📋 Requirements (build from source)

Check your Go version:

go version

📥 Installation

The fastest paths need no toolchain at all.

⚡ One-line install (prebuilt binary)

curl -sSL https://www.xalgorix.com/install | bash

Downloads the latest release binary for your platform (Linux or macOS, amd64/arm64) and installs it to /usr/local/bin (or ~/.local/bin without sudo). Override with XALGORIX_INSTALL_DIR or pin a version with XALGORIX_VERSION=vX.Y.Z.

Complete first-time configuration interactively—no manual environment-file editing required:

xalgorix --setup

The wizard preserves existing settings when rerun, hides API-key input in a terminal, and optionally launches the Web UI when finished.

🐳 Docker

docker run --rm -p 9137:9137 \
  --privileged \
  -e XALGORIX_LLM=openai/gpt-5.6 \
  -e XALGORIX_API_KEY=your_openai_api_key \
  -v xalgorix-data:/data \
  ghcr.io/xalgord/xalgorix:latest

--privileged (or the narrower --cap-add=NET_ADMIN --cap-add=NET_RAW --cap-add=SYS_PTRACE --security-opt seccomp=unconfined) gives the toolset host-like access. Docker's default sandbox drops capabilities and filters syscalls, which breaks low-level tooling (iptables/route/interface changes, ARP-spoof/MITM, tun/tap VPNs, ptrace-based debuggers). An image can't grant these to itself — they're a run-time decision — so pass the flag, or use the provided docker-compose.yml, which sets it for you.

The image is batteries-included: an extensive offensive-security toolset is preinstalled (nmap, nuclei, httpx, subfinder, dnsx, naabu, katana, ffuf, gobuster, dalfox, feroxbuster, sqlmap, masscan, nikto, whatweb, hydra, and more), plus Chromium for browser-assisted DAST. It also keeps the full package-manager set (apt, go, cargo, pipx, npm) available, so the agent auto-installs anything missing at runtime. Scan data persists to the /data volume, and the server binds 0.0.0.0 inside the container — set XALGORIX_USERNAME/XALGORIX_PASSWORD before exposing it beyond localhost.

The container runs as root by design (the engine only enables runtime auto-install for uid 0, and apt/go/cargo installs need system write access). Treat it as a disposable, network-isolated scanning sandbox. The same tags publish a multi-platform manifest for linux/amd64 and linux/arm64, so Docker selects the native image automatically.

On first run, if you don't set dashboard auth the container generates a random admin password and prints it to the logs (the image binds 0.0.0.0, which the engine won't do without auth). Set XALGORIX_USERNAME + XALGORIX_PASSWORD (or XALGORIX_PASSWORD_HASH) to use your own. The binary never self-updates inside the container (XALGORIX_NO_AUTO_UPDATE=1) — pull a new image tag to upgrade. The nuclei engine and its vuln templates are refreshed to the latest on every image build (the release CI and redeploy.sh force this); pass --build-arg NUCLEI_VERSION=vX.Y.Z to pin the engine, or NUCLEI_REFRESH=0 ./redeploy.sh to reuse Docker's cache.

🔨 Build From Source

git clone https://github.com/xalgorix/xalgorix.git
cd xalgorix
make build
sudo install -m 755 build/xalgorix /usr/local/bin/xalgorix

make build builds the React Web UI into internal/web/static, then builds the Go binary.

📦 Install With Go

GOPROXY=direct GOSUMDB=off go install github.com/xalgord/xalgorix/v4/cmd/xalgorix@latest

Provision + DAST: build & run the app locally, then pentest the running instance

xalgorix --source https://github.com/org/app.git --code-scan provision ```

- --source accepts a Git URL (shallow-cloned), a local directory, or a path to an uploaded/extracted archive. In the Web UI / hosted app you can also upload a .zip of your codebase (POST /api/upload-source). - You can still combine a repo and a live target for classic whitebox augmentation — that path is unchanged. Code-scan modes are for when the codebase is the whole subject.

Provision mode runs your app's build/start commands in the agent's sandbox and only pentests the single loopback port it stood the app up on — the dashboard and everything else on the machine stay out of scope.

