Security Policy

See SECURITY.md for reporting vulnerabilities in STRYX itself.

License

Apache License 2.0. See LICENSE.

Author

Built by Akhilesh Varma (ak495867) under Medusa Security.