# Xalgorix

> Xalgorix is an autonomous AI pentesting platform that runs a 22-phase offensive methodology against apps, APIs, and source code, then re-exploits every candidate finding so reports contain proven vulnerabilities instead of unverified alerts.

Xalgorix is an autonomous AI penetration testing platform that tests web applications, APIs, and source code, then tries to reproduce every candidate finding before it reaches a report. An LLM-driven agent works through a fixed offensive methodology, and a separate verification step re-exploits what it found. It is published as an Apache-2.0 licensed Go and TypeScript project that teams can self-host, and the same engine also runs as a managed cloud service.

## What It Is

The project describes itself as an open-source AI pentester that proves vulnerabilities rather than guessing at them. Instead of matching signatures or templates, the agent reasons about authentication flows, business logic, and access control, chaining steps the way a human tester would. Coverage spans injection, SSRF, IDOR and broken access control, file upload, deserialization, race conditions, and subdomain takeover, among others. Findings carry CVSS scores, evidence, and remediation guidance, and can be exported as branded PDF reports.

## The 22-Phase Methodology

Every engagement is organized into 22 numbered phases, running from reconnaissance through directory discovery, CORS and cookie analysis, session testing, cloud and infrastructure checks, and a final report. Output from each phase feeds the next, so reconnaissance results shape later exploitation attempts. Operators can run the full sweep or select a subset when an engagement only calls for certain phases.

## Verification Instead of Triage

Phase 20 is dedicated to exploit verification. An independent verifier re-tests each candidate finding, and the vendor states that anything it cannot reproduce is flagged for review rather than reported as confirmed. That is the design decision separating Xalgorix from template scanners, trading runtime and depth for a much shorter list to triage. Payloads are described as non-destructive, with configurable rate limits, proxy rotation, and circuit breakers intended to make runs safe against staging and production systems.

## Self-Hosted or Managed

The self-hosted build runs a local dashboard and REST API on your own machine, with a bring-your-own-model setup supporting OpenAI, Anthropic, DeepSeek, Gemini, Groq, Ollama, and MiniMax, plus any OpenAI-compatible gateway such as LiteLLM. The documentation states that no target data, keys, or findings leave your infrastructure. The managed cloud version removes setup and model-key management, routes across frontier models per phase, and adds scheduling, team workspaces, and out-of-band infrastructure for blind SSRF and RCE testing.

## Code Scanning and Pull Request Reviews

Xalgorix also scans code directly. Source review mode traces user input from entry point to dangerous sink without a running target, while provision mode builds and runs the application locally, then pentests the instance it started. A GitHub App reviews pull request diffs and posts findings as a single comment that updates in place on new commits, with no workflow file or API key to manage, and a GitHub Action can fail a build when verified findings cross a severity threshold the team sets.

## Features
- Autonomous LLM agent that runs a 22-phase penetration testing methodology
- Dedicated exploit verification phase that independently reproduces each finding
- Reasoning over auth flows, business logic, IDOR/BOLA, and chained exploits
- Single target, wildcard/multi-target, and browser-assisted DAST scan modes
- Source code scanning from a Git URL, local path, or uploaded archive
- Provision mode that builds and runs an app locally, then pentests it
- GitHub App that reviews pull request diffs and comments findings
- GitHub Action that fails builds at a chosen severity threshold
- Live WebSocket telemetry of tool calls, agent messages, HTTP, and LLM activity
- Findings management with CVSS scoring, severity filters, and deduplication
- Branded PDF reports with executive summary, proof of concept, and remediation
- Scheduled recurring scans and resumable scan persistence
- REST API and signed scan.completed webhooks
- Bring-your-own-LLM support across OpenAI, Anthropic, DeepSeek, Gemini, Groq, Ollama, and MiniMax
- Self-hosted local dashboard with Docker images for amd64 and arm64
- Configurable rate limits, proxy rotation, and non-destructive payload safeguards

## Integrations
GitHub, GitHub Actions, Docker, Slack, Discord, Telegram, AgentMail, Caido, LiteLLM, OpenAI, Anthropic, Google Gemini, DeepSeek, Groq, Ollama, MiniMax

## Platforms
LINUX, MACOS, WEB, API, CLI

## Pricing
Open Source, Free tier available

## Version
v4.6.78

## Links
- Website: https://www.xalgorix.com
- Documentation: https://www.xalgorix.com/docs
- Repository: https://github.com/xalgorix/xalgorix
- EveryDev.ai: https://www.everydev.ai/tools/xalgorix