Xalgorix — Open-source AI pentester that proves vulnerabilities

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript.

Quick Start · Why Xalgorix · Features · Use Cases · Hosted Cloud · Docs

## Quick Start **Install (one line):** curl -sSL https://www.xalgorix.com/install | bash This downloads the prebuilt binary for your platform (Linux amd64/arm64) from the latest release. Then point it at your LLM provider in `~/.xalgorix.env`: XALGORIX_LLM=minimax/MiniMax-M3 XALGORIX_API_KEY=your_provider_api_key Launch the dashboard and open `http://127.0.0.1:9137`: xalgorix --web **Or run with Docker — batteries included, no toolchain needed:** docker run --rm -p 9137:9137 \ --privileged \ -v xalgorix-data:/data \ xalgord/xalgorix:latest `--privileged` gives the toolset the same host-like access it has when run natively as root. Docker's default sandbox drops capabilities (like `NET_ADMIN`) and applies a seccomp filter, which breaks low-level tools (iptables/route changes, ARP-spoof/MITM, tun/tap VPNs, ptrace-based debuggers, masscan interface tuning). Since an image can't grant itself these, they must be set at run time. The container is a disposable, network-isolated scanning sandbox running as root — privileged is the intended posture; never expose the dashboard publicly without auth. Prefer least-privilege? Swap `--privileged` for `--cap-add=NET_ADMIN --cap-add=NET_RAW --cap-add=SYS_PTRACE --security-opt seccomp=unconfined`. Open `http://localhost:9137`. You **don't need an LLM key to start** — the dashboard launches without one; set the model + API key under **Settings → LLM** (it persists to the `/data` volume). If you don't pass `XALGORIX_USERNAME`/`XALGORIX_PASSWORD`, a random admin password is generated and printed to the container logs on first run. **Easiest — Docker Compose** (maps the port + a persistent volume for you): curl -sSLO https://raw.githubusercontent.com/xalgord/xalgorix/main/docker-compose.yml docker compose up -d docker compose logs -f # shows the generated admin password on first start The image ships an extensive offensive-security toolset preinstalled (nmap, nuclei, httpx, subfinder, katana, ffuf, gobuster, sqlmap, masscan, dalfox, feroxbuster, and more) **and** keeps every package manager (apt, go, cargo, pipx, npm) available so the agent can still auto-install anything missing at runtime. It runs as root inside the container by design — treat the container as a disposable, network-isolated scanning sandbox and never expose the dashboard without auth. (amd64 image; the installer above covers arm64.) **Or build from source** (needs Go 1.25+ and Node.js): git clone https://github.com/xalgord/xalgorix.git cd xalgorix make build sudo install -m 755 build/xalgorix /usr/local/bin/xalgorix ### Review pull requests automatically — free GitHub App Want a security review on every pull request with zero setup? Install the **[Xalgorix GitHub App](https://github.com/apps/xalgorix)**. It reads each PR's diff and comments a security review — injection, broken auth/IDOR, SSRF, secrets, unsafe patterns — right on the pull request. Updates in place on new commits, and you can comment **`@xalgorix review`** to re-run on demand. No workflow file, no API key, no account — and it's free. For merge gating and full exploit-verified pentests in CI, use the [hosted scanner](https://www.xalgorix.com/) or the GitHub Action. ## Contents - [Quick Start](#quick-start) - [Overview](#overview) - [Why Xalgorix](#why-xalgorix) - [Use Cases](#use-cases) - [Screenshots](#screenshots) - [Features](#features) - [Installation](#installation) - [Configuration](#configuration) - [Upgrading from previous versions](#upgrading-from-previous-versions) - [Running](#running) - [Service Mode](#service-mode) - [Web UI Workflow](#web-ui-workflow) - [Scan Modes](#scan-modes) - [Methodology](#methodology) - [Reports](#reports) - [Settings](#settings) - [Environment Variables](#environment-variables) - [Provider Prefixes](#provider-prefixes) - [CLI Reference](#cli-reference) - [API Summary](#api-summary) - [Data Storage](#data-storage) - [Development](#development) - [Safety