Noureddine RAMDI / Inside Xalgorix: an LLM-driven autonomous pentesting platform with a 22-phase testing pipeline

Created Sat, 23 May 2026 20:41:14 +0000 Modified Sat, 23 May 2026 20:41:27 +0000
1001 Words
github-stars go security pentesting automation llm webui

xalgord/xalgorix

Xalgorix tackles a common pain point in security testing: how to automate a comprehensive pentesting workflow end-to-end, not just run isolated scans or vulnerability checks. Instead of a simple script or chatbot wrapping security tools, it implements a 22-phase autonomous methodology that covers everything from reconnaissance to final reporting. This shifts the paradigm from manual or semi-automated testing to a structured pipeline powered by an LLM agent orchestrating browser automation and terminal tools.

What xalgorix does and how it works

At its core, Xalgorix is a self-hosted web application security testing platform. It combines an LLM-driven autonomous agent with a 22-phase pentesting methodology that systematically advances through reconnaissance, scanning, exploitation, verification, and reporting. This pipeline approach is more than just invoking a few tools; it’s a full workflow engine that manages state, telemetry, and findings throughout.

The backend is written in Go, which is a solid choice for reliability, concurrency, and system-level orchestration. The frontend is a React-based web UI providing live telemetry via WebSocket, findings management with severity filters, and branded PDF report generation. This UI sits on top of the Go backend and offers a dashboard for configuration and monitoring.

Under the hood, Xalgorix leverages browser automation for DAST (Dynamic Application Security Testing) phases, integrating with terminal-based security tools as well. The 22-phase methodology is opinionated and comprehensive, ensuring no major step in a pentest is missed. It also supports integrations for testing email/OTP via AgentMail and Discord for notifications, reflecting a real-world pentesting workflow.

Configuration is environment-variable-driven but enhanced with a dashboard settings editor, which balances automation and user control. By default, the server binds only to loopback interfaces for security, requiring explicit authentication and configuration to expose externally, which is a sensible default in security tooling.

The 22-phase autonomous pentesting methodology and architectural strengths

What makes Xalgorix stand out is its structured 22-phase pipeline. Most pentesting tools are modular or focused on specific scanning steps. Xalgorix turns an LLM agent into a full workflow engine that autonomously moves through each phase, applying different techniques and tools.

This approach has clear tradeoffs. On the plus side, it enforces a disciplined, repeatable process from start to finish, which is often missing in ad hoc pentesting scripts. It also integrates telemetry and findings management tightly, so you get live insights and a centralized place for results and severity filtering.

On the downside, this complexity means the codebase is larger and the system has a steeper learning curve. The Go backend must orchestrate diverse external tools and automation flows, which can introduce brittleness if tools change or outputs vary. The reliance on environment variables for configuration is straightforward but can become unwieldy for larger deployments.

The code quality is surprisingly clean for a multi-tool orchestration platform. The React UI is bundled with the Go binary, simplifying deployments by reducing dependencies. The use of WebSocket for live telemetry is a practical choice for real-time feedback during long-running tests.

Security-wise, the default loopback-only binding and enforced authentication for external access show a cautious approach, which is important given the sensitivity of pentesting workflows. The integration with communication tools like Discord and email OTP testing demonstrates a focus on practical workflows beyond just scanning.

Quick start with Xalgorix

The installation and build process is well documented and straightforward for a Go-based project with a React frontend.

You need Linux, Go 1.24.2 or newer, and Node.js/npm to build the React UI.

Here’s how to build and install from source:

git clone https://github.com/xalgord/xalgorix.git
cd xalgorix
make build
sudo install -m 755 build/xalgorix /usr/local/bin/xalgorix

The make build target compiles the React Web UI into a static bundle inside the Go project, then builds the Go binary. This bundling makes deployment simpler since you get a single binary that serves the UI.

Alternatively, you can install the latest release directly using Go:

GOPROXY=direct GOSUMDB=off go install github.com/xalgord/xalgorix/v4/cmd/xalgorix@latest

Once installed, configuration is mostly via environment variables, but there is a dashboard editor after startup for tweaking settings.

Verdict: who should consider Xalgorix?

Xalgorix is a solid option if you want an autonomous, end-to-end pentesting workflow that goes beyond running isolated vulnerability scanners. Its 22-phase testing pipeline is the standout feature, providing structure and coverage that are hard to find in other open-source tools.

The platform is best suited for authorized pentesters, bug bounty hunters, and security teams working on systems they own or have explicit permission to test. It assumes some familiarity with Linux environments, Go tooling, and pentesting concepts.

The tradeoff is complexity versus coverage — you get a comprehensive pipeline but with a learning curve and operational overhead. The environment-variable-driven config and loopback-only default binding are sensible defaults but might require customization for larger or multi-user environments.

The live telemetry, findings management, and reporting capabilities add real production value, making it more than just an automation script.

In short, if you want a single platform that orchestrates browser automation, terminal tools, and an LLM-driven workflow through a rigorous pentesting methodology, Xalgorix is worth exploring. Just be prepared for the operational complexity that comes with a full autonomous pentesting pipeline.

→ GitHub Repo: xalgord/xalgorix ⭐ 287 · Go