An AI pentest assistant that never phones home

What it does

METATRON is a CLI-based penetration testing assistant that orchestrates standard reconnaissance tools—nmap, whois, whatweb, curl, dig, and nikto—against a target you provide, then feeds the raw output into a locally running fine-tuned Qwen model via Ollama. The AI analyzes the results for vulnerabilities, suggests exploits, recommends fixes, and stores everything in a structured MariaDB database with relational tables for scan history, vulnerabilities, fixes, and attempted exploits. It also exports PDF and HTML reports and can search DuckDuckGo for CVE lookups without requiring API keys.

The interesting bit

The README claims an “agentic loop” where the model can request additional tool runs mid-analysis, turning a static scan into an iterative back-and-forth between the LLM and the recon suite. Everything stays offline: the custom metatron-qwen model is derived from an abliterated Qwen 3.5 base, and scan data is stored in a normalized five-table MariaDB schema rather than dumped to flat files.

Key highlights

• Runs fully offline via Ollama using a custom metatron-qwen model fine-tuned for pentest analysis
• Orchestrates real tools (nmap, nikