Developer Tools

Strix

by Strix

Overview

Strix brings AI penetration testing and vulnerability management into ChatGPT. Review recent tests, prioritize open findings by severity, and inspect evidence and remediation steps. Start tests against your authorized web applications, APIs, and repositories; retest findings; and open fix pull requests or tickets through connected integrations. Check pull request security reviews and supply-chain findings, manage recurring schedules and assets, and summarize your workspace's security activity. Sign in with your Strix account using OAuth. Access follows your Strix workspace role and resource permissions. Starting tests, retests, reviews, and other security workflows may use Strix credits and send traffic to the selected targets. Some capabilities require an eligible Strix plan.

Tools

add_cloud_connection_project

ChatGPT

Adds a project under an existing cloud connection. The source connection must own a provider credential.

auto_verify_domain

ChatGPT

Creates the _strix-verification TXT record through the organization's connected DNS provider (Vercel or Cloudflare) and runs the DNS verification check. Requires an organization admin to have connected the provider in the dashboard first.

bulk_push_vulnerabilities_to_ticket

ChatGPT

Creates or syncs Jira or Linear tickets for up to 100 vulnerabilities in a single request. Each vulnerability is processed independently. The response reports per-vulnerability success or failure.

bulk_update_vulnerabilities

ChatGPT

Applies one status and/or severity change to up to 100 vulnerabilities in a single request. The server processes each vulnerability independently and reports per-vulnerability success or failure. Vulnerabilities that already have the requested values count as successful.

cancel_scan

ChatGPT

Cancel a pending or running scan. Credits may be refunded if cancelled within 5 minutes.

complete_upload

ChatGPT

Queues bounded archive validation after the byte transfer. Repeat this request after a 202 response until validation completes. Repeating completion for a completed upload is idempotent. Asset-scoped tokens can finalize only uploads from their effective user. Unscoped tokens retain organization-wide access.

configure_azure_repos_hooks

ChatGPT

Create or repair service hooks for registered repositories on this connection. Requires an organization admin, integrations:write, Azure project service-hook permissions, and an HTTPS webhook address reachable by Azure. Safe to retry.

create_domain

ChatGPT

create_knowledge_document

ChatGPT

Manage organization knowledge. Organization-global knowledge writes are not available to asset-scoped tokens.

create_repositories

ChatGPT

create_scan

ChatGPT

Launch a new penetration test scan against the specified targets. For retry-safe at-most-once creation, send an Idempotency-Key and reuse the exact same key and request after a lost or ambiguous response. The key is optional for backward compatibility, retained for 24 hours, and cannot be reused with a different actor, operation, or payload. A terminal response is replayed only after the caller still passes current target/resource authorization; revoked access returns a fresh 403/404 without exposing the receipt. Use a new key only for a deliberate new attempt.

create_scan_report_export

ChatGPT

Generate a report for a completed scan and return a short-lived signed download link instead of the file. Same options and plan requirements as GET /scans/{scanId}/report; use this from clients that cannot receive a file, such as the Strix MCP. The link expires after one hour and the file is deleted shortly after. Report exports require an Enterprise plan.

create_schedule

ChatGPT

Create a recurring scan schedule. Optionally trigger an immediate scan with also_run_now. Supply Chain schedules require the Enterprise Supply Chain entitlement. When also_run_now creates a chargeable scan, the optional Idempotency-Key covers both schedule creation and that immediate scan; reuse the exact same key only to retry the exact same request. Replay and in-progress responses are still subject to current authorization against the persisted schedule when it exists.

create_test_user

ChatGPT

Creates a test account the agent can log in as. Secrets are encrypted at rest and never returned. Email-based MFA requires a Strix-managed inbox (see provision-inbox).

create_vulnerability_fix_pr

ChatGPT

Opens a pull request with an agent-authored fix for the vulnerability. For code findings, this patches the affected files. For dependency findings (npm-based projects), it bumps the direct dependency in package.json or pins the vulnerable transitive package through the project's override mechanism (npm overrides, yarn resolutions, or pnpm overrides).

create_webhook

ChatGPT

Create a new webhook subscription. The signing secret is returned only in this response. Asset-scoped tokens must provide an in-scope business_unit and cannot create organization-wide subscriptions.

create_workspace

ChatGPT

Create a workspace and make the token owner its admin. Requires a personal token and the organizations:write scope.

delete_connector

ChatGPT

Deletes the connector and revokes its devices. Personal tokens must belong to an organization admin (parity with the dashboard).

delete_container_image

ChatGPT

Delete the image and its scan history. Strix closes the open findings of the image. Session callers must hold the admin or analyst role without asset scopes.

