Pentesting with an LLM reading over your shoulder

What it does

Nebula is a Python CLI application that sits alongside your terminal-based penetration testing tools. It feeds tool output to integrated large language models—running locally via Ollama or remotely through OpenAI—and returns context-aware suggestions. The interface also bundles automatic command logging, manual and AI-assisted note-taking, screenshot capture, and a status feed that refreshes every five minutes.

The interesting bit

Rather than replacing your existing toolkit, Nebula acts as an opinionated wrapper: it claims to support any tool invokable from the shell and pipes the results through models like Mistral or DeepSeek for real-time analysis. The result is essentially a chatbot that remembers what you ran and tries to tell you what to do next.

Key highlights

• Runs fully offline through Ollama (Llama, Mistral, DeepSeek) or via OpenAI API
• AI agent can perform real-time internet searches for current threat intel
• Captures and annotates screenshots inside the application for documentation
• Maintains a rolling activity log and categorized security findings automatically
• Requires at least 16 GB of RAM for local CPU inference

Caveats

• The Docker workflow relies on permissive local X11 access, an awkward security trade-off for a security-focused tool
• The README claims compatibility with any CLI-invokable tool but does not clarify how the AI handles arbitrary output formats

Verdict

Best suited for cybersecurity professionals and ethical hackers who want an interactive shell companion that logs activity and suggests next steps. If you already script your own post-processing and prefer deterministic tooling, this will feel like unnecessary glue.