File size: 3,021 Bytes
7c2701e | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 | ---
license: mit
language:
- en
tags:
- penetration-testing
- autonomous-agent
- mcp
- kali-linux
- llm
- cybersecurity
- red-team
- ethical-hacking
- bug-bounty
- python
- flask
- bug-bounty,
- pentesting-tools,
- mcp,
- mcp-server,
- mcp-agent-loop,
- ethical-hacker,
- ethical-hacking-tools,
library_name: other
pipeline_tag: text-generation
base_model:
- Qwen/Qwen2.5-1.5B-Instruct-GGUF
---
# 🔐 PenMaster Security
**Autonomous AI-powered penetration testing agent — fully local, no cloud, no API keys.**
Built on Kali Linux with a local LLM (Qwen 2.5-14B via LM Studio) and a Flask-based MCP tool server. The agent runs recon, attacks, and generates professional pentest reports — all autonomously.
---
## What It Does
- 🔍 Autonomous recon — masscan + nmap to discover open ports and services
- ⚔️ Autonomous attack loop — selects and chains tools based on what it finds
- 🧠 Persistent negative experience cache — learns what fails across ALL sessions and never repeats mistakes
- 📝 Auto-generates branded HTML pentest reports on session end (Ctrl+C)
- 🔒 100% local — Qwen 2.5-14B running in LM Studio, nothing leaves your machine
---
## Tool Arsenal (18 Tools)
| Tool | Purpose |
|------|---------|
| `run_masscan` | Fast port discovery |
| `run_nmap` | Deep service/version scanning |
| `run_nikto` | Web vulnerability scanning |
| `run_sqlmap` | SQL injection testing |
| `run_hydra` | Credential brute forcing |
| `run_ncrack` | Network authentication cracking |
| `run_searchsploit` | CVE/exploit database lookup |
| `run_metasploit` | Exploit framework integration |
| `run_curl` | HTTP interaction and payload staging |
| `run_wget` | File retrieval and payload staging |
| `run_enum4linux` | SMB/Samba enumeration |
| `run_smbclient` | SMB share access and enumeration |
| `run_ftp` | FTP service interaction |
| `run_ssh` | SSH service interaction |
| `run_telnet` | Telnet service interaction |
| `run_wpscan` | WordPress vulnerability scanning |
| `run_dirb` | Web directory brute forcing |
| `run_set` | Social Engineering Toolkit |
---
## Sovereign Agent Upgrades
- ✅ Autonomous tool reasoning — agent selects tools based on discovered services
- ✅ Persistent negative experience cache — SHA-256 fingerprinting blacklists failing tool/parameter combos across sessions
- ✅ Social Engineering Toolkit (SET) integration
- ✅ Auto HTML pentest report generation
---
## Stack
- **Model:** Qwen 2.5-14B Instruct (abliterated) via LM Studio
- **OS:** Kali Linux
- **Server:** Flask MCP server (port 8000)
- **Agent:** Python autonomous loop
- **Reports:** Auto-generated HTML on exit
---
## Intended Use
Designed for:
- Professional penetration testing against **authorized targets only**
- Security audits for small businesses, WordPress sites, and ecommerce
- Bug bounty hunting workflows
- AI/security research and development
---
## GitHub
[XenoCoreGiger31/Local-Model](https://github.com/XenoCoreGiger31/Local-Model) |