delete_container_registry

ChatGPT

Delete the registry, its images, and its scan history. Strix closes the open findings of those images. Session callers must hold the admin or analyst role without asset scopes.

delete_domain

ChatGPT

Remove a domain.

delete_knowledge_document

ChatGPT

Manage organization knowledge. Organization-global knowledge writes are not available to asset-scoped tokens.

delete_knowledge_policy

ChatGPT

Deletes an organization knowledge policy. Personal tokens must belong to an organization admin (parity with the dashboard). Organization-global knowledge writes are not available to asset-scoped tokens.

delete_knowledge_source

ChatGPT

Disconnects the source and deletes its selected resources and note. Strix asks the vendor's authorization server to revoke the grant first and reports whether that succeeded; when it did not, the response says what is left to finish at the provider. Removing a source that is already gone succeeds. Personal tokens must belong to an organization admin, and asset-scoped tokens cannot remove organization-global sources.

delete_repository

ChatGPT

Remove a repository.

delete_scan

ChatGPT

Permanently deletes a scan and its findings.

delete_schedule

ChatGPT

Delete a schedule.

delete_test_user

ChatGPT

Deletes the test user when called on its home domain. When called on another domain covered by the user's scope, only detaches that domain from the scope (response includes detached: true). Org-wide (all-domains) users can only be deleted from their home domain (409 otherwise).

delete_upload

ChatGPT

Delete an unreferenced upload. Asset-scoped tokens may delete only uploads created by their effective user; unscoped tokens retain organization-wide access. Inaccessible upload IDs return 404. Uploads already attached to any scan are immutable and return 409 without removing the storage object or soft-deleting the row.

delete_webhook

ChatGPT

Delete a webhook. Asset-scoped tokens may delete only a webhook whose business_unit is covered by their token scopes.

disconnect_integration

ChatGPT

Disconnects the integration for the organization. installation_id is required for GitHub, GitLab, Bitbucket, and Azure Repos, which may have multiple installations; omit it for organization-wide providers such as Slack. Personal tokens must belong to an organization admin (parity with the dashboard).

exec_chat_terminal_command

ChatGPT

Executes one non-interactive command inside the chat agent's sandbox, starting from a directory under /workspace. Execution time and output size are capped by the runtime, and every attempt is recorded as a chat.terminal.command audit event.

export_container_image_sbom

ChatGPT

Download the SBOM of one completed scan as an SPDX 2.3 or CycloneDX 1.6 JSON document. Without scan_id, Strix uses the latest completed scan. Strix builds the document from the stored components, so it matches list_container_image_components.

export_repository_sbom

ChatGPT

Export repository SBOM.

file_chat_finding

ChatGPT

Adds a chat-discovered finding to the organization's issue list. Idempotent: re-filing returns the same finding. When the organization already tracks an equivalent finding (same title, target and endpoint), the finding is left unfiled and duplicate_of identifies the existing issue. Recorded as a chat.finding.filed audit event.

get_analytics_overview

ChatGPT

Unified dashboard overview: KPIs with period-over-period deltas, issues-over-time by source (pentests vs PR reviews), severity breakdown, PR review effectiveness (distinct PRs, verdicts, addressed rate, top repos and contributors), remediation trends, exploitability (KEV/EPSS) of open issues and active dependency CVEs, threat intelligence feed (recently exploited and high-risk CVEs, flagged when they match your open issues), and activity heatmap. Asset-scoped tokens cannot access organization-wide analytics.

get_analytics_stats

ChatGPT

Aggregate counts powering the dashboard (scans, vulnerabilities by severity/status, and more). Accepts the same filter query params as the dashboard. Asset-scoped tokens cannot access organization-wide analytics.

get_asset_discovery_run

ChatGPT

Returns one asset discovery run with its status, summary, and asset count.

get_asset_discovery_schedule

ChatGPT

Returns how often discovery runs start on their own, which verified domains they start from, which outcomes send a notification, and who gets it.

get_auto_topup_settings

ChatGPT

Not available on self-hosted deployments (returns 404). Get the automatic top-up settings for the organization. Requires the billing:read scope, an unscoped token, and the admin role.

get_chat

ChatGPT

Get a chat.

get_chat_action_approval

ChatGPT

Reads one approval the chat agent requested for a guarded API operation. A pending row stays decidable until someone approves or denies it. The chat must be visible to the token's user.

get_chat_credit_usage

ChatGPT

Not available on self-hosted deployments (returns 404). Get the credits that Chat can spend and the cost of a typical chat in the organization. Give chat_id to also get what that chat has used and what automatic top-up bought for it. A chat uses part of a credit for each agent step. Requires the chat:read scope.

