v1.6.0

What's Changed

• Fix LiteLLM cost model resolution by @bearsyankees in #1069
• feat: place caller-provided files into the sandbox workspace (extra_files, --workspace-file) by @yoni-at-strix in #1085
• feat(reporting): contextual CVSS breakdown on dependency reports by @devin-ai-integration[bot] in #1091
• feat(reporting): require contextual CVSS and usage evidence on dependency reports by @devin-ai-integration[bot] in #1092
• handle resume tokens gracefully by @bearsyankees in #1097
• Add OWASP LLM Top 10 2026 skill coverage by @bearsyankees in #1115
• Add Azure and Entra security skill by @bearsyankees in #1119
• Add argument injection security skill by @bearsyankees in #1120
• Add ecosystem supply-chain security skills by @bearsyankees in #1121
• Add Hurl and Hypothesis security playbooks by @bearsyankees in #1122
• Add semantic browser and Electron security skills by @bearsyankees in #1123
• Expose viewer host option by @kusonooyasumi in #1127
• Drop strict tool schemas on Claude routes by @devin-ai-integration[bot] in #1136
• fix(tui): preserve cost when state is truncated by @kusonooyasumi in #1086
• fix(tui): use single space after ordered-list marker by @OpenPay-App in #1043
• fix(report): raise RuntimeError on non-object run.json (fixes #1109) by @vardhans07 in #1116
• better skills by @bearsyankees in #1139
• perf: take heavy imports off the startup path and pre-warm them in the background by @devin-ai-integration[bot] in #1141
• perf: bootstrap Caido concurrently with the scan start by @devin-ai-integration[bot] in #1143
• feat(agents): evidence discipline, and coverage as a first-class artifact by @devin-ai-integration[bot] in #961
• Add MCP server support by @yoni-at-strix in #1137
• Treat literal 'null'/'none' strings as absent for optional tool args by @bearsyankees in #1164
• fix(update): re-exec runs the new binary after self-update (endless update-prompt loop) by @devin-ai-integration[bot] in #1168
• fix(tui): restore base foreground after ANSI resets by @bearsyankees in #1169
• Scope threat models to the current run instead of caching them on disk by @devin-ai-integration[bot] in #1178
• Reach MCP tools on demand instead of registering every one by @yoni-at-strix in #1175
• Isolate MCP connections per task and surface connection status in the UIs by @yoni-at-strix in #1181
• fix(llm): only attach prompt-cache points on routes LiteLLM serves by @devin-ai-integration[bot] in #1186
• fix(llm): bind dedupe credentials to a provider; send reasoning=max via extra_body by @devin-ai-integration[bot] in #1187
• fix(report): keep strix.report import-light so it never races the warm-up thread into the agents SDK graph by @devin-ai-integration[bot] in #1188
• Fix user message retry lifecycle and TUI sync by @0xallam in #1193
• csv injection hardening by @bearsyankees in #1203
• fix(viewer): harden PDF report rendering by @kusonooyasumi in #1192
• fix(runtime): stage extra-file bind mounts where a remote docker daemon can see them by @devin-ai-integration[bot] in #1211
• Make MCP connections survive transient transport failures by @devin-ai-integration[bot] in #1184
• feat(cli): strix cloud — managed platform CLI (login, scans, billing, and the rest of the API) by @bearsyankees in #1177
• pentest skill cloud cli by @bearsyankees in #1220
• Forward the workspace header through cli by @bearsyankees in #1221
• report: add update_vulnerability_report so an agent can revise a filed finding by @bearsyankees in #1210
• chore: release v1.6.0 by @devin-ai-integration[bot] in #1223

New Contributors

• @OpenPay-App made their first contribution in #1043
• @vardhans07 made their first contribution in #1116

Full Changelog: v1.5.3...v1.6.0