Xalgorix Reviews & Product Details

Xalgorix is an Apache-2.0 open-source autonomous AI pentesting platform for authorized security testing. Unlike scanners that stop at plausible alerts, Xalgorix uses an AI agent to work through a structured 22-phase methodology and a separate verifier to independently reproduce each candidate finding before it is reported. Teams receive exploit-verified evidence, CVSS scoring, proof-of-concept details, remediation guidance, and branded PDF reports. The self-hosted Go and TypeScript project runs locally, keeps scan data in your infrastructure, and supports OpenAI, Anthropic, Gemini, DeepSeek, Groq, Ollama, MiniMax, and other OpenAI-compatible gateways. It includes a local web dashboard, CLI, Docker image, browser-assisted DAST, source-code review and provision-and-test modes, live telemetry, API and GraphQL testing, authentication and session analysis, injection, SSRF, IDOR/BOLA, file upload, deserialization/RCE, cloud, and WebSocket testing. The public repository is free and open source. The optional hosted Xalgorix service removes setup and adds managed scans, schedules, team workspaces, REST API access, CI gating, webhooks, and reports. A free GitHub App reviews pull-request diffs for security issues. Use Xalgorix only on systems you own or have explicit permission to test.