Notes](#safety-notes) - [License](#license) - [Links](#links) ## Overview Xalgorix is a self-hosted AI penetration testing platform for authorized security testing, vulnerability assessment, and bug bounty workflows. It combines an LLM-driven autonomous agent, browser automation, terminal tooling, a comprehensive 22-phase testing methodology, live WebSocket telemetry, finding management with CVSS scoring, branded PDF report generation, and integrations for AgentMail, Discord, and Telegram. Unlike cloud-only DAST scanners, Xalgorix runs entirely on your machine. You bring your own LLM provider (OpenAI, Anthropic, DeepSeek, Gemini, Groq, Ollama, MiniMax) and control the model, reasoning effort, rate limits, and proxy configuration. No scan data, API keys, or target information leaves your infrastructure. The default experience is the Web UI. From one local dashboard you can start scans, monitor active runs, inspect findings, configure model/provider settings, manage environment variables, generate branded PDF reports, and delete or resume historical scans. ## Why Xalgorix Most scanners **detect**. Xalgorix **proves**. An autonomous agent works through a 22-phase methodology, then an independent verifier re-tests every candidate finding before it is reported — so you get exploit-verified results with evidence, not a wall of "maybes" to triage. - 🧠 **An AI agent, not a template engine** — reasons about auth flows, business logic, IDOR/BOLA, and chained exploits that signature scanners miss. - ✅ **Exploit-verified findings** — a separate verifier independently reproduces each finding; inconclusive ones are flagged for review, never dressed up as confirmed. - 🔒 **Self-hosted and private** — runs on your machine with your own LLM key; no target data, keys, or findings leave your infrastructure. - 🧩 **Bring your own LLM** — OpenAI, Anthropic, DeepSeek, Gemini, Groq, Ollama, or MiniMax — or any OpenAI-compatible gateway like [LiteLLM](#litellm--openai-compatible-gateways-github-copilot-claude-opus-codex-openrouter-azure-local-models) (GitHub Copilot, Codex, OpenRouter, Azure). You control model, reasoning effort, and cost. - 📄 **Audit-ready reports** — branded PDFs with CVSS scores, proof-of-concept, and remediation. ### How it compares | | **Xalgorix** | Template scanners (e.g. Nuclei) | Crawling scanners (e.g. OWASP ZAP) | Commercial DAST | | -------------------------------------------- | ------------------------ | ------------------------------- | ---------------------------------- | ---------------------- | | Approach | Autonomous AI agent | Signatures / templates | Spider + active rules | Signatures + heuristics | | Business logic / IDOR / auth-bypass coverage | ✅ | Limited | Limited | Partial | | Exploit-verified (proves impact) | ✅ independent verifier | ❌ | ❌ | Partial | | False-positive load | Low (proven) | Template-dependent | High | Medium | | Self-hosted / data stays local | ✅ | ✅ | ✅ | Usually cloud | | Bring-your-own LLM | ✅ | — | — | ❌ | | Branded PDF reports | ✅ | ❌ | Basic | ✅ | | Cost | Open source + your LLM | Free | Free | $$$ | ## Use Cases | Use Case | How Xalgorix helps | | -------- | ------------------ | | **Penetration testing** | Run a full 22-phase methodology against authorized targets. The AI agent handles reconnaissance, vulnerability discovery, injection testing, SSRF, IDOR, auth bypass, race conditions, and more — then verifies findings before reporting. | | **Bug bounty hunting** | Point Xalgorix at an in-scope target and let the agent enumerate the attack surface, test for common vulnerability classes, and surface verified findings with CVSS scores and proof-of-concept evidence. | | **Red team operations** | Use wildcard and multi-target scan modes to map an organization's external attack surface. Browser-assisted DAST handles auth flows, forms, and runtime behavior that static scanners miss. | | **Security research** | The novel-vulnerability-discovery phase pushes the agent beyond known template matching. Bring your own LLM (OpenAI, Anthropic, DeepSeek, Gemini, Ollama, MiniMax) to control reasoning depth and