xalgorix

Quick Start

Install (one line):

curl -sSL https://www.xalgorix.com/install | bash

This downloads the prebuilt binary for your platform (Linux amd64/arm64) from the latest release. Then point it at your LLM provider in ~/.xalgorix.env:

XALGORIX_LLM=minimax/MiniMax-M3
XALGORIX_API_KEY=your_provider_api_key

Launch the dashboard and open http://127.0.0.1:9137:

xalgorix --web

Or run with Docker — batteries included, no toolchain needed:

docker run --rm -p 9137:9137 \
  -v xalgorix-data:/data \
  xalgord/xalgorix:latest

Open http://localhost:9137. You don't need an LLM key to start — the dashboard launches without one; set the model + API key under Settings → LLM (it persists to the /data volume). If you don't pass XALGORIX_USERNAME/XALGORIX_PASSWORD, a random admin password is generated and printed to the container logs on first run.

Easiest — Docker Compose (maps the port + a persistent volume for you):

curl -sSLO https://raw.githubusercontent.com/xalgord/xalgorix/main/docker-compose.yml
docker compose up -d
docker compose logs -f   # shows the generated admin password on first start

The image ships an extensive offensive-security toolset preinstalled (nmap, nuclei, httpx, subfinder, katana, ffuf, gobuster, sqlmap, masscan, dalfox, feroxbuster, and more) and keeps every package manager (apt, go, cargo, pipx, npm) available so the agent can still auto-install anything missing at runtime. It runs as root inside the container by design — treat the container as a disposable, network-isolated scanning sandbox and never expose the dashboard without auth. (amd64 image; the installer above covers arm64.)

Or build from source (needs Go 1.25+ and Node.js):

git clone https://github.com/xalgord/xalgorix.git
cd xalgorix
make build
sudo install -m 755 build/xalgorix /usr/local/bin/xalgorix

[!TIP] Prefer zero setup? A fully managed version runs at www.xalgorix.com — click-to-scan, no install or API keys required.

Review pull requests automatically — free GitHub App

Want a security review on every pull request with zero setup? Install the Xalgorix GitHub App. It reads each PR's diff and comments a security review — injection, broken auth/IDOR, SSRF, secrets, unsafe patterns — right on the pull request. Updates in place on new commits, and you can comment @xalgorix review to re-run on demand. No workflow file, no API key, no account — and it's free.

➕ Add Xalgorix to GitHub →

For merge gating and full exploit-verified pentests in CI, use the hosted scanner or the GitHub Action.

[!IMPORTANT] Use Xalgorix only on systems you own or have explicit permission to test.

[!TIP] Prefer not to self-host? A fully managed version is available at www.xalgorix.com — click-to-scan, no install or API keys required.

Contents

• Quick Start
• Overview
• Why Xalgorix
• Use Cases
• Screenshots
• Features
• Installation
• Configuration
• Upgrading from previous versions
• Running
• Service Mode
• Web UI Workflow
• Scan Modes
• Methodology
• Reports
• Settings
• Environment Variables
• Provider Prefixes
• CLI Reference
• API Summary
• Data Storage
• Development
• Safety Notes
• License
• Links

Overview

Xalgorix is a self-hosted AI penetration testing platform for authorized security testing, vulnerability assessment, and bug bounty workflows. It combines an LLM-driven autonomous agent, browser automation, terminal tooling, a comprehensive 22-phase testing methodology, live WebSocket telemetry, finding management with CVSS scoring, branded PDF report generation, and integrations for AgentMail, Discord, and Telegram.

Unlike cloud-only DAST scanners, Xalgorix runs entirely on your machine. You bring your own LLM provider (OpenAI, Anthropic, DeepSeek, Gemini, Groq, Ollama, MiniMax) and control the model, reasoning effort, rate limits, and proxy configuration. No scan data, API keys, or target information leaves your infrastructure.

The default experience is the Web UI. From one local dashboard you can start scans, monitor active runs, inspect findings, configure model/provider settings, manage environment variables, generate branded PDF reports, and delete or resume historical scans.

Why Xalgorix

Most scanners detect. Xalgorix proves. An autonomous agent works through a 22-phase methodology, then an independent verifier re-tests every candidate finding before it is reported — so you get exploit-verified results with evidence, not a wall of "maybes" to triage.

• 🧠 An AI agent, not a template engine — reasons about auth flows, business logic, IDOR/BOLA, and chained exploits that signature scanners miss.
• ✅ Exploit-verified findings — a separate verifier independently reproduces each finding; inconclusive ones are flagged for review, never dressed up as confirmed.
• 🔒 Self-hosted and private — runs on your machine with your own LLM key; no target data, keys, or findings leave your infrastructure.
• 🧩 Bring your own LLM — OpenAI, Anthropic, DeepSeek, Gemini, Groq, Ollama, or MiniMax — or any OpenAI-compatible gateway like LiteLLM (GitHub Copilot, Codex, OpenRouter, Azure). You control model, reasoning effort, and cost.
• 📄 Audit-ready reports — branded PDFs with CVSS scores, proof-of-concept, and remediation.

How it compares