🚀 Quick Start

Install (one line):

curl -sSL https://www.xalgorix.com/install | bash

This downloads the prebuilt binary for your platform (Linux or macOS, amd64/arm64) from the latest release. Then run the interactive setup wizard:

xalgorix --setup

Choose your provider, confirm a model, and enter the API key when prompted. For best results, use a current frontier model with strong reasoning, long-context performance, and reliable tool calling—such as the latest capable GPT, Claude, or Gemini model available to you. Smaller or local models remain supported, but may require more supervision during long autonomous scans. Xalgorix stores the key privately in ~/.xalgorix.env (mode 0600) and can launch the dashboard for you. Local Ollama needs no API key.

If you choose not to launch immediately, start later with xalgorix --web and open http://127.0.0.1:9137. You can change providers or advanced options at any time under Settings → LLM, or rerun xalgorix --setup.

Or run with Docker — batteries included, no toolchain needed:

docker run --rm -p 9137:9137 \
  --privileged \
  -v xalgorix-data:/data \
  xalgord/xalgorix:latest

--privileged gives the toolset the same host-like access it has when run natively as root. Docker's default sandbox drops capabilities (like NET_ADMIN) and applies a seccomp filter, which breaks low-level tools (iptables/route changes, ARP-spoof/MITM, tun/tap VPNs, ptrace-based debuggers, masscan interface tuning). Since an image can't grant itself these, they must be set at run time. The container is a disposable, network-isolated scanning sandbox running as root — privileged is the intended posture; never expose the dashboard publicly without auth. Prefer least-privilege? Swap --privileged for --cap-add=NET_ADMIN --cap-add=NET_RAW --cap-add=SYS_PTRACE --security-opt seccomp=unconfined.

Open http://localhost:9137. You don't need an LLM key to start — the dashboard launches without one; set the model + API key under Settings → LLM (it persists to the /data volume). If you don't pass XALGORIX_USERNAME/XALGORIX_PASSWORD, a random admin password is generated and printed to the container logs on first run.

Easiest — Docker Compose (maps the port + a persistent volume for you):

curl -sSLO https://raw.githubusercontent.com/xalgorix/xalgorix/main/docker-compose.yml
docker compose up -d
docker compose logs -f   # shows the generated admin password on first start

The image ships an extensive offensive-security toolset preinstalled (nmap, nuclei, httpx, subfinder, katana, ffuf, gobuster, sqlmap, masscan, dalfox, feroxbuster, and more) and keeps every package manager (apt, go, cargo, pipx, npm) available so the agent can still auto-install anything missing at runtime. It runs as root inside the container by design — treat the container as a disposable, network-isolated scanning sandbox and never expose the dashboard without auth. Images are published for both amd64 and arm64.

Or build from source (needs Go 1.26+ and Node.js):

git clone https://github.com/xalgorix/xalgorix.git
cd xalgorix
make build
sudo install -m 755 build/xalgorix /usr/local/bin/xalgorix

[!TIP] Prefer zero setup? A fully managed version runs at www.xalgorix.com — click-to-scan, no install or API keys required.

🎯 Use Cases

🔌 Provider Examples

OpenAI:

XALGORIX_LLM=openai/gpt-5.6
XALGORIX_API_KEY=sk-...

Custom OpenAI-compatible provider:

XALGORIX_LLM=custom/security-model
XALGORIX_API_BASE=https://your-provider.example/v1
XALGORIX_API_KEY=your_provider_api_key

🌉 LiteLLM / OpenAI-compatible gateways (GitHub Copilot, Claude Opus, Codex, OpenRouter, Azure, local models)

Because XALGORIX_API_BASE accepts any OpenAI-compatible /v1/chat/completions endpoint, Xalgorix works with a LiteLLM proxy out of the box — no Xalgorix-side changes needed. LiteLLM handles the upstream provider auth (Copilot device login, Azure keys, OpenRouter, Ollama, etc.); Xalgorix just talks OpenAI to the gateway.

