Configuration

Configure Strix using environment variables or a config file.

LLM Configuration

string

required

Model name in LiteLLM format (e.g., openrouter/z-ai/glm-5.3, openai/gpt-5.4).

string

API key for your LLM provider. Not required for local models or cloud provider auth (Vertex AI, AWS Bedrock).

string

Custom API base URL. Also accepts OPENAI_API_BASE, LITELLM_BASE_URL, or OLLAMA_API_BASE.

string

Select the OpenAI API path for the model: responses or chat_completions. By default, a custom LLM_API_BASE uses chat completions. Set this variable when your gateway requires the other API. Also accepts STRIX_FORCE_API.

string

Extra HTTP headers sent on every LLM request, as a JSON object (e.g. {"X-Feature-Key":"value","X-Tenant":"acme"}). Useful for OpenAI-compatible gateways that require attribution or routing headers in addition to the bearer token. The bearer token itself still comes from LLM_API_KEY. Applies to both the LiteLLM and native OpenAI routing paths.

integer

default:"300"

Request timeout in seconds for LLM calls.

integer

default:"5"

Maximum number of retries for LLM API calls on transient failures.

string

default:"high"

Control thinking effort for reasoning models. Valid values: none, minimal, low, medium, high, xhigh, max. Defaults to medium for quick scan mode.

integer

default:"30"

Timeout in seconds for memory compression operations (context summarization).

boolean

default:"false"

Send a per-agent session_id on OpenRouter requests, so each agent’s calls stay on one upstream provider and its prompt cache carries over between turns. When unset, OpenRouter routes every request freely.

integer

default:"128"

Token block size that providers cache prompts in. A turn counts as a cache miss in the run report only when the cached tokens fall at least this many tokens short of the previous prompt and the prompt did not shrink. Lower it for providers with smaller blocks (DeepSeek and GLM use 64; vLLM defaults to 16).

Dedicated deduplication model

Finding deduplication is a cheap, structured classification task. By default it runs on the main model, but you can route it to a smaller/cheaper model without affecting the agents that do the actual testing.

string

Model used to judge whether a candidate finding duplicates an existing report. Falls back to STRIX_LLM when unset.

string

Optional provider key for the deduplication model.

string

Optional custom API base URL for the deduplication model. Use when the dedupe model runs on a different endpoint than the main model.

string

Optional JSON object of extra HTTP headers sent on every deduplication-model request, e.g. {"X-Feature-Key":"value"}. A dedicated dedupe model never inherits LLM_EXTRA_HEADERS; set this when its endpoint needs custom headers.

string

Reasoning effort for the deduplication model. Defaults to the model’s own baseline when unset.

Optional Features

string

API key for Perplexity AI. Enables real-time web search during scans for OSINT and vulnerability research.

string

API key for Exa. Enables real-time web search through the Exa /search endpoint. Exa also powers the web_get_contents tool, which fetches the full text of a page through the Exa /contents endpoint. This is the preferred web search provider.

string

default:"auto"

Web search provider: auto, perplexity, or exa. With auto, Strix uses Exa when EXA_API_KEY is set, and Perplexity otherwise. Set an explicit provider to pin one when you configure both keys.

string

default:"auto"

Exa search mode: auto, fast, instant, deep-lite, deep, or deep-reasoning. Lower modes return results faster. Higher modes plan across more steps and take more time. This setting applies only to the Exa provider.

integer

default:"5"

Number of Exa results to return, from 1 to 100. Each result includes a title, a URL, and a short security-focused summary. To read a full page, the agent calls web_get_contents with the result URL. This setting applies only to the Exa provider.

string

Postman API key (PMAK-…). Enables fetching Postman collections by id as a target (postman://<collection-uid>), and Postman environments (postman://<collection-uid>?env=<environment-uid>) to resolve collection variables. Not needed when passing a local collection export file.

string

default:"1"

Telemetry toggle. Set to 0, false, no, or off to disable telemetry (PostHog, Scarf, OTEL).

string

OTLP/Traceloop base URL for remote OpenTelemetry export. If unset, Strix keeps traces local only.

string

API key used for remote trace export. Remote export is enabled only when both TRACELOOP_BASE_URL and TRACELOOP_API_KEY are set.

string

Optional custom OTEL headers (JSON object or key=value,key2=value2). Useful for Langfuse or custom/self-hosted OTLP gateways.

When remote OTEL vars are not set, Strix still writes complete run telemetry locally to:

strix_runs/<run_name>/events.jsonl

When remote vars are set, Strix dual-writes telemetry to both local JSONL and the remote OTEL endpoint.

Docker Configuration

string

default:"ghcr.io/usestrix/strix-sandbox:1.3.0"

Docker image to use for the sandbox container.

string

Docker daemon socket path. Use for remote Docker hosts or custom configurations.

string

default:"docker"

Runtime backend for the sandbox environment.

Sandbox Configuration

integer

default:"120"

Maximum execution time in seconds for sandbox operations.

integer

default:"10"

Timeout in seconds for connecting to the sandbox container.

Config File

Strix stores configuration in ~/.strix/cli-config.json. You can also specify a custom config file:

strix --target ./app --config /path/to/config.json

Config file format:

{
  "env": {
    "STRIX_LLM": "openrouter/z-ai/glm-5.3",
    "LLM_API_KEY": "sk-...",
    "STRIX_REASONING_EFFORT": "high"
  }
}

Example Setup

# Required
export STRIX_LLM="openrouter/z-ai/glm-5.3"
export LLM_API_KEY="sk-..."

# Optional: Enable web search (Exa preferred, Perplexity supported)
export EXA_API_KEY="..."
export PERPLEXITY_API_KEY="pplx-..."

# Optional: Custom timeouts
export LLM_TIMEOUT="600"
export STRIX_SANDBOX_EXECUTION_TIMEOUT="300"

Getting Started

Usage

LLM Providers

Integrations

Tools

Advanced

Configuration

LLM Configuration

Dedicated deduplication model

Optional Features

Docker Configuration

Sandbox Configuration

Config File

Example Setup

​LLM Configuration

​Dedicated deduplication model

​Optional Features

​Docker Configuration

​Sandbox Configuration

​Config File

​Example Setup

LLM Configuration

Dedicated deduplication model

Optional Features

Docker Configuration

Sandbox Configuration

Config File

Example Setup