The most powerful open-source AI autonomous pentesting agent.|
Give it a target URL, and Xalgorix will find vulnerabilities, generate a professional PDF report, and send Discord alerts — all automatically.
LLM-driven pentesting with a comprehensive 20-phase methodology. No human intervention needed — set a target and watch it work.
Dark mode dashboard with live real-time feed, chat with the agent during scans, and complete token tracking. Works on mobile.
Works with OpenAI, Anthropic, DeepSeek, Google, Groq, Ollama, MiniMax — or any custom provider. Your choice, your keys.
Professional pentest reports auto-generated with cover page, executive summary, CVSS scoring, PoC, and remediation steps.
Get notified instantly on scan start, vulnerability discovery, and completion. Never miss a critical finding.
85+ tool-to-package mappings across Go, APT, PIP, Cargo, Gem, and NPM. Missing a tool? Xalgorix installs it automatically.
Blocks destructive commands, detects encoding bypass attempts (Base64, hex, URL), and rate limits to protect your IP.
Auto-blocks failing tools after 5 consecutive failures for 60 seconds. Prevents wasting time on broken integrations.
Send messages to the agent while a scan is running. Guide it, ask questions, or redirect focus in real-time.
Resume interrupted scans after restart. Multi-target queue system processes targets sequentially with full state recovery.
CVE search via NIST NVD, exploit search via Exploit-DB, web search via Gemini/Brave/Google. All integrated natively.
Built-in email system for sign-up verification and OTP retrieval. Test authenticated flows without manual intervention.
From single targets to full wildcard subdomain enumeration — choose the depth that fits your mission.
A comprehensive, systematic approach to penetration testing — from reconnaissance to reporting.
Bring your own API key. Xalgorix supports 7+ providers out of the box — or connect any custom endpoint.
A comprehensive feature-by-feature comparison with every major open-source alternative.
| Feature | Xalgorix | Shannon | Strix | PentestGPT | HexStrike | PentAGI | Nebula |
|---|---|---|---|---|---|---|---|
| Self-Hosted | ✓ | ⚠ SaaS | ✓ | ✓ | ✓ | ✓ | ✓ |
| Web UI Dashboard | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Live Real-Time Feed | ✓ | ✗ | ✗ | ⚠ Term | ✗ | ✗ | ✗ |
| Chat During Scan | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| PDF Reports (Auto) | ✓ | ✓ | ✓ | ⚠ Manual | ✗ | ✗ | ✗ |
| Discord Alerts | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Auto-Install Tools | ✓ 85+ | ✗ | ⚠ Docker | ⚠ Docker | ⚠ MCP | ⚠ Docker | ⚠ CLI |
| Rate Limiting | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Multi-Target Queue | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Circuit Breaker | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| DAST Mode | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Wildcard Scan | ✓ | ✗ | ✗ | ⚠ Manual | ✗ | ⚠ Manual | ✗ |
| CVE Search Built-in | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Browser Automation | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
From zero to scanning in under 2 minutes. Xalgorix handles the rest.
One command to install via Go — or build from source.
# Install via Go (recommended)
GOPROXY=direct go install -v \
github.com/xalgord/xalgorix/v4/cmd/xalgorix@latest
Set your LLM provider and API key.
# ~/.xalgorix.env
XALGORIX_LLM=openai/gpt-5.4
XALGORIX_API_KEY=sk-your-key
Launch the Web UI or scan directly from CLI.
# Launch Web UI
xalgorix --web
# Or scan directly
xalgorix --target https://example.com
A real-time dashboard that puts you in control — dark mode, live feed, and full scan visibility.
Deploy Xalgorix on your machine and let AI do the pentesting. Open source. Free forever. No limits.