# Strix Security Operations Portal

Base URL: https://strix.greener-business.com
API base: https://strix.greener-business.com/api/v1
Authentication: Authorization: Bearer <STRIX_PORTAL_TOKEN>
Content-Type: application/json

This service launches autonomous, self-hosted Strix security assessments. Use it only on assets the user owns or is explicitly authorized to test. Production scans require a verified backup. Scans are non-destructive by default.

## Discovery

GET /api/v1/health
GET /api/v1/capabilities
GET /api/v1/providers

## Scan tools

POST /api/v1/scans

Body:

{"targets":["https://app.example.com"],"mode":"quick","provider":"smart-router","instruction":"Focus on authorization boundaries.","authorized":true,"backup_confirmed":true}

mode: quick | standard | deep
provider: codex | smart-router
targets: 1-4 HTTPS URLs or Git repository URLs

GET /api/v1/scans?limit=50
GET /api/v1/scans/{id}
GET /api/v1/scans/{id}/findings
GET /api/v1/scans/{id}/artifacts
GET /api/v1/scans/{id}/artifacts/{name}
POST /api/v1/scans/{id}/cancel

Terminal states: completed, failed, cancelled, timed_out, interrupted.
Non-terminal states: queued, running.

Artifacts: penetration_test_report.md, vulnerabilities.json, vulnerabilities.csv, findings.sarif, run.json.

For each finding, report severity, confidence, impact, technical root cause, evidence/PoC, affected endpoint or file, reproduction steps, and concrete remediation. Never call a target clean merely because a scan ended; check run.json status, coverage, and limitations.

## Agent integrations

Skill: https://strix.greener-business.com/agent/skill.md
MCP stdio adapter: https://strix.greener-business.com/agent/strix_portal_mcp.py

The MCP adapter exposes: strix_start_scan, strix_list_scans, strix_get_scan, strix_get_findings, strix_list_artifacts, strix_get_artifact, strix_cancel_scan, strix_capabilities.