# strix v1.6.0

- Product: strix (https://whatsnew.fyi/product/strix)
- Vendor: usestrix
- Date: 2026-09-01
- Version: v1.6.0
- Original notes: https://github.com/usestrix/strix/releases/tag/v1.6.0
- Permalink: https://whatsnew.fyi/product/strix/releases/v1.6.0
- Labels: Platforms: Android

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Fix LiteLLM cost model resolution
- **added** — Place caller-provided files into the sandbox workspace via extra_files and --workspace-file
- **added** — Add contextual CVSS breakdown on dependency reports
- **changed** — Require contextual CVSS and usage evidence on dependency reports
- **fixed** — Handle resume tokens gracefully
- **added** — Add OWASP LLM Top 10 2026 skill coverage
- **added** — Add Azure and Entra security skill
- **added** — Add argument injection security skill
- **added** — Add ecosystem supply-chain security skills
- **added** — Add Hurl and Hypothesis security playbooks
- **added** — Add semantic browser and Electron security skills
- **added** — Expose viewer host option
- **changed** — Drop strict tool schemas on Claude routes
- **fixed** — Preserve cost in TUI when state is truncated
- **fixed** — Use single space after ordered-list marker in TUI
- **fixed** — Raise RuntimeError on non-object run.json in report
- **changed** — Improve skills
- **changed** — Take heavy imports off the startup path and pre-warm them in the background
- **changed** — Bootstrap Caido concurrently with the scan start
- **added** — Add evidence discipline and coverage as a first-class artifact in agents
- **added** — Add MCP server support
- **changed** — Treat literal 'null' and 'none' strings as absent for optional tool arguments
- **fixed** — Re-exec runs the new binary after self-update to prevent endless update-prompt loop
- **fixed** — Restore base foreground after ANSI resets in TUI
- **changed** — Scope threat models to the current run instead of caching them on disk
- **changed** — Reach MCP tools on demand instead of registering every one
- **changed** — Isolate MCP connections per task and surface connection status in the UIs
- **fixed** — Only attach prompt-cache points on routes LiteLLM serves
- **fixed** — Bind dedupe credentials to a provider and send reasoning=max via extra_body
- **fixed** — Keep strix.report import-light to prevent races with the warm-up thread
- **fixed** — Fix user message retry lifecycle and TUI sync
- **security** — Add CSV injection hardening
- **fixed** — Harden PDF report rendering in viewer
- **fixed** — Stage extra-file bind mounts where a remote docker daemon can see them
- **changed** — Make MCP connections survive transient transport failures
- **added** — Add strix cloud — managed platform CLI for login, scans, billing, and API
- **added** — Add pentest skill cloud CLI
- **changed** — Forward the workspace header through CLI
- **added** — Add update_vulnerability_report so an agent can revise a filed finding

##### What's Changed
* Fix LiteLLM cost model resolution by @bearsyankees in https://github.com/usestrix/strix/pull/1069
* feat: place caller-provided files into the sandbox workspace (`extra_files`, `--workspace-file`) by @yoni-at-strix in https://github.com/usestrix/strix/pull/1085
* feat(reporting): contextual CVSS breakdown on dependency reports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1091
* feat(reporting): require contextual CVSS and usage evidence on dependency reports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1092
* handle resume tokens gracefully by @bearsyankees in https://github.com/usestrix/strix/pull/1097
* Add OWASP LLM Top 10 2026 skill coverage by @bearsyankees in https://github.com/usestrix/strix/pull/1115
* Add Azure and Entra security skill by @bearsyankees in https://github.com/usestrix/strix/pull/1119
* Add argument injection security skill by @bearsyankees in https://github.com/usestrix/strix/pull/1120
* Add ecosystem supply-chain security skills by @bearsyankees in https://github.com/usestrix/strix/pull/1121
* Add Hurl and Hypothesis security playbooks by @bearsyankees in https://github.com/usestrix/strix/pull/1122
* Add semantic browser and Electron security skills by @bearsyankees in https://github.com/usestrix/strix/pull/1123
* Expose viewer host option by @kusonooyasumi in https://github.com/usestrix/strix/pull/1127
* Drop strict tool schemas on Claude routes by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1136
* fix(tui): preserve cost when state is truncated by @kusonooyasumi in https://github.com/usestrix/strix/pull/1086
* fix(tui): use single space after ordered-list marker by @OpenPay-App in https://github.com/usestrix/strix/pull/1043
* fix(report): raise RuntimeError on non-object run.json (fixes #1109) by @vardhans07 in https://github.com/usestrix/strix/pull/1116
* better skills by @bearsyankees in https://github.com/usestrix/strix/pull/1139
* perf: take heavy imports off the startup path and pre-warm them in the background by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1141
* perf: bootstrap Caido concurrently with the scan start by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1143
* feat(agents): evidence discipline, and coverage as a first-class artifact by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/961
* Add MCP server support by @yoni-at-strix in https://github.com/usestrix/strix/pull/1137
* Treat literal 'null'/'none' strings as absent for optional tool args by @bearsyankees in https://github.com/usestrix/strix/pull/1164
* fix(update): re-exec runs the new binary after self-update (endless update-prompt loop) by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1168
* fix(tui): restore base foreground after ANSI resets by @bearsyankees in https://github.com/usestrix/strix/pull/1169
* Scope threat models to the current run instead of caching them on disk by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1178
* Reach MCP tools on demand instead of registering every one by @yoni-at-strix in https://github.com/usestrix/strix/pull/1175
* Isolate MCP connections per task and surface connection status in the UIs by @yoni-at-strix in https://github.com/usestrix/strix/pull/1181
* fix(llm): only attach prompt-cache points on routes LiteLLM serves by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1186
* fix(llm): bind dedupe credentials to a provider; send reasoning=max via extra_body by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1187
* fix(report): keep strix.report import-light so it never races the warm-up thread into the agents SDK graph by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1188
* Fix user message retry lifecycle and TUI sync by @0xallam in https://github.com/usestrix/strix/pull/1193
* csv injection hardening by @b

_[Truncated at 4000 characters — full notes: https://github.com/usestrix/strix/releases/tag/v1.6.0]_