cost. | | **Continuous security testing** | Run as a system service with `xalgorix --start`. Scan on a schedule, stream findings to Discord or Telegram, and generate branded PDF reports for stakeholders. | | **DAST automation** | Browser-driven testing for web applications — auth flows, forms, JavaScript-rendered content, and runtime behavior. Integrates with Caido for proxy traffic inspection. | ## Screenshots | Overview dashboard | Scan detail | Findings | | ------------------------------------------------------- | ------------------------------------------------ | --------------------------------------------- | |  |  |  | ## Features | Area | Capabilities | | -------------- | --------------------------------------------------------------------------------------------------------------------------- | | Dashboard | Local Web UI on `127.0.0.1:9137` by default, scan management, live status, bulk scan actions, and historical scan recovery. | | Scanning | Single target, DAST, wildcard, and multi-target flows with selectable methodology phases. | | Live telemetry | Tool calls, agent messages, findings, errors, HTTP activity, and LLM activity over WebSockets. | | Findings | Scan detail pages, severity filters, CVSS details, finding index, and verified finding workflows. | | Reporting | Branded PDF reports with target/company name, uploaded logo, report list, open/download/delete actions. | | Integrations | AgentMail test inboxes, verification emails, OTP flows, email triage events, Discord and Telegram notifications. | | Configuration | Dashboard settings for LLM, AgentMail, Discord, Telegram, proxy, runtime, browser, auth, rate limits, and resources. | | Runtime safety | Resource-aware instance limits and loopback-only binding unless external access is explicitly configured with auth. | ## Installation The fastest paths need no toolchain at all. ### One-line install (prebuilt binary) curl -sSL https://www.xalgorix.com/install | bash Downloads the latest release binary for your platform (Linux `amd64`/`arm64`) and installs it to `/usr/local/bin` (or `~/.local/bin` without sudo). Override with `XALGORIX_INSTALL_DIR` or pin a version with `XALGORIX_VERSION=vX.Y.Z`. ### Docker docker run --rm -p 9137:9137 \ --privileged \ -e XALGORIX_LLM=minimax/MiniMax-M3 \ -e XALGORIX_API_KEY=your_provider_api_key \ -v xalgorix-data:/data \ ghcr.io/xalgord/xalgorix:latest `--privileged` (or the narrower `--cap-add=NET_ADMIN --cap-add=NET_RAW --cap-add=SYS_PTRACE --security-opt seccomp=unconfined`) gives the toolset host-like access. Docker's default sandbox drops capabilities and filters syscalls, which breaks low-level tooling (iptables/route/interface changes, ARP-spoof/MITM, tun/tap VPNs, ptrace-based debuggers). An image can't grant these to itself — they're a run-time decision — so pass the flag, or use the provided `docker-compose.yml`, which sets it for you. The image is **batteries-included**: an extensive offensive-security toolset is preinstalled (nmap, nuclei, httpx, subfinder, dnsx, naabu, katana, ffuf, gobuster, dalfox, feroxbuster, sqlmap, masscan, nikto, whatweb, hydra, and more), plus Chromium for browser-assisted DAST. It also keeps the full package-manager set (apt, go, cargo, pipx, npm) available, so the agent auto-installs anything missing at runtime. Scan data persists to the `/data` volume, and the server binds `0.0.0.0` inside the container — set `XALGORIX_USERNAME`/`XALGORIX_PASSWORD` before exposing it beyond localhost. The container runs as root by design (the engine only enables runtime auto-install for uid 0, and apt/go/cargo installs need system write access). Treat it as a disposable, network-isolated scanning sandbox. It's published for `amd64`; use the one-line installer for arm64 hosts. On first run, if you don't set dashboard auth the container **generates a random admin password and prints it to the logs** (the image binds `0.0.0.0`, which the engine won't do without auth). Set `XALGORIX_USERNAME` + `XALGORIX_PASSWORD` (or `XALGORIX_PASSWORD_HASH`) to use your own. The binary never self-updates inside the container (`XALGORIX_NO_AUTO_UPDATE=1`) — pull