compare
Open-source AI pentesting tools compared
Four questions separate these tools: what they need from you (source code or a URL), where you can run them, who pays for the model, and what the license lets you do.
Disclosure: this page is published by Xalgorix, one of the tools listed. Every fact comes from each project's own README or pricing page, checked on 19 October 2026, and each tool links to its source. Spotted something out of date? Tell us.
Summary
| Tool | License | GitHub stars | Approach | Self-hosted needs | Hosted option |
|---|---|---|---|---|---|
| Strix | Apache-2.0 | ~69.8k | Runs your app dynamically and validates findings with proof-of-concept exploits | Docker plus an LLM API key | Strix Cloud: Pro $29 per seat per month; pentests billed per test |
| Shannon | AGPL-3.0 | ~49.1k | White-box: reads the source code, then exploits the running app. “No exploit, no report” | Your own model key, or local models | Keygraph Pro: $50 per developer per month; Enterprise on request |
| PentestGPT | MIT | ~16.0k | Agentic penetration-testing framework powered by large language models | Your own LLM provider | None listed |
| Xalgorix | Apache-2.0 | ~1.2k | Black-box: tests the running app; reports a finding only after exploiting it, then re-tests it with an independent verifier | Your own LLM provider key, or local models via Ollama | Xalgorix Cloud: 10 credits for $10 (never expire); plans from $49/mo |
Star counts from the GitHub API on 19 October 2026. For a closed-source reference point, XBOW does not publish prices; its pricing page describes usage-based pricing scoped to your environment. Xalgorix vs XBOW →
Which should you pick?
- You have the source code and want CI gating on mergesShannon or Strix
- You need to test what is deployed, including apps whose code you can't shareXalgorix
- You want the largest community and the most integrationsStrix
- You want to pay per scan, without seats or model keysXalgorix Cloud
Try Xalgorix on your staging app
10 credits for $10, no subscription, and credits never expire. Or self-host the open-source engine for free.