Xalgorix is an open-source AI pentesting platform that autonomously assesses authorized web applications using a structured 22-phase methodology. It attempts to reproduce candidate exploits and delivers evidence-backed findings, severity context, and remediation guidance. It’s built to slot into a dev workflow too: install the free GitHub App for automatic security reviews on every pull request, or wire the GitHub Action into CI to block merges on proven, high-severity bugs.
The core engine is open-source and available on GitHub, so you can self-host it and run the same 22-phase methodology on your own machine, minus the hosted dashboard, managed LLM keys, and team-sharing extras. Worth noting for anyone testing this out – Xalgorix only scans targets you own or have explicit permission to test, and it logs every scan for an audit trail, so it’s a good idea to confirm authorization before pointing it at anything.
