English

← Back to list

Xalgorix: An Open-Source AI Pentest Platform With 22 Phases

itadol5j

Cover

What's the most soul-crushing part of penetration testing? It's not writing reports—it's the repetitive grind: recon, directory brute-forcing, injection testing, SSRF validation, CORS checks... A standard web pentest means running a dozen-plus tools, typing hundreds of commands, then stitching the results together by hand.

AI security tools have been proliferating like crazy these past few years, but most projects either only handle a single phase, only work with a handful of hardwired models, or have UIs so bad you're stuck grinding through the command line.

Then I found Xalgorix—it breaks the entire pentest methodology into 22 phases and runs them fully automatically, with a web dashboard, real-time telemetry, and PDF reports,and it supports MiniMax, GPT, Claude, Gemini, and any OpenAI-compatible endpoint. It's open source, written in Go, self-hosted, and one make build gets you flying.

Project link: github.com/xalgord/xalgorix

What Exactly Is Xalgorix

In one sentence:a self-hosted AI penetration testing platform.

It combines:

  • an LLM-powered agent brain
  • browser automation (for DAST and anything needing interaction)
  • a terminal toolchain (common security tools auto-installed on demand)
  • a 22-phase penetration testing methodology
  • real-time WebSocket event streams
  • a findings management system (vulnerabilities + CVSS + verification status)
  • branded PDF report generation
  • AgentMail and Discord integrations

Open your browser at http://127.0.0.1:9137 and there's your "AI pentest command center."

The 22-Phase Methodology: From Recon to Zero-Days

This is where Xalgorix genuinely impressed me—it doesn't take the crude "throw a URL at the AI and let it figure things out" approach. Instead, it splits pentesting into 22 ordered phases:

  • Phases 1-2: Reconnaissance / manual vulnerability hunting
  • Phases 3-4: Directory & file discovery / CORS and cookie analysis
  • Phases 5-6: Authentication & session testing / injection testing (SQL/XSS/Cmd)
  • Phases 7-8: SSRF testing / IDOR access control
  • Phases 9-10: API & GraphQL testing / file upload testing
  • Phases 11-12: Deserialization & RCE / race conditions and business logic
  • Phases 13-14: Subdomain takeover / open redirect testing
  • Phases 15-16: Email security testing / cloud and infrastructure
  • Phases 17-18: WebSocket testing / CMS-specific testing
  • Phases 19-20: Broken link hijacking / vulnerability verification
  • Phases 21-22: Zero-day discovery / final reporting

You can run everything, or tick off specific phases in the web UI—say you only want SSRF and IDOR tested, just check those two and you save both time and tokens.

Three Scan Modes

Illustration
  • Single target: test a single known URL or host
  • Wildcard / multi: wildcard multi-target mode for attack surface discovery and bulk scanning
  • DAST: browser-assisted testing, built for web apps, auth flows, forms, and runtime behavior

DAST mode is the standout—lots of AI pentest tools lack browser automation and fall apart the moment they hit a modern web app that needs login or SPA interaction. Xalgorix ships a browser layer out of the box that can run full login flows, form submissions, and JavaScript interactions.

Up and Running in Three Steps, 60 Seconds Flat

Requirements: Linux + Go 1.24.2+.

Step 1: Clone and build

git clone https://github.com/xalgord/xalgorix.git
cd xalgorix
make build
sudo install -m 755 build/xalgorix /usr/local/bin/xalgorix

make build compiles the React web UI into internal/web/static first, then builds the Go binary.

Step 2: Configure your LLM

Create ~/.xalgorix.env:

XALGORIX_LLM=minimax/MiniMax-M2.7
XALGORIX_API_KEY=your_provider_api_key

For users in China, MiniMax-M2.7 is the top pick—great value for money and friendly to Chinese-language pentest reports. OpenAI, custom OpenAI-compatible endpoints, and Gemini are also supported.

OpenAI configuration:

XALGORIX_LLM=openai/gpt-5.4
XALGORIX_API_KEY=sk-...

Custom OpenAI-compatible setups (Alibaba Qwen, Zhipu, etc.):

XALGORIX_LLM=custom/security-model
XALGORIX_API_BASE=https://your-provider.example/v1
XALGORIX_API_KEY=your_provider_api_key

Step 3: Launch the web dashboard

xalgorix --web

Open http://127.0.0.1:9137 in your browser and get to work.

It Works From the Command Line Too

For hardcore users who don't want the web UI:

xalgorix --target https://example.com

With custom instructions:

xalgorix --target https://app.example.com --instruction "Focus on SQL injection, IDOR, and auth bypass. Avoid destructive tests."

Natural-language instructions like this get fed straight to the agent, which runs the scan following your stated strategy.

Service Mode: Run It as a System Service

Illustration

Need batch scanning around the clock, 24/7?

sudo xalgorix --start
sudo xalgorix --restart
sudo xalgorix --stop
sudo xalgorix --uninstall

journalctl -u xalgorix -f

Want the dashboard reachable remotely? You must enable dashboard authentication first:

sudo tee -a /root/.xalgorix.env >/dev/null <<EOF
XALGORIX_BIND=0.0.0.0
XALGORIX_USERNAME=admin
XALGORIX_PASSWORD=change-this
EOF

sudo xalgorix --restart

Note: without authentication configured, the server refuses external bindings outright. That's a security default worth applauding.

