# ci-security-scanning-with-strix

> Claude/Codex skill by [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars · Updated 2026-10-15

Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it merges, with results as PR comments and SARIF uploaded to code scanning. Covers both the self-hosted open-source CLI (runs in your runner) and the managed app.strix.ai platform (GitHub/GitLab app or API, no runner infra). Use when the user asks to add security scanning, SAST/DAST, pentesting, vulnerability checks, or automated security review to their CI pipeline, pre-merge gate, or PR workflow.

Tags: agents, ai-hacking, ai-penetration-testing, ai-pentesting, ai-security, artificial-intelligence, bug-bounty, code-quality, ctf-tools, cybersecurity, cybersecurity-tools, ethical-hacking, hacking, llm-security, offensive-security, penetration-testing, pentesting-tools, red-teaming, security, security-automation

## Install

```sh
git clone https://github.com/usestrix/strix /tmp/strix && ln -s /tmp/strix/skills/ci-security-scanning-with-strix ~/.claude/skills/ci-security-scanning-with-strix
```

## From README

Set up Strix in CI/CD You can gate PRs two ways — pick based on the environment, or combine them: Managed platform (recommended for most teams) — connect the GitHub/GitLab/Bitbucket app once and Strix reviews every PR with no workflow file, no runner, no Docker, and no LLM key. Results post as PR comments and land in the team dashboard. Best when you want zero CI maintenance, central tracking, or your runners lack Docker. See "Managed platform" below and the managed-pentesting-with-strix skill. Self-hosted OSS CLI in your runner — run a diff-scoped scan as a pipeline step. Fully in your infra, free (BYO LLM key), no external account. Requires Docker on the runner. Best for air-gapped/self-hosted CI or when you do not want scans leaving your environment. Both fail the build on validated findings and both emit SARIF 2.1.0, so you can start with one and add the other later.

## Links

- HTML page: https://omgskills.com/skills/usestrix/strix/ci-security-scanning-with-strix/
- GitHub: https://github.com/usestrix/strix
- Author: [@usestrix](https://omgskills.com/library/usestrix/index.md)

## More from this repo

- [api-security-testing](https://omgskills.com/skills/usestrix/strix/api-security-testing/index.md) — Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 72k stars
- [application-security-testing](https://omgskills.com/skills/usestrix/strix/application-security-testing/index.md) — Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars
- [find-security-vulnerabilities-in-code](https://omgskills.com/skills/usestrix/strix/find-security-vulnerabilities-in-code/index.md) — Used to find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars