Blog

Strix alternative: the local-first open source AI pentester

Strix is a strong open source AI pentester, but it runs against a cloud model. If you need autonomous AI penetration testing that keeps your code and traffic on your own infrastructure and also covers Active Directory and Kubernetes, here is the honest comparison.

· 6 min read

If you evaluated Strix for autonomous AI penetration testing and thought "this is good, but I cannot send my source code, traffic or credentials to a cloud model", this is for you. An honest comparison, credit included.

Credit where it is due

Strix is a genuinely capable open source project (Apache 2.0), focused on autonomous web application testing. It runs its agents against a hosted cloud model. If a cloud model is acceptable in your context, it does the job well. Teams look for an alternative for three reasons: data must stay in-house, they need to cover more than web apps, and they want to read and modify the methodology.

Darkmoon, in one line

Darkmoon is a GPL-3.0 autonomous AI pentester that chains recon, exploitation and reporting over an MCP server, proves every finding with a working exploit, and covers web, API, Active Directory and Kubernetes. Unlike Strix, it can run entirely on a local LLM (Ollama or llama.cpp), and its local Privacy Gateway tokenizes sensitive values so your data never reaches a third party. Full disclosure: this is our project.

The differences that actually decide it

  • Where the model runs. Strix calls a cloud LLM. Darkmoon can run 100% locally, so it is safe to point at production or a client environment.
  • Scope. Autonomous web application testing vs Darkmoon's web + API + Active Directory + Kubernetes.
  • Proof over claims. Darkmoon found 57 real vulnerabilities on OWASP Juice Shop in 28 minutes, black-box, on a local LLM. Reproduce it yourself: the open AI-pentester benchmark.
  • License and auditability. GPL-3.0, self hosted via docker-compose, read and modify the source.

Try it

github.com/ASCIT31/Dark-Moon, clone, run ./install.sh, point it at a target you are authorized to test. If it saves you a manual pentest, a star helps other defenders find it.

Run it against your own lab

Darkmoon is open source (GPL-3.0) and self hosted. Clone it, point it at a target you own, and read every line.