Full API Access

Programmatic Security Operations

XHack AI's full API access enables security teams to integrate AI-powered security operations into their existing workflows, automation pipelines, and custom tooling. Every capability available through the interactive CLI is also accessible programmatically, allowing organizations to build automated security workflows that run on schedule, on trigger, or as part of continuous integration processes.

The API supports multiple output formats including human-readable text, structured JSON, and streaming JSON, making it straightforward to integrate with any downstream system that consumes security data.

CI/CD Security Integration

Modern development teams deploy code multiple times per day. XHack AI integrates into CI/CD pipelines to provide automated security testing as part of every deployment. Configure your pipeline to run XHack AI against staging environments before production deployments, automatically blocking releases that introduce critical vulnerabilities.

xhack -p "Test the staging environment at staging.example.com for critical vulnerabilities" --output json --max-price 5.00

The structured JSON output can be parsed by pipeline scripts to make automated pass/fail decisions based on severity thresholds.

Custom Automation

Security teams frequently need to automate recurring tasks — weekly vulnerability scans, daily threat intelligence briefings, automated incident triage, or continuous compliance monitoring. XHack AI's programmatic mode makes these automations straightforward to build and maintain. Simply script the XHack AI CLI with the appropriate prompts and output handling.

Tool Control

The API provides fine-grained control over which tools XHack AI can use during programmatic operations. This allows organizations to define security policies about what the AI is permitted to do in automated contexts — for example, allowing reconnaissance tools but requiring manual approval for exploitation tools.

xhack -p "Enumerate services on target" --enabled-tools "bash*" --max-turns 10

Cost and Scope Controls

Programmatic operations include built-in controls to prevent runaway costs and scope violations. Set maximum dollar amounts per operation to cap API costs, and configure maximum turn limits to bound operation duration. These controls ensure that automated security operations remain within organizational budgets and operational boundaries.

Agent Configuration

For complex automated workflows, XHack AI supports custom agent configurations defined in TOML files. These configurations specify the AI's behavior, available tools, operating constraints, and default parameters for specific use cases. Organizations can create specialized agents for different security functions — a vulnerability scanner agent, a compliance checker agent, a threat hunter agent — each configured with appropriate capabilities and constraints.

Webhook and Event Integration

XHack AI's programmatic capabilities enable event-driven security operations. Configure webhooks to trigger security scans when new code is deployed, when new assets are discovered, when threat intelligence indicators are received, or when security alerts require automated investigation.

Multi-Format Output

The API supports three output formats to suit different integration needs. Text format provides human-readable output suitable for notifications and reports. JSON format provides structured data suitable for programmatic processing and database storage. Streaming JSON provides real-time output suitable for live dashboards and monitoring systems.