a new image tag to upgrade. ### Requirements (build from source) | Requirement | Notes | | -------------- | ------------------------------------------------------------ | | Linux | Primary supported platform. | | Go | `1.25` or newer. | | Node.js + npm | Required when building the bundled React Web UI from source. | | Security tools | Installed on demand only when auto-install is enabled. | Check your Go version: go version ### Build From Source git clone https://github.com/xalgord/xalgorix.git cd xalgorix make build sudo install -m 755 build/xalgorix /usr/local/bin/xalgorix `make build` builds the React Web UI into `internal/web/static`, then builds the Go binary. ### Install With Go GOPROXY=direct GOSUMDB=off go install github.com/xalgord/xalgorix/v4/cmd/xalgorix@latest ## Configuration Xalgorix loads configuration in this order. Later sources override earlier ones. | Order | Source | | ----- | -------------------------------------------------------------- | | 1 | `/etc/xalgorix.env` | | 2 | `/home//.xalgorix.env` when launched through `sudo` | | 3 | `~/.xalgorix.env` | | 4 | Environment variables already present in the process | Create the local environment file: nano ~/.xalgorix.env ### Minimal Config XALGORIX_LLM=minimax/MiniMax-M3 XALGORIX_API_KEY=your_provider_api_key ### Provider Examples OpenAI: XALGORIX_LLM=openai/gpt-5.4 XALGORIX_API_KEY=sk-... Custom OpenAI-compatible provider: XALGORIX_LLM=custom/security-model XALGORIX_API_BASE=https://your-provider.example/v1 XALGORIX_API_KEY=your_provider_api_key #### LiteLLM / OpenAI-compatible gateways (GitHub Copilot, Claude Opus, Codex, OpenRouter, Azure, local models) Because `XALGORIX_API_BASE` accepts any OpenAI-compatible `/v1/chat/completions` endpoint, Xalgorix works with a [LiteLLM](https://docs.litellm.ai/) proxy out of the box — no Xalgorix-side changes needed. LiteLLM handles the upstream provider auth (Copilot device login, Azure keys, OpenRouter, Ollama, etc.); Xalgorix just talks OpenAI to the gateway. Run LiteLLM (example `config.yaml`): model_list: - model_name: claude-opus-4-8 litellm_params: model: github_copilot/claude-opus-4.8 # or openrouter/…, azure/…, ollama/… general_settings: master_key: sk-local-litellm-key Point Xalgorix at it — use the `custom/` prefix so the model name is sent verbatim and the OpenAI chat-completions protocol is used: XALGORIX_LLM=custom/claude-opus-4-8 # the LiteLLM model_name XALGORIX_API_BASE=http://localhost:4000/v1 # your LiteLLM proxy XALGORIX_API_KEY=sk-local-litellm-key # LiteLLM master_key / virtual key The same pattern covers GitHub Copilot Business/CLI, Claude Opus, Codex-style models, OpenRouter, Azure OpenAI, and local Ollama models — anything LiteLLM can route. Keep the `custom/` (or `openai/`) prefix and a non-Anthropic/Gemini `XALGORIX_API_BASE` so Xalgorix uses the standard OpenAI request shape that LiteLLM expects. ### Optional Integrations GEMINI_API_KEY=AIza... AGENTMAIL_POD=am_us_pod_47 AGENTMAIL_API_KEY=ak_... XALGORIX_DISCORD_WEBHOOK=https://discord.com/api/webhooks/... XALGORIX_DISCORD_MIN_SEVERITY=high ### Dashboard Authentication XALGORIX_USERNAME=admin XALGORIX_PASSWORD=change-this-password ## Upgrading from previous versions This release ships a stability and workspace-isolation pass with one breaking change and a few new knobs worth knowing about. ### Breaking change: default workspace moved to `~/.xalgorix/data/` Scan output, notes, schedules, and other generated artefacts now live under `~/.xalgorix/data/` instead of `$CWD` (the directory the binary was launched from). To retain the previous behavior, point `XALGORIX_DATA_DIR` at your current working directory: export XALGORIX_DATA_DIR=$(pwd) A `[MIGRATION]` warning is emitted at startup when legacy markers (`notes.json`, `_schedules/`, `vulnerabilities.json`, or `YYYY-MM-DD/scan-*` directories) are detected in `$CWD` and `XALGORIX_DATA_DIR` is unset. Xalgorix never reads, copies, or deletes those legacy files automatically; the warning is informational and only fires once per process. ### New environment variable | Variable | Default | Description | | ---------------------------- | ----------------------------- | -------------------------------------------------------------------------------------------------------- | | `XALGORIX_LLM_MAX_INFLIGHT` | `4 × EffectiveMaxInstances` | Caps simultaneous outbound LLM calls across all running scans. Minimum `1`. Cancelled waiters do not consume a slot. | ### New health endpoint counters `GET /api/status` now exposes: | Field | Meaning | | --------------------- | ------------------------------------------------------------------------------------ | | `panics_recovered` | Goroutine, HTTP handler, and tool panics that were recovered without crashing. | | `path_rejections` | Filesystem writes refused by Path_Policy (outside `data_dir` / `~/.xalgorix/` / `/tmp`). | | `watchdog_kills` | Subprocesses terminated by the per-tool hard-timeout watchdog. | | `admission_refusals` | Scan admission requests denied due to the concurrency ceiling. | | `llm_inflight_cap` | Effective `XALGORIX_LLM_MAX_INFLIGHT` value for this process. | | `data_dir` | Resolved Data_Dir in use. | | `allow_list` | Filesystem roots accepted by Path_Policy. | ## Running ### Web UI xalgorix --web Open: http://127.0.0.1:9137 Use a different port: xalgorix --web --port 8080 ### External Access Bind to another interface only after enabling dashboard authentication: XALGORIX_USERNAME=admin XALGORIX_PASSWORD=change-this xalgorix --web --bind 0.0.0.0 ### CLI Scan xalgorix --target https://example.com With custom instructions: xalgorix --target https://app.example.com --instruction "Focus on SQL injection, IDOR, and auth bypass. Avoid destructive tests." ## Service Mode Install and start as a system service: sudo xalgorix --start Manage the service: sudo xalgorix --restart sudo xalgorix --stop sudo xalgorix --uninstall View logs: journalctl -u xalgorix -f ### Remote Service Access Expose the service to remote browsers only after enabling dashboard auth: sudo tee -a /root/.xalgorix.env >/dev/null <<'EOF' XALGORIX_BIND=0.0.0.0 XALGORIX_USERNAME=admin XALGORIX_PASSWORD=change-this EOF sudo xalgorix --restart Then open `http://:9137`. If the process is listening but the page still does not load remotely, allow TCP port `9137` in the server firewall or cloud security group. #### Scanning local/internal targets By default Xalgorix refuses to scan loopback, `localhost`, private-range, or its own interface addresses — they're the machine Xalgorix runs on, not a target. On a **self-hosted, single-tenant** box you can opt in to scan a locally-hosted demo/staging app: echo 'XALGORIX_ALLOW_LOCAL_TARGETS=true' | sudo tee -a /root/.xalgorix.env sudo xalgorix --restart The dashboard's own listener is **always** protected, even with this enabled. ## Web UI Workflow 1. Open the dashboard at `http://127.0.0.1:9137`. 2. Go to Settings and confirm the LLM provider, API key, rate limits, and optional integrations. 3. Create a scan from New Scan. 4. Choose a scan mode. 5. Select methodology phases when you want a focused run. 6. Set severity filters when only certain severities should be reported live. The filter affects the real-time dashboard feed and notifications only; the PDF report and `/api/findings` always include every vulnerability the agent discovered. 7. Add company name and upload a logo for branded reports. 8. Monitor progress from Overview, Scan Detail, or Live Feed. 9. Open finding details, download reports, or manage historical scans from Scans and Reports. ## Scan Modes | Mode | Best for | | ---------------- | ------------------------------------------------------------------------------- | | Single target | Testing one known URL or host. | | Wildcard / multi | Enumerating related targets and scanning the discovered attack surface. | | DAST | Browser-assisted testing for web apps, auth flows, forms, and runtime behavior. | ## Scan Your Code (no target needed) Point Xalgorix at a codebase — a Git URL, a local path, or an uploaded zip — and it scans the source directly. No deployed URL, no infrastructure to stand up. # Source review (SAST): audit the code, no running target required xalgorix --source ./my-app --code-scan review # Provision + DAST: build & run the app locally, then pentest the running instance xalgorix --source https://github.com/org/app.git --code-scan provision | Code-scan mode | What it does | Verification level | | -------------- | ------------ | ------------------ | | `review` | Reads the source, traces user input from entry point → dangerous sink, and reports reachable vulnerabilities. No live target. | **Source-verified** — proven reachable in code (clearly labeled as not runtime-exploited). | | `provision` | Inspects the repo, builds and runs the app on a loopback port, then runs whitebox-guided DAST against the running instance. Falls back to `review` if the app can't be built. | **Exploit-verified** — reproduced against the running app. | - `--source` accepts a Git URL (shallow-cloned), a local directory, or a path to an uploaded/extracted archive. In the Web UI / hosted app you can also upload a `.zip` of your codebase (`POST /api/upload-source`). - You can still combine a repo **and** a live target for classic whitebox augmentation — that path is unchanged. Code-scan modes are for when the codebase is the whole subject. ## Methodology Xalgorix organizes autonomous testing into 22 phases. | Phase | Focus | | ----: | ------------------------------------------ | | 1 | Reconnaissance | | 2 | Manual vulnerability discovery | | 3 | Directory and file discovery | | 4 | CORS and cookie analysis | | 5 | Authentication and session testing | | 6 | Injection testing | | 7 | SSRF testing | | 8 | IDOR and broken access control | | 9 | API and GraphQL testing | | 10 | File upload testing | | 11 | Deserialization and RCE | | 12 | Race conditions and business logic | | 13 | Subdomain takeover | | 14 | Open redirect testing | | 15 | Email security testing | | 16 | Cloud and infrastructure | | 17 | WebSocket testing | | 18 | CMS-specific testing | | 19 | Broken link hijacking and content spoofing | | 20 | Exploit verification | | 21 | Novel vulnerability discovery | | 22 | Final report | Phase selection in the Web UI lets you run every phase or only the subset needed for a specific engagement. ## Reports Reports are generated as PDF files and can include: | Section | Included content | | ----------- | ------------------------------------------------------------------------------- | | Summary | Executive summary, target metadata, scan metadata, and severity overview. | | Findings | Verified findings, CVSS details, technical analysis, and exploitation proof. | | Evidence | Proof of concept commands, scripts, payload notes, and supporting observations. | | Remediation | Fix guidance and prioritized next steps. | | Branding | Company/target name and uploaded logo. | Reports are available from the scan detail page and the Reports page. Report rows support opening, downloading, and deletion. ## Settings Most operational settings can be changed from the Web UI under Settings. | Area | Examples | | ------------- | ------------------------------------------------------------------- | | Engagement | Dashboard request rate limits | | LLM | Model, API key, API base, reasoning effort, retries, max iterations | | AgentMail | Pod and API key | | Notifications | Discord webhook and minimum severity, Telegram bot token, chat ID, and minimum severity | | Proxy | Proxy URL, proxy file, rotation, TLS verification | | Runtime | Workspace, browser path, auto-install controls | | Security | Dashboard username, password, password hash, bind address | | Resources | CPU/RAM/disk thresholds and scan concurrency budget | Some settings require a restart because they affect process startup or server binding. The UI marks those fields. ## Environment Variables ### Core | Variable | Default | Description | | ------------------------------------ | ---------------- | ------------------------------------------------------ | | `XALGORIX_LLM` | none | Provider-native model ID used for LLM requests. | | `XALGORIX_LLM_PROVIDER` | none | Provider selected by the dashboard, stored separately from the model ID. | | `XALGORIX_API_KEY` | none | Required LLM provider API