Run LiteLLM (example config.yaml):

model_list:
  - model_name: claude-opus-5
    litellm_params:
      model: github_copilot/claude-opus-5   # or openrouter/…, azure/…, ollama/…
general_settings:
  master_key: sk-local-litellm-key

Point Xalgorix at it — use the custom/ prefix so the model name is sent verbatim and the OpenAI chat-completions protocol is used:

XALGORIX_LLM=custom/claude-opus-5            # the LiteLLM model_name
XALGORIX_API_BASE=http://localhost:4000/v1     # your LiteLLM proxy
XALGORIX_API_KEY=sk-local-litellm-key          # LiteLLM master_key / virtual key

The same pattern covers GitHub Copilot Business/CLI, Claude Opus, Codex-style models, OpenRouter, Azure OpenAI, and local Ollama models — anything LiteLLM can route. Keep the custom/ (or openai/) prefix and a non-Anthropic/Gemini XALGORIX_API_BASE so Xalgorix uses the standard OpenAI request shape that LiteLLM expects.

📸 Screenshots

🖥️ Self-hosted dashboard — runs locally on 127.0.0.1:9137

☁️ Hosted cloud dashboard — the fully managed version at www.xalgorix.com

<img src="assets/SaaS-dashboard.png?v=4.5.154" alt="Xalgorix hosted cloud dashboard showing security score, vulnerability trends, remediation metrics, and open issues by category" width="860" />

---

🔩 Configuration

Xalgorix loads configuration in this order. Later sources override earlier ones.

Create the local environment file:

nano ~/.xalgorix.env

🧩 Minimal Config

For the strongest autonomous scanning results, select a current frontier model. The model ID below is a concrete example; newer compatible model IDs can be entered without waiting for a Xalgorix release.

XALGORIX_LLM=openai/gpt-5.6
XALGORIX_API_KEY=your_openai_api_key

🔔 Optional Integrations

GEMINI_API_KEY=AIza...
AGENTMAIL_POD=am_us_pod_47
AGENTMAIL_API_KEY=ak_...
XALGORIX_DISCORD_WEBHOOK=https://discord.com/api/webhooks/...
XALGORIX_DISCORD_MIN_SEVERITY=high

🆕 New environment variable

🔧 Settings

Most operational settings can be changed from the Web UI under Settings.

Some settings require a restart because they affect process startup or server binding. The UI marks those fields.

🧾 Environment Variables

🩺 New health endpoint counters

GET /api/status now exposes:

🏹 CLI Scan

xalgorix --target https://example.com

With custom instructions:

xalgorix --target https://app.example.com --instruction "Focus on SQL injection, IDOR, and auth bypass. Avoid destructive tests."

💻 CLI Reference

📡 API Summary

🔁 Web UI Workflow

1. Open the dashboard at http://127.0.0.1:9137.
2. Go to Settings and confirm the LLM provider, API key, rate limits, and optional integrations.
3. Create a scan from New Scan.
4. Choose a scan mode.
5. Select methodology phases when you want a focused run.
6. Set severity filters when only certain severities should be reported live. The filter affects the real-time dashboard feed and notifications only; the PDF report and /api/findings always include every vulnerability the agent discovered.
7. Add company name and upload a logo for branded reports.
8. Monitor progress from Overview, Scan Detail, or Live Feed.
9. Open finding details, download reports, or manage historical scans from Scans and Reports.

🤝 Integrations

📊 How it compares

Directional comparison — Nuclei and ZAP are excellent at what they do. Xalgorix adds the reasoning-heavy discovery and exploit-verification layer on top.

☁️ Self-hosted vs Hosted cloud

Xalgorix is free and open source — self-host it forever, no strings attached. The hosted cloud runs the same exploit-verified engine; it exists for people who'd rather not manage API keys, infrastructure, and unpredictable LLM bills. Both are first-class — pick what fits.

Self-host if data must stay on your network, you want full control, or you'll run offline/air-gapped — that's exactly what it's for. Use the cloud if you'd rather skip the API keys, infra, and surprise token bills, and pay only for the live hosts you actually scan.