get_chat_finding

ChatGPT

Returns the complete vulnerability row for a finding reported in the chat. The row includes findings that are not filed in the organization's issue list.

get_connector

ChatGPT

Get a network connector.

get_connector_status

ChatGPT

Queries the connector's live health and updates the stored status.

get_container_ecr_setup

ChatGPT

Returns the external id, the Strix AWS account, and the role name that an Amazon ECR pull role must trust, plus a CloudFormation quick-create link. Call this endpoint before you create an ecr registry. Container scanning requires the Enterprise plan.

get_container_image

ChatGPT

Image metadata with its registry, latest scan, layers, and image configuration from the latest completed scan.

get_container_registry

ChatGPT

Get a container registry.

get_containers_summary

ChatGPT

Organization-wide counts for the Containers dashboard. Container scanning requires the Enterprise plan.

get_credit_balance

ChatGPT

Not available on self-hosted deployments (returns 404). Get the current top-up credit balance for the organization. The response also gives the whole-credit balance that Chat can spend. A credit that Chat has only partly used counts as one. Requires the billing:read scope.

get_fix_pr_settings

ChatGPT

Returns how the organization names the pull requests that Strix opens to fix findings. A null value means the default is in use.

get_integration_settings

ChatGPT

Returns the ticketing settings for the Linear or Jira integration. Administrators and service tokens also receive the connected repositories and the repository routes.

get_license_status

ChatGPT

License state for self-hosted installs: whether licensing is enforced, the current state (unlicensed/valid/expired/grace_exceeded/invalid), signed entitlements (seat, domain, repo, developer, pentest, and concurrency limits plus feature flags), expiry, and install-wide aggregate usage counts. Licenses are verified offline from a signed token, so there is no sync (last_synced_at is always null). On SaaS this always reports enforced=false. Requires the license:read scope. Personal tokens must belong to an org admin (service tokens are admin-issued and exempt).

get_llm_costs_overview

ChatGPT

Self-hosted (on-prem) only — returns 404 on SaaS. Full LLM spend analytics: KPIs with period deltas, month-to-date and projected burn, cost and token timelines, breakdowns by model/asset/member, most expensive runs, and cache efficiency. Requires an unrestricted token (tokens limited by rbac scopes are rejected).

get_llm_settings

ChatGPT

Self-hosted (on-prem) only — returns 404 on SaaS. Requires the organization admin role. Named model configurations (API keys and extra headers are never returned, only whether they are set), per-purpose model assignments (default, scan, pr_review, chat, dedupe, app), env-fallback models per purpose, and current month-to-date spend per run type.

get_notification_settings

ChatGPT

Returns the organization's notification settings, including SLA deadline reminder configuration.

get_organization

ChatGPT

Returns workspace configuration for the authenticated token organization.

get_pr_review

ChatGPT

Fetches a PR review with its findings. Results are limited to repositories within the token's rbac scopes.

get_pr_review_settings

ChatGPT

Get PR review settings.

get_repository_supply_chain_summary

ChatGPT

Counts for the resolved scope. Pull-request and merge-request scans keep no SBOM snapshot, so scoping to one of those jobs with job_id serves component_count, finding_count, malicious_count, suspicious_count, vulnerable_count, and severity_counts from the job's stored scan result. For those scopes latest_snapshot is null and ecosystem_counts is empty, because neither can be derived without stored component rows. A change-scan job that ran before scan results were stored reports zero counts.

get_run_llm_usage

ChatGPT

Self-hosted (on-prem) only — returns 404 on SaaS. Cost, token, and request totals recorded for a single scan, PR review, or chat run. usage is null until the run has reported cost. Requires an unrestricted token (tokens limited by rbac scopes are rejected).

get_run_log

ChatGPT

Self-hosted installs only. Returns the tail of one run log of the authenticated organization. JSON holds at most 8 MiB, and format=raw or download=1 holds at most 32 MiB. Secrets are redacted before the text leaves the server.

get_scan

ChatGPT

Returns full scan details including associated vulnerabilities. A pentest's list omits dependency CVE findings. A supply-chain scan's findings are all dependency CVEs. The response embeds them only when the token also holds the dependencies:read scope. Without that scope, the list is empty.

get_scan_agent_trace

ChatGPT

Returns one page of an agent's steps, oldest first. A step is an agent message, a tool call, a tool result, or a reported finding. Long payloads are shortened and marked with truncated. To read a shortened payload in full, call GET /scans/{scanId}/trace/{eventId} with the step's event_id. To read the next page, send the returned cursor value. If the response contains a note field, the trace is incomplete and the note tells you why.