key. | | `XALGORIX_API_BASE` | provider default | Custom OpenAI-compatible API base URL. | | `XALGORIX_REASONING_EFFORT` | `high` | Reasoning effort: `none`, `low`, `medium`, `high`, or `xhigh` (`xhigh` maps to `high` for Ollama). | | `XALGORIX_OLLAMA_COMPATIBLE` | `false` | Apply Ollama reasoning semantics to a custom endpoint on a non-standard port. Port `11434` is detected automatically. | | `XALGORIX_LLM_MAX_RETRIES` | `5` | Retry count for transient LLM failures. | | `XALGORIX_MEMORY_COMPRESSOR_TIMEOUT` | `30` | Timeout in seconds for context compression. | | `XALGORIX_MAX_ITERATIONS` | `0` | Agent iteration cap. `0` means unlimited. | | `GEMINI_API_KEY` | none | Optional Gemini key for web-search enrichment. | ### Web and Security | Variable | Default | Description | | ------------------------ | ----------------- | ---------------------------------- | | `XALGORIX_BIND` | `127.0.0.1` | Web server listen address. | | `XALGORIX_ALLOW_LOCAL_TARGETS` | `false` | Allow scanning locally-hosted apps (localhost / 127.0.0.1 / private IPs) on a self-hosted install. The dashboard's own listener is always protected. Leave off on shared/hosted deployments. | | `XALGORIX_USERNAME` | none | Dashboard username. | | `XALGORIX_PASSWORD` | none | Dashboard password. | | `XALGORIX_PASSWORD_HASH` | none | Preferred bcrypt password hash. | | `XALGORIX_WORKSPACE` | current directory | Workspace root for scan execution. | ### Integrations | Variable | Default | Description | | ------------------------------- | ------- | ---------------------------------------- | | `AGENTMAIL_POD` | none | AgentMail pod identifier. | | `AGENTMAIL_API_KEY` | none | AgentMail API key. | | `XALGORIX_DISCORD_WEBHOOK` | none | Global Discord webhook. | | `XALGORIX_DISCORD_MIN_SEVERITY` | none | Minimum severity sent to Discord. | | `XALGORIX_TELEGRAM_BOT_TOKEN` | none | Telegram bot token from @BotFather. | | `XALGORIX_TELEGRAM_CHAT_ID` | none | Telegram chat/channel ID (numeric or @username). | | `XALGORIX_TELEGRAM_MIN_SEVERITY`| none | Minimum severity sent to Telegram. | | `CAIDO_PORT` | `0` | Caido proxy port. `0` means auto-detect. | | `CAIDO_API_TOKEN` | none | Caido API token. | ### Rate Limits, Proxy, and Runtime | Variable | Default | Description | | ------------------------------ | ------------ | -------------------------------------------------- | | `XALGORIX_RATE_LIMIT_REQUESTS` | `60` | Dashboard requests per window. | | `XALGORIX_RATE_LIMIT_WINDOW` | `60` | Dashboard rate-limit window in seconds. | | `XALGORIX_RATE_RPS` | `10` | Sustained outbound request rate. | | `XALGORIX_RATE_BURST` | `20` | Outbound burst size. | | `XALGORIX_USE_PROXY` | `false` | Enable proxy routing. | | `XALGORIX_PROXY_URL` | none | Single proxy URL. Overrides proxy file. | | `XALGORIX_PROXY_FILE` | none | File containing one proxy per line. | | `XALGORIX_PROXY_ROTATION` | `roundrobin` | Proxy rotation strategy: `roundrobin` or `random`. | | `XALGORIX_TLS_SKIP_VERIFY` | `false` | Skip TLS verification for testing traffic. | | `XALGORIX_DISABLE_BROWSER` | `false` | Disable browser automation. | | `XALGORIX_BROWSER_PATH` | auto | Custom Chrome/Chromium executable path. | | `XALGORIX_ALLOW_AUTO_INSTALL` | root only | Permit automatic package installation. | | `XALGORIX_AUTO_INSTALL_SUDO` | `false` | Permit sudo-prefixed auto-installs. | ## Provider Prefixes When `XALGORIX_API_BASE` is empty, Xalgorix infers provider defaults from the model prefix. | Prefix | Default API base | | ------------ | ---------------------------------------------- | | `openai/` | `https://api.openai.com/v1` | | `anthropic/` | `https://api.anthropic.com` | | `deepseek/` | `https://api.deepseek.com/v1` | | `groq/` | `https://api.groq.com/openai/v1` | | `google/` | `https://generativelanguage.googleapis.com/v1` | | `gemini/` | `https://generativelanguage.googleapis.com/v1` | | `ollama/` | `http://localhost:11434/v1` | | `minimax/` | `https://api.minimax.io/v1` | Model names are not hard-coded to this list. The Settings page accepts typed model IDs so newer provider models can be used without waiting for a UI dropdown update. ## CLI