Your Autonomous Red Teamer, Trapped on localhost

What it does Xalgorix is a Go-based, self-hosted security testing platform that orchestrates an LLM-driven agent through structured penetration tests. It runs a local React dashboard—bound to loopback by default—where you can launch scans, watch live WebSocket telemetry, triage findings, and generate branded PDF reports. The system supports single targets, wildcard enumeration, and browser-assisted DAST flows, with selectable phases from a 22-phase methodology.

The interesting bit Most autonomous security tools either spray blindly or require constant babysitting; Xalgorix tries to split the difference by enforcing a rigid 22-phase methodology and hard safety guardrails like filesystem path policies, resource-aware concurrency caps, and mandatory authentication before external binding. It also bakes in operational conveniences like AgentMail test inboxes and Discord webhooks, suggesting the author actually lives the bug-bounty workflow rather than just simulating it.

Key highlights

• Local-first Web UI with live WebSocket feeds for tool calls, LLM activity, errors, and findings.
• Selectable 22-phase testing methodology covering reconnaissance, manual discovery, directory enumeration, and beyond.
• Branded PDF report generation with uploaded logos and company names for client deliverables.
• Safety defaults: loopback-only binding, path policy restrictions, per-tool watchdog timeouts, and admission refusals when resource ceilings hit.
• Integrations for AgentMail (test inboxes and OTP flows) and Discord severity-based notifications.

Caveats

• Linux is the primary supported platform, and building from source requires Node.js to compile the bundled React frontend.
• The LLM is external by default (OpenAI, MiniMax, or custom OpenAI-compatible endpoints); “self-hosted” describes the platform, not the model.
• The full list of the 22 methodology phases is truncated in the README, so the complete scope is unclear from the provided source.

Verdict Worth a look for bug bounty hunters and internal red teams who want a structured, LLM-guided attack workflow with a local dashboard and client-ready reporting. Skip it if you need a fully offline, LLM-free scanner or a native Windows or macOS experience.