get_scan_budget_state

ChatGPT

Self-hosted only; the route answers 404 elsewhere. Reads the actual spend, the cost limit, and the paused state from the running pentest. Calls in flight when the limit was reached finish and are counted, so spent_usd can exceed max_budget_usd.

get_scan_frequency

ChatGPT

Daily scan counts for roughly the last 10 months, suitable for a contribution-style heatmap. Asset-scoped tokens cannot access organization-wide analytics.

get_scan_limit

ChatGPT

Not available on self-hosted deployments (returns 404). Get the scan limit for the organization and the number of scans used in the current period. Each scan counts once, for all of its repositories and domains. Retests and failed scans do not count. Periods use UTC, and a week starts on Monday. The value of scan_limit is null when the organization has no limit. Requires the billing:read scope.

get_scan_sarif

ChatGPT

Generate a SARIF 2.1.0 export for active vulnerabilities on a scan.

get_scan_template

ChatGPT

Returns the scan's configuration shaped for starting a new, similar scan. Credentials are returned as metadata only (username, notes, MFA method, has_stored_secret) — raw secrets such as passwords, TOTP seeds, MFA inboxes, and login URLs are never included. Use test_user_ids with POST /scans to reuse saved test users. Their secrets are rehydrated server-side.

get_scan_trace_step

ChatGPT

Returns the complete payload of one trace step. Use this endpoint when the trace returned the step with truncated set to true.

get_schedule

ChatGPT

Returns schedule details including recent run history.

get_schedule_template

ChatGPT

Returns the full stored configuration of the schedule, in a format that you can edit with PATCH /schedules/{scheduleId} — targets, prompts, test users, headers, scope, timing, notifications, and uploads. Credentials are returned as metadata only (username, notes, MFA method, has_stored_secret) and headers as metadata only (name, notes, has_stored_value) — raw secrets such as passwords, TOTP seeds, header values, MFA inboxes, and login URLs are never included. Keep a stored header value on PATCH by sending keep_stored_value: true.

get_supply_chain_org_summary

ChatGPT

Get organization supply-chain summary.

get_test_user_login_verification

ChatGPT

Returns the latest login verification for a saved test user, or null if it has never been verified. Poll this while a verification is pending / running.

get_vulnerability

ChatGPT

Returns full details for a single vulnerability.

get_vulnerability_history

ChatGPT

Returns lifecycle audit entries for one vulnerability, including status, severity, snooze, note, and reason changes.

get_vulnerability_share_settings

ChatGPT

Returns whether share links for the vulnerability ask for a password, the most recent revocation cut-off, and the newest access requests from viewers who opened a locked or password-protected link.

get_webhook

ChatGPT

Returns a webhook subscription. Asset-scoped tokens may access only a webhook whose business_unit is covered by their token scopes.

get_webhook_delivery

ChatGPT

Returns one delivery attempt record, including the event payload that was sent and the endpoint's response status and body. Asset-scoped tokens may access deliveries only for an in-scope business_unit webhook.

import_discovered_asset

ChatGPT

Add a discovered host name or IPv4 address to the domain inventory. When the host is under a domain the organization already verified, or is an IPv4 address the organization already verified, the new domain is verified and a scan can start at once. Otherwise, verify the domain first with verify_domain. A netblock, a wildcard, or an IPv6 address is not one target and cannot be imported (422 not_importable).

invite_organization_member

ChatGPT

Invite organization member.

link_vulnerability_pull_request

ChatGPT

Stores a pull request or merge request URL as the vulnerability's fix PR. Works for every finding, including black-box findings with no repository. Accepts GitHub pull requests, GitLab merge requests and Bitbucket pull requests on any host, including self-hosted instances. Strix attaches the pull request to each Linear or Jira ticket of the finding. A previous pull request on the finding is replaced and removed from those tickets. Tickets created later pick up the stored pull request automatically. Returns 409 when the stored pull request changed while the request was in flight.

list_asset_discovery_runs

ChatGPT

Returns the most recent asset discovery runs for the authenticated organization, the run that is in progress, the verified domains a new run can start from, and the recurring schedule. Asset Discovery is free: runs are not limited and do not use credits.

list_audit_events

ChatGPT

Returns enterprise audit events for the authenticated organization, with optional CSV, Snowflake NDJSON, or Splunk NDJSON export formats.

list_chat_credentials

ChatGPT

Returns metadata for the credentials armed on a chat plus the saved domain test users the caller may attach. Secret material (passwords, TOTP seeds) is never returned.