The Integration Ecosystem

Xalgorix isn't an island:

  • AgentMail: disposable emails for testing, verification email reception, OTP flows, email-triggered events
  • Discord Webhook: real-time push alerts for high-severity findings, with a configurable minimum severity threshold

Sample Discord configuration:

XALGORIX_DISCORD_WEBHOOK=https://discord.com/api/webhooks/...
XALGORIX_DISCORD_MIN_SEVERITY=high

This way only high-severity and above findings notify you, so you don't drown in low-severity noise.

Reporting: Client-Ready PDFs, Straight Out of the Box

Reporting in many open-source tools is a joke—either raw JSON or a thrown-together Markdown file, nothing you could ever hand to a client.

Xalgorix's reporting module has real craft behind it:

  • Summary: executive summary, target metadata, scan metadata, severity overview
  • Findings: verified findings, CVSS details, technical analysis, proof of exploitation
  • Evidence: PoC commands, scripts, payloads, corroborating observations
  • Remediation: fix guidance, priority ranking
  • Branding: company name, logo (you can upload your own)

Finish a scan and out comes a PDF report carrying your company's logo, ready to deliver. This is the feature built for security consultancies, SRC teams, and pentest service providers.

Secure Runtime Design

Illustration

Xalgorix puts real thought into "not getting owned itself":

  • Binds to loopback only by default(127.0.0.1); exposing it externally requires explicitly enabling authentication
  • Path policies: filesystem writes are only allowed to data_dir, ~/.xalgorix/, and /tmp—everything else is rejected
  • Resource-aware instance limits: prevents one machine from running so many scans it blows up its memory
  • Per-tool hard-timeout watchdog: hung child processes get force-killed
  • Concurrency admission control: scans above the cap get refused—no mindless task piling

The GET /api/status endpoint even exposes runtime stats: panics_recovered, path_rejections, watchdog_kills, admission_refusals, llm_inflight_cap. Baking observability into a standard API like this tells you the author is an engineer's engineer, not a PoC slapper-together.

The Breaking Changes in v4.4.18

Upgrade notes:Scan output, notes, schedules, and other generated data now all live under ~/.xalgorix/data/, no longer in the directory where the binary was launched.

If you want to keep the old behavior:

export XALGORIX_DATA_DIR=$(pwd)

At startup, if legacy path markers like notes.json, _schedules/, or vulnerabilities.json are detected in $CWD, you'll get a [MIGRATION] warning—but Xalgorix will not automatically read, copy, or deletethose old files. It just nudges you to migrate and never touches your data—a restraint that's genuinely reassuring.

Who Is It For

Red teams / pentest engineers: the 22-phase methodology plus automation plus natural-language instructions frees you from the repetitive grind so you can focus on manual bug hunting and deep analysis.

Bug bounty hunters: bulk-scan wild
card targets, auto-discover your attack surface, and get high-severity findings pushed to Discord in real time. Let the AI hunt bounties for you while you sleep.

SRC teams / blue teams: run scheduled self-checks and map out your corporate attack surface. Branded PDF reports go straight to the boss.

Security consultancies: run service mode with isolated scans per client and deliver client-branded reports.

Students / researchers: the 22-phase methodology is essentially a living pentest textbook—open source, readable, and modifiable.

Why This Project Deserves Your Attention

Illustration

There's no shortage of AI pentest tools in 2026, but few manage the "complete closed loop" that Xalgorix does:

  • It's not an agent with no UI (plenty of AI pentest tools are command-line only)
  • It's not a UI with no methodology (plenty are just piles of buttons)
  • It's not locked to a single model (supports any OpenAI-compatible endpoint, including China's MiniMax)
  • It doesn't output half-finished work (branded PDF reports, client-ready)
  • It doesn't run naked with zero security design (loopback by default, path policies, watchdog, concurrency controls—all there)

Building out the full stack—"AI agent brain + browser automation + toolchain + 22-phase methodology + web UI + reporting system"—is a rare feat of engineering in the open-source world.

A Word on Safe Use

One last thing, straight from the official docs:

Use Xalgorix only on systems you own or have explicit permission to test.

Only use Xalgorix on systems you own or have explicit permission to test.

The power of AI pentest tools cuts both ways—they can help you find vulnerabilities efficiently, but pointed at the wrong targets they become a very real legal risk. Authorization, scope, and reporting processes all matter. People getting burned by AI tools and ending up in legal trouble aren't rare stories these days. Don't become the next headline.

Wrapping Up

Xalgorix isn't yet another AI pentest PoC—it's an open-source example of what it looks like to turn "AI security testing" into something truly engineered and productized.

If you work in security, red side or blue side, it's worth cloning and trying out. If you contribute to open source, its Go + React + LLM agent architecture is a solid study too.

Project link, one more time:

github.com/xalgord/xalgorix