---
name: strix-security-portal
description: Launch authorized self-hosted Strix security scans, monitor them, retrieve validated findings and artifacts, and prepare developer-ready remediation handoffs through the private Greener Business Strix Portal API.
---

# Strix Security Portal

Use this skill only for assets the user owns or has explicit permission to test. Before starting any scan, confirm both authorization and a current backup. Prefer staging; on production use test accounts and non-destructive validation.

## Configuration

```bash
export STRIX_PORTAL_URL="https://strix.greener-business.com"
export STRIX_PORTAL_TOKEN="<scoped token from the portal>"
```

Send `Authorization: Bearer $STRIX_PORTAL_TOKEN` and `Content-Type: application/json`.

## Workflow

1. Call `GET /api/v1/providers`; choose only a provider whose `configured` value is true.
2. Choose `quick` for a smoke check, `standard` for routine assessment, or `deep` only after the user confirms production safety and scope.
3. Start with `POST /api/v1/scans`. Pass `authorized:true` and `backup_confirmed:true` only after those statements are actually true.
4. Poll `GET /api/v1/scans/{id}` every 15-30 seconds. Do not create duplicate scans while a job is queued or running.
5. When terminal, read `GET /api/v1/scans/{id}/findings` and the artifact list. Use `strix_get_artifact` when operating through MCP.
6. Summarize validated findings separately from hypotheses or coverage gaps. For each finding give business impact, technical root cause, reproduction/evidence, affected component, and a specific fix the developer can implement.
7. Prefer SARIF for CI/code navigation and Markdown for a human handoff.

## Start request

```json
{
  "targets": ["https://app.example.com"],
  "mode": "quick",
  "provider": "smart-router",
  "instruction": "Focus on tenant isolation and authenticated authorization checks.",
  "authorized": true,
  "backup_confirmed": true
}
```

Targets must be HTTPS URLs or Git repository URLs. Never embed credentials in a URL. Put disposable test credentials in `instruction` only when the user explicitly supplies them, and avoid repeating them in chat or logs.

## Status interpretation

- `queued`, `running`: keep polling.
- `completed`: artifacts are available; this does not by itself prove full coverage.
- `failed`: read `error` and `log_tail`; explain what did and did not run.
- `timed_out`: preserve partial findings and state that coverage is incomplete.
- `cancelled`, `interrupted`: do not describe the target as clean.

## API reference

Read `https://strix.greener-business.com/llms.txt` for the compact endpoint contract. Call `GET /api/v1/capabilities` for the live tool, provider, and artifact inventory.