{"id":11886,"date":"2026-04-06T10:03:38","date_gmt":"2026-04-06T10:03:38","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/04\/06\/metatron-open-source-ai-penetration-testing-assistant-brings-local-llm-analysis-to-linux\/"},"modified":"2026-04-06T10:03:38","modified_gmt":"2026-04-06T10:03:38","slug":"metatron-open-source-ai-penetration-testing-assistant-brings-local-llm-analysis-to-linux","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/04\/06\/metatron-open-source-ai-penetration-testing-assistant-brings-local-llm-analysis-to-linux\/","title":{"rendered":"METATRON \u2013 Open-Source AI Penetration Testing Assistant Brings Local LLM Analysis to Linux"},"content":{"rendered":"

METATRON \u2013 Open-Source AI Penetration Testing Assistant Brings Local LLM Analysis to Linux
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A new open-source penetration testing framework called METATRON is gaining attention in the security research community for its fully offline, AI-driven approach to vulnerability assessment.<\/p>\n

Built for Parrot OS and other Debian-based Linux distributions, METATRON combines automated reconnaissance tooling with a locally hosted large language model (LLM), eliminating the need for cloud connectivity, API keys, or third-party subscriptions.<\/p>\n

METATRON is a CLI-based penetration testing assistant written in Python 3 that accepts a target IP address or domain and autonomously orchestrates a suite of standard reconnaissance tools.<\/p>\n

These include nmap for port scanning, nikto for web server vulnerability detection<\/a>, whois and dig for DNS and registration data, whatweb for technology fingerprinting, and curl for HTTP header inspection.<\/p>\n

\"\"
Tool Scan Process<\/figcaption><\/figure>\n

Once recon data is collected, all results are piped directly into a locally running AI model \u2014 metatron-qwen \u2014 a fine-tuned variant of the huihui_ai\/qwen3.5-abliterated:9b<\/code> base model, customized specifically for penetration testing analysis<\/a>.<\/p>\n

The model is served via Ollama, a local LLM runner, and is configured with a 16,384-token context window, a temperature of 0.7, top-k of 10, and top-p of 0.9 \u2014 parameters optimized for precise, technically grounded security analysis rather than creative generation.<\/p>\n

\"\"
Scan Using nmap and other tools<\/figcaption><\/figure>\n

Agentic Loop and CVE Integration<\/strong><\/h2>\n

One of METATRON\u2019s more technically notable features is its agentic loop: the AI model can autonomously request additional tool executions mid-analysis if it determines more data is needed before rendering a verdict. This enables a dynamic, iterative assessment workflow rather than a single static scan pass.<\/p>\n

The framework also integrates DuckDuckGo-based web search and CVE lookups without requiring any API credentials, allowing the model to cross-reference discovered services and versions against known public vulnerability databases in real time.<\/p>\n

\"\"
Web Search and CVE Lookup<\/figcaption><\/figure>\n

METATRON uses a five-table MariaDB schema to persist all scan data, structured around a central history<\/code> table keyed by session number (sl_no<\/code>). Linked tables store discovered vulnerabilities with severity ratings, recommended fixes sourced from AI analysis, attempted exploits with payloads and results, and a full summary table containing raw scan output alongside the complete AI analysis dump and overall risk level.<\/p>\n

Users can edit or delete any saved record directly from the CLI, and export reports in PDF or HTML format for documentation or client delivery \u2014 a critical feature for professional penetration testers who need audit trails.<\/p>\n

The project\u2019s most significant differentiator in the current AI tooling landscape is its zero-exfiltration guarantee. All LLM inference happens on-device through Ollama, meaning sensitive target data, including internal IP ranges, banner information, and discovered vulnerabilities, never leaves the tester\u2019s machine. This positions METATRON as a viable option for engagements with strict data handling requirements.<\/p>\n

METATRON is available on GitHub under the MIT License at github.com\/sooryathejas\/METATRON<\/a>, with minimum hardware requirements of 8.4 GB RAM for the 9b model variant.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post METATRON \u2013 Open-Source AI Penetration Testing Assistant Brings Local LLM Analysis to Linux<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

METATRON \u2013 Open-Source AI Penetration Testing Assistant Brings Local LLM Analysis to Linux A new open-source penetration testing framework called METATRON is gaining attention in the security research community for its fully offline, AI-driven approach to vulnerability assessment. Built for Parrot OS and other Debian-based Linux distributions, METATRON combines automated reconnaissance tooling with a locally […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,1709],"tags":[130],"class_list":["post-11886","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-cyberpedia","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11886"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=11886"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11886\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=11886"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=11886"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=11886"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}