list_chat_findings

ChatGPT

Findings discovered inside a chat are exploratory and stay out of the organization's issue lists until a member files one; filed_at reflects that state.

list_chat_workspace_files

ChatGPT

Lists files in the running chat agent's /workspace so artifacts (reports, PoCs, generated files) can be exported. The sandbox response is limited to 2 MiB and 10,000 entries before JSON normalization.

list_chats

ChatGPT

Most recent chats for the organization (up to 50).

list_cloud_connections

ChatGPT

Returns the cloud connections available to scans in the organization.

list_connectors

ChatGPT

List network connectors.

list_container_image_components

ChatGPT

SBOM components from one scan. Without scan_id, Strix uses the latest completed scan.

list_container_image_findings

ChatGPT

Findings for the image. Each finding is a vulnerability row, so the Vulnerabilities endpoints accept its id.

list_container_image_snapshots

ChatGPT

Scan history for the image, newest first. Each entry is one image snapshot: the run that scanned the image and the digest, platform, layers, and configuration that the run recorded. The list contains at most 50 snapshots.

list_container_images

ChatGPT

Tracked images with counts from their latest completed scan. Container scanning requires the Enterprise plan.

list_container_registries

ChatGPT

Registries that the organization connected. Container scanning requires the Enterprise plan.

list_discovered_assets

ChatGPT

Returns the discovered assets of the authenticated organization. By default the response contains only assets with the new status. Set status to all to include imported and ignored assets.

list_domains

ChatGPT

Returns a paginated list of domains for the authenticated organization.

list_integration_priorities

ChatGPT

Priorities available on the create screen of the project, in Jira's order (highest first), for the jira_priority_map setting. Defaults to the connected account's default project; collection_id overrides it. Empty for Linear. Personal tokens must belong to an organization administrator (parity with the dashboard).

list_integration_users

ChatGPT

Returns the provider users who can be the default assignee: active Linear workspace users, or the users assignable in the Jira project given by collection_id (default: the default project). Personal tokens must belong to an organization administrator (parity with the dashboard).

list_integrations

ChatGPT

Connected SCM installations, ticketing accounts, and OAuth availability.

list_knowledge_documents

ChatGPT

List knowledge documents.

list_knowledge_policies

ChatGPT

List knowledge policies.

list_knowledge_repo_entries

ChatGPT

List knowledge entries for a repository.

list_knowledge_repos

ChatGPT

List repository knowledge profiles.

list_knowledge_source_documents

ChatGPT

Lists the documents a person could pin by running the provider's listing tool on the vendor's MCP server and reading the result in code. Providers without a listing recipe answer 501. Organization-global knowledge sources are not available to asset-scoped tokens.

list_knowledge_sources

ChatGPT

Lists the organization's connected knowledge sources and their selected resources. Organization-global knowledge sources are not available to asset-scoped tokens.

list_llm_requests

ChatGPT

Self-hosted installs only. Lists the LLM provider requests that the engine made for the runs of the authenticated organization, newest first. Each entry is one provider attempt: a success, a refusal, a timeout or one retry. An entry holds the provider request ID, the status code, the model, the latency, the token usage, the response headers as the provider sent them and the free-form provider details. An entry never holds a prompt or a completion. Raw request and response bodies are never stored. Hosted installs return 404.

list_organization_invitations

ChatGPT

List pending invitations.

list_organization_members

ChatGPT

List organization members.

list_pr_review_findings

ChatGPT

Lists every security issue that the organization's PR reviews caught. Each issue appears once. Repeated reports of the same issue across review runs of one pull request are collapsed. Dependency CVEs and retest rows are excluded. Results include only repositories within the token RBAC scopes.

list_pr_reviews

ChatGPT

Lists PR reviews for the organization. Results include only repositories within the token RBAC scopes.

list_repositories

ChatGPT

Returns a paginated list of repositories for the authenticated organization.

list_repository_supply_chain_components

ChatGPT

List repository SBOM components.

list_repository_supply_chain_findings

ChatGPT

Open findings for the resolved scope. Pull-request and merge-request scans keep no SBOM snapshot, so scoping to one of those jobs with job_id serves the findings from the job's stored scan result: snapshot is null, and on each finding id, source, first_seen_at, and last_seen_at are null because no stored finding row exists to carry them. For those scopes component_id matches nothing (there are no stored component rows to filter on), and the list is capped at the first 100 findings while finding_count on the summary endpoint still covers the whole set. A change-scan job that ran before scan results were stored returns an empty list.

list_run_logs

ChatGPT

Self-hosted installs only. Lists the persisted engine logs of pentests, PR reviews, chats and login verifications of the authenticated organization. Hosted installs return 404.

