v1.6.0

silvia-odwyer/photonv1.6.0Sep 1, 2026by github-actions[bot]

AI Summary

A major release introducing the Strix Cloud CLI, MCP server support, and a suite of new security skills and reporting enhancements.

Key Highlights

Introduced Strix Cloud CLI for managed platform operations
Implemented MCP server support with per-task isolation
Added new security skills including OWASP LLM Top 10, Azure/Entra, and browser/Electron skills
Enhanced reporting with contextual CVSS breakdowns

New Features

Strix Cloud CLI
MCP Server Support
OWASP LLM Top 10 2026 Skill Coverage
Azure and Entra Security Skill
Argument Injection Security Skill
Contextual CVSS breakdown on dependency reports
Evidence discipline and coverage as first-class artifacts

Full Release Notes

## What's Changed
* Fix LiteLLM cost model resolution by @bearsyankees in https://github.com/usestrix/strix/pull/1069
* feat: place caller-provided files into the sandbox workspace (`extra_files`, `--workspace-file`) by @yoni-at-strix in https://github.com/usestrix/strix/pull/1085
* feat(reporting): contextual CVSS breakdown on dependency reports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1091
* feat(reporting): require contextual CVSS and usage evidence on dependency reports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1092
* handle resume tokens gracefully by @bearsyankees in https://github.com/usestrix/strix/pull/1097
* Add OWASP LLM Top 10 2026 skill coverage by @bearsyankees in https://github.com/usestrix/strix/pull/1115
* Add Azure and Entra security skill by @bearsyankees in https://github.com/usestrix/strix/pull/1119
* Add argument injection security skill by @bearsyankees in https://github.com/usestrix/strix/pull/1120
* Add ecosystem supply-chain security skills by @bearsyankees in https://github.com/usestrix/strix/pull/1121
* Add Hurl and Hypothesis security playbooks by @bearsyankees in https://github.com/usestrix/strix/pull/1122
* Add semantic browser and Electron security skills by @bearsyankees in https://github.com/usestrix/strix/pull/1123
* Expose viewer host option by @kusonooyasumi in https://github.com/usestrix/strix/pull/1127
* Drop strict tool schemas on Claude routes by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1136
* fix(tui): preserve cost when state is truncated by @kusonooyasumi in https://github.com/usestrix/strix/pull/1086
* fix(tui): use single space after ordered-list marker by @OpenPay-App in https://github.com/usestrix/strix/pull/1043
* fix(report): raise RuntimeError on non-object run.json (fixes #1109) by @vardhans07 in https://github.com/usestrix/strix/pull/1116
* better skills by @bearsyankees in https://github.com/usestrix/strix/pull/1139
* perf: take heavy imports off the startup path and pre-warm them in the background by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1141
* perf: bootstrap Caido concurrently with the scan start by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1143
* feat(agents): evidence discipline, and coverage as a first-class artifact by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/961
* Add MCP server support by @yoni-at-strix in https://github.com/usestrix/strix/pull/1137
* Treat literal 'null'/'none' strings as absent for optional tool args by @bearsyankees in https://github.com/usestrix/strix/pull/1164
* fix(update): re-exec runs the new binary after self-update (endless update-prompt loop) by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1168
* fix(tui): restore base foreground after ANSI resets by @bearsyankees in https://github.com/usestrix/strix/pull/1169
* Scope threat models to the current run instead of caching them on disk by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1178
* Reach MCP tools on demand instead of registering every one by @yoni-at-strix in https://github.com/usestrix/strix/pull/1175
* Isolate MCP connections per task and surface connection status in the UIs by @yoni-at-strix in https://github.com/usestrix/strix/pull/1181
* fix(llm): only attach prompt-cache points on routes LiteLLM serves by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1186
* fix(llm): bind dedupe credentials to a provider; send reasoning=max via extra_body by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1187
* fix(report): keep strix.report import-light so it never races the warm-up thread into the agents SDK graph by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1188
* Fix user message retry lifecycle and TUI sync by @0xallam in https://github.com/usestrix/strix/pull/1193
* csv injection hardening by @bearsyankees in https://github.com/usestrix/strix/pull/1203
* fix(viewer): harden PDF report rendering by @kusonooyasumi in https://github.com/usestrix/strix/pull/1192
* fix(runtime): stage extra-file bind mounts where a remote docker daemon can see them by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1211
* Make MCP connections survive transient transport failures by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1184
* feat(cli): strix cloud — managed platform CLI (login, scans, billing, and the rest of the API) by @bearsyankees in https://github.com/usestrix/strix/pull/1177
* pentest skill cloud cli by @bearsyankees in https://github.com/usestrix/strix/pull/1220
* Forward the workspace header through cli by @bearsyankees in https://github.com/usestrix/strix/pull/1221
* report: add update_vulnerability_report so an agent can revise a filed finding by @bearsyankees in https://github.com/usestrix/strix/pull/1210
* chore: release v1.6.0 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1223

## New Contributors
* @OpenPay-App made their first contribution in https://github.com/usestrix/strix/pull/1043
* @vardhans07 made their first contribution in https://github.com/usestrix/strix/pull/1116

**Full Changelog**: https://github.com/usestrix/strix/compare/v1.5.3...v1.6.0