Someone will test your app. Be first. 
Seven free agents that attack code you own — on your own machine, legally, tonight.
ROUND 1 · 
strix — 71.9k★
Finds the hole and writes the patch. If you ship a web app this month, start here and stop reading.
ROUND 2 · 
shannon — 49.4k★
Reads your source code, then attacks what it just read. Have the repo? This one sees deeper than a URL scanner.
ROUND 3 · 
pentagi — 32.4k★
A whole team in one job: recon, exploit, report. For when you want a full engagement rather than a scan.
ROUND 4 · 
PentestGPT — 16.1k★
The classic, and it shows its reasoning at every step. Learn the trade by watching it work.
ROUND 5 · 
hexstrike-ai — 13.1k★
Hands Claude or Cursor 150+ security tools over MCP. Already coding with an assistant? Give it hands.
ROUND 6 · 
CAI — 9.8k★
The research framework people script their own attack chains on. Built to be extended, not just used.
ROUND 7 · 
vulnhuntr — 2.8k★
Zero-shot: no example of the bug needed. Point it at a big codebase when you have no idea what to look for.
Where to practise
The undercard matters as much as the fight. Juice Shop (14.2k★) is a store built to be cracked; PortSwigger’s labs run free in the browser. Run an agent, then compare its report to the lab’s own answer key — that comparison is where you learn.
Tonight: clone strix, aim it at Juice Shop, read one report. Your own code never looks the same afterwards.
!