list_scan_agents

ChatGPT

Lists the agents that ran in this scan, with the task, status, parent agent, and finding count of each agent. Use the returned agent id with GET /scans/{scanId}/trace to read what one agent did.

list_scan_retests

ChatGPT

Lists the newest retest of each finding of this scan, with progress counts.

list_scans

ChatGPT

Returns a paginated list of scans for the authenticated organization. Each scan carries finding counts. A pentest's counts omit dependency CVE findings. A supply-chain scan's findings are all dependency CVEs, so its counts are nonzero only when the token also holds the dependencies:read scope.

list_schedules

ChatGPT

Returns all scan schedules for the organization. Requires Pro plan.

list_test_users

ChatGPT

List domain test users.

list_vulnerabilities

ChatGPT

Returns a paginated list of vulnerabilities across all scans for the organization. Set the finding_type query parameter to dependency to read dependency findings. This filter also requires the dependencies:read scope.

list_vulnerability_http_exchanges

ChatGPT

Returns the HTTP request metadata that supports a vulnerability. Set include_content to true to include stored request and response text.

list_vulnerability_screenshots

ChatGPT

Returns the screenshots the agent attached to a vulnerability as visual evidence, in display order. Most vulnerabilities have none: the agent attaches a screenshot only when the image proves something the captured HTTP and text cannot. Each entry gives a url that serves the image bytes with the same API key.

list_webhook_deliveries

ChatGPT

Returns a paginated delivery log for a specific webhook, newest first. Filter by status to see only failed or pending deliveries. Asset-scoped tokens may access deliveries only for an in-scope business_unit webhook.

list_webhooks

ChatGPT

Returns webhooks for the organization. Asset-scoped tokens see only subscriptions whose business_unit is covered by their token scopes.

list_workspaces

ChatGPT

List the workspaces that the token owner is a member of. Requires a personal token; no API scope is required so a minimal CLI session can recover and switch.

preview_integration_ticket

ChatGPT

Returns the ticket that a sample finding would produce with the integration's current settings: destination, issue type, assignee, pentest grouping, and the rendered title and description. Use it to check templates before you save. Nothing is created. To preview a real finding, use GET /vulnerabilities/{vulnerabilityId}/preview.

preview_vulnerability_ticket

ChatGPT

Returns the destination, issue type, assignee, pentest group, and rendered title and description that POST /vulnerabilities/{vulnerabilityId}/push would create for the vulnerability. Nothing is created in the provider.

provision_test_user_inbox

ChatGPT

Creates a Strix-controlled AgentMail inbox (in the caller's org pod) for email-OTP / magic-link MFA. The agent reads verification emails from this inbox during scans.

push_vulnerability_to_ticket

ChatGPT

Creates or syncs a Jira or Linear ticket for the vulnerability using the organization's connected ticketing integration. If a ticket already exists for the vulnerability and provider, its status is synced instead of creating a duplicate.

read_test_user_inbox

ChatGPT

Lists recent messages in the test user's Strix-managed inbox (e.g. OTP / magic-link emails).

read_test_user_inbox_message

ChatGPT

Returns the full message body as readable text (HTML converted to text so OTP codes and magic-link URLs are preserved).

remove_organization_member

ChatGPT

Remove member.

rename_scan

ChatGPT

Sets a new scan title. The server trims the title and accepts 1 to 120 characters.

request_upload

ChatGPT

Reserves an upload and returns a signed URL (and resumable endpoint for large files) to PUT the file bytes to. Files ending in .zip are always treated as repository source archives and cannot be downgraded to documentation by setting category.

rerun_scan

ChatGPT

Create a new scan with the same configuration as the specified scan. The new scan is a full pentest. In the background, a separate retest scan also verifies the open issues of the specified scan, in its own sandbox and with its own agent, so the full pentest does not know the old issues. An open issue that the retest scan does not reproduce is set to fixed. Read the retest scan through GET /scans/{scanId}/retests on the specified scan. For retry-safe at-most-once creation, send an Idempotency-Key and reuse the exact same key and request after a lost or ambiguous response. The key is optional for backward compatibility, retained for 24 hours, and cannot be reused with a different actor, operation, or source scan. A terminal response is replayed only after the caller still passes current source-scan authorization; revoked access returns a fresh 403/404 without exposing the receipt. Use a new key only for a deliberate new rerun.