Reference | Flag | Alias | Description | | ---------------------- | ----- | ------------------------------------------ | | `--web` | `-w` | Start the Web UI. | | `--port ` | `-p` | Web UI port. Default: `9137`. | | `--bind ` | none | Bind address. Default: `127.0.0.1`. | | `--target ` | `-t` | Target URL, host, IP, or path. Repeatable. | | `--instruction ` | `-i` | Custom scan instructions. | | `--model ` | `-m` | Override `XALGORIX_LLM` for this run. | | `--update` | `-up` | Update to the latest release. | | `--version` | `-v` | Print version. | | `--start` | none | Install and start the system service. | | `--stop` | none | Stop the system service. | | `--restart` | none | Restart the system service. | | `--uninstall` | none | Remove the system service. | | `--help` | `-h` | Show help. | ## API Summary | Method | Endpoint | Purpose | | -------- | ---------------------------- | --------------------------------------------- | | `POST` | `/api/scan` | Start or save a scan. | | `POST` | `/api/stop` | Stop all running scans. | | `GET` | `/api/status` | Current global status. | | `GET` | `/api/scans` | List scans. | | `GET` | `/api/scans/:id` | Get scan detail. | | `DELETE` | `/api/scans/:id` | Delete a scan and its report data. | | `GET` | `/api/findings` | List all findings (deduplicated across scans). | | `GET` | `/api/findings/summary` | Severity tally across all scans. | | `GET` | `/api/report/:id` | Download a PDF report. | | `GET` | `/api/instances` | List live and historical instances. | | `GET` | `/api/instances/:id/events` | Get buffered event history. | | `POST` | `/api/instances/:id/stop` | Stop a specific instance. | | `POST` | `/api/instances/:id/start` | Start a saved or completed scan as a new run. | | `POST` | `/api/instances/:id/restart` | Restart with the same configuration. | | `POST` | `/api/instances/:id/pause` | Pause a running scan. | | `POST` | `/api/instances/:id/resume` | Resume a paused scan. | | `POST` | `/api/upload-logo` | Upload a report logo. | | `POST` | `/api/upload-targets` | Upload a target list. | | `GET` | `/api/settings/environment` | List editable environment settings. | | `POST` | `/api/settings/environment` | Save environment settings. | | `GET` | `/api/settings/llm` | Get LLM settings. | | `POST` | `/api/settings/llm` | Save LLM settings. | | `GET` | `/api/settings/agentmail` | Get AgentMail settings. | | `POST` | `/api/settings/agentmail` | Save AgentMail settings. | | `GET` | `/ws` | WebSocket live event stream. | ## Data Storage Web-mode scan data is stored under: ~/xalgorix-data/ |-- _saved/ |-- logos/ |-- queue_state.json `-- / `-- / `-- / |-- scan.json `-- report.pdf The server keeps historical scan records on disk so the UI can recover after refresh or restart. ## Development | Task | Command | | --------------------------- | ----------------------------- | | Install Web UI dependencies | `make webui-install` | | Build everything | `make build` | | Run tests | `go test ./...` | | Run Web UI from source | `go run ./cmd/xalgorix --web` | | Run frontend dev server | `make webui-dev` | ## Safety Notes - Use Xalgorix only against authorized targets. - Do not run active testing against third-party systems without permission. - Review scan instructions before launching. - Configure rate limits and proxy settings to match engagement rules. - Exposing the dashboard externally requires authentication. - Auto-install is disabled by default for non-root users and should be enabled only when you trust the environment. ## License Xalgorix is released under the MIT License. See [LICENSE](LICENSE). ## Links | Resource | Link | | ------------- | -------------------------------------------------------------------------------- | | Hosted (Cloud) | [www.xalgorix.com](https://www.xalgorix.com/) | | Documentation | [docs.xalgorix.com](https://docs.xalgorix.com) | | Issues | [github.com/xalgord/xalgorix/issues](https://github.com/xalgord/xalgorix/issues) | | Support | [buymeacoffee.com/xalgord](https://buymeacoffee.com/xalgord) |

标签：AI智能体, EVTX分析, Go, Ruby工具, TypeScript, XXE攻击, 安全插件, 实时处理, 密码管理, 日志审计, 自动化攻防, 请求拦截