Xalgorix

Xalgorix is an autonomous AI penetration testing platform that tests web applications, APIs, and source code, then tries to reproduce every candidate finding before it reaches a report. An LLM-driven agent works through a fixed offensive methodology, and a separate verification step re-exploits what it found. It is published as an Apache-2.0 licensed Go and TypeScript project that teams can self-host, and the same engine also runs as a managed cloud service.

What It Is

The project describes itself as an open-source AI pentester that proves vulnerabilities rather than guessing at them. Instead of matching signatures or templates, the agent reasons about authentication flows, business logic, and access control, chaining steps the way a human tester would. Coverage spans injection, SSRF, IDOR and broken access control, file upload, deserialization, race conditions, and subdomain takeover, among others. Findings carry CVSS scores, evidence, and remediation guidance, and can be exported as branded PDF reports.

The 22-Phase Methodology

Every engagement is organized into 22 numbered phases, running from reconnaissance through directory discovery, CORS and cookie analysis, session testing, cloud and infrastructure checks, and a final report. Output from each phase feeds the next, so reconnaissance results shape later exploitation attempts. Operators can run the full sweep or select a subset when an engagement only calls for certain phases.

Verification Instead of Triage

Phase 20 is dedicated to exploit verification. An independent verifier re-tests each candidate finding, and the vendor states that anything it cannot reproduce is flagged for review rather than reported as confirmed. That is the design decision separating Xalgorix from template scanners, trading runtime and depth for a much shorter list to triage. Payloads are described as non-destructive, with configurable rate limits, proxy rotation, and circuit breakers intended to make runs safe against staging and production systems.

Self-Hosted or Managed

The self-hosted build runs a local dashboard and REST API on your own machine, with a bring-your-own-model setup supporting OpenAI, Anthropic, DeepSeek, Gemini, Groq, Ollama, and MiniMax, plus any OpenAI-compatible gateway such as LiteLLM. The documentation states that no target data, keys, or findings leave your infrastructure. The managed cloud version removes setup and model-key management, routes across frontier models per phase, and adds scheduling, team workspaces, and out-of-band infrastructure for blind SSRF and RCE testing.

Code Scanning and Pull Request Reviews

Xalgorix also scans code directly. Source review mode traces user input from entry point to dangerous sink without a running target, while provision mode builds and runs the application locally, then pentests the instance it started. A GitHub App reviews pull request diffs and posts findings as a single comment that updates in place on new commits, with no workflow file or API key to manage, and a GitHub Action can fail a build when verified findings cross a severity threshold the team sets.