retest_all_scan_findings

ChatGPT

Starts retest scans for the findings of the scan. A single finding gets one targeted retest scan. Several findings share retest scans: one scan per group of up to 50 findings, in which every finding is checked by its own agent, all in parallel. The request checks access, the findings in scope, and the replacement uploads. Then it answers with status 202 and creates the retest scans in the background. The retest scans do not appear in the scan list. Read them, and the launches that are still starting or that failed to start, through GET /scans/{scanId}/retests on the source scan. A finding with a retest that is still running is skipped.

retest_vulnerability

ChatGPT

Starts a focused retest to confirm whether a single finding is still exploitable.

revoke_chat_credentials

ChatGPT

Clears every credential armed on the chat, in storage and in the running orchestrator. Recorded as a chat.credentials.revoked audit event.

revoke_organization_invitation

ChatGPT

Revoke invitation.

revoke_vulnerability_share_links

ChatGPT

Invalidates every share URL created for the vulnerability before this call. Viewers who open a revoked link can request access. Share URLs created after this call stay valid.

search

ChatGPT

One query across issues (STRIX id, title, CVE, CWE, host), pentests, PR reviews (repository, title, number), chats, repositories, domains, network connectors and schedules. Results come back grouped by kind, each group ranked exact match first, then prefix, then substring, newest first within a rank. Only the kinds the token has a read scope for are searched (vulnerabilities:read for issues, scans:read for pentests, pr_reviews:read, chat:read, assets:read for repositories and domains, connectors:read, schedules:read); kinds outside the token's scopes are skipped, and the same asset scopes and plan features apply as on each kind's own list endpoint. An empty q returns the most recent items of each kind. A kind whose lookup failed is listed in failed while the other groups are still returned.

send_chat_message

ChatGPT

Sends a message to an active chat. Use application/json for text-only, or multipart/form-data to attach files. message may be omitted for a control-only request when cancel_current or stop_agent is true.

send_integration_test_ticket

ChatGPT

Creates one real ticket from a sample finding, with the integration's templates, label, and default assignee, so you can check the setup end to end. The ticket title starts with [Strix test]. It is not linked to a finding and is never synced; delete it in the provider when you are done. Personal tokens must belong to an organization administrator (parity with the dashboard).

send_scan_message

ChatGPT

Sends a live prompt to a running scan. message is required unless cancel_current is true. You must provide at least one of these fields.

share_chat

ChatGPT

Generates a public, read-only share URL for the chat.

share_vulnerability

ChatGPT

Generates a read-only share URL for the vulnerability. Anyone who has the URL can open the report without an account, and must enter the password when one is set. Send password to set or replace the password every link to this vulnerability asks for, or null to clear it. Omit it to keep the current setting.

start_chat

ChatGPT

Starts a new agent chat. Use application/json for text-only, or multipart/form-data to attach files (field files).

start_container_image_scan

ChatGPT

Resolve the tag to a digest and queue a scan. An image whose compressed size is above the scan limit (8 GiB; self-hosted installs can change it with STRIX_CONTAINER_MAX_IMAGE_BYTES) fails with status 400 before Strix queues the scan. One scan per image can be queued or running at a time. Strix returns 409 when a scan is already active. Session callers must hold the admin or analyst role without asset scopes.

start_pr_review

ChatGPT

Triggers a security review of a specific pull request. The target repository must be within the token's rbac scopes.

start_repository_supply_chain_scan

ChatGPT

Trigger a supply-chain scan.

trigger_schedule

ChatGPT

Trigger an immediate run of a scheduled scan. Stored Supply Chain schedules require the Enterprise Supply Chain entitlement. When a pentest schedule fires, the open issues of its earlier runs also get separate retest scans (up to 50 issues each), in their own sandboxes and with their own agents, so the new pentest does not know the old issues. Each open issue is retested once, in a run scoped like the newest earlier run whose scope still reaches it. An open issue that the retest scan does not reproduce is set to fixed. Read the retest scans through GET /scans/{scanId}/retests on each earlier run that has open issues. A 200 acknowledges durable queue acceptance; later execution failures are reported in the schedule's run health and are never silently launched a second time. Manual schedule fires support the optional Idempotency-Key contract used by scan creation: reuse the exact same key only to retry the same schedule trigger after a lost or ambiguous response. Replay and in-progress responses are returned only after current authorization against the schedule succeeds.

unlink_vulnerability_pull_request

ChatGPT

Clears the vulnerability's fix PR and removes the pull request link from each Linear or Jira ticket of the finding. Succeeds when the finding has no pull request.

update_asset_discovery_schedule

ChatGPT

Sets when runs start (cron read in timezone), which verified domains they start from (seeds), the outcomes that send a notification, and the notification targets. Discovery schedules may recur hourly. The notification settings also apply to runs started by hand.

update_chat_domain_scope

ChatGPT

Replaces the verified organization domains a chat is authorized against, including while it is running: the domains are re-validated (owned, verified, inside the caller's access scopes), persisted, and pushed to the running agent, which re-labels proxy traffic and is told its scope changed. An empty list restores organization-wide authorization.

update_container_image

ChatGPT

Change the watched tags, the linked repository, or the enabled flag. Session callers must hold the admin or analyst role without asset scopes.

update_discovered_asset

ChatGPT

Set the triage status of a discovered asset. Use ignored to remove the asset from the review list. Use new to restore it. An imported asset cannot change status.

update_domain

ChatGPT

Update a domain's context, tags, or business_unit. Tags and business_unit require the Enterprise plan.

update_fix_pr_settings

ChatGPT

Sets the title template and the branch prefix for the fix pull requests that Strix opens. Omitted fields keep their current values. Send null or an empty string to return a field to its default. Requires the admin role.

update_integration_settings

ChatGPT

Updates ticketing settings for the Linear or Jira integration. Set issue_label_enabled and issue_label_name to add a label to each issue that Strix creates. Personal tokens must belong to an organization administrator (parity with the dashboard).

update_knowledge_document

ChatGPT

Manage organization knowledge. Organization-global knowledge writes are not available to asset-scoped tokens.

update_knowledge_repo_profile

ChatGPT

Update a repository knowledge profile. Asset-scoped tokens may update profiles only for repositories covered by their token scopes.

update_knowledge_source

ChatGPT

Replaces the source note and selected resource list. Context is optional. Personal tokens must belong to an organization admin, and asset-scoped tokens cannot update organization-global sources.

update_notification_settings

ChatGPT

Update the organization's notification settings (admin only). Enable SLA deadline reminders and choose email/Slack delivery and the warning period.

update_organization

ChatGPT

Rename the authenticated token organization.

update_organization_member_role

ChatGPT

Update member role.

update_pr_review_settings

ChatGPT

Updates organization PR review settings. Personal tokens must belong to an organization admin (parity with the dashboard).

update_repository

ChatGPT

Update repository settings.

update_repository_supply_chain_policy

ChatGPT

Update repository supply-chain policy.

update_schedule

ChatGPT

Update a schedule's configuration, cron expression, or pause/resume it. Send action: "pause" or action: "resume" to toggle, or provide fields to update.

update_test_user

ChatGPT

Update a domain test user.

update_vulnerability

ChatGPT

Change status and/or severity, or adjust the CVSS v3.1 base metrics with a required reason. CVSS adjustments cannot be combined with status or severity. The server calculates the score, vector and severity, and preserves the manual rating when scans update the same issue.

update_webhook

ChatGPT

Update webhook URL, events, active status, or rotate the signing secret. Asset-scoped tokens may update only an in-scope business_unit webhook. If you omit business_unit, the webhook keeps its current business_unit. If you change business_unit, use an in-scope value.

upload_scan_sarif

ChatGPT

Generate SARIF for active scan vulnerabilities and upload it to GitHub code scanning. Requires an Enterprise plan.

upsert_knowledge_policy

ChatGPT

Creates or updates an organization knowledge policy. Personal tokens must belong to an organization admin (parity with the dashboard). Organization-global knowledge writes are not available to asset-scoped tokens.

verify_azure_repos

ChatGPT

Reads the saved repository with its existing PAT or Microsoft OAuth credential. Refreshes an expiring OAuth token server-side. Requires an organization admin and integrations:write. Does not launch a scan.

verify_container_registry

ChatGPT

Authenticate against the registry with the stored credential and update status. Session callers must hold the admin or analyst role without asset scopes.

verify_domain

ChatGPT

Checks DNS, verification file, meta tag, allowlist, and existing organization verification methods.

verify_test_user_login

ChatGPT

Starts a short agent run (usually a minute or two) that drives the target's real login form with the saved credentials and reports a structured outcome, so a broken login surfaces before a scan. Returns 202 with a pending verification, or 200 with an in-flight / recent one that is reused. The domain must be ownership-verified. The login URL may live on another host (SSO tenant, IdP, separate auth site) as long as it is a public http(s) endpoint.

wake_chat

ChatGPT

Wakes the chat workspace when it is asleep. The workspace is running when the request returns. A released workspace returns 409 and is recreated by the next message; an ended workspace returns 410.

Capabilities

Writes

Example Prompts

Click any prompt to copy it.

Links

Documentation ↗Privacy Policy ↗

App Stats

181

Tools

Prompts

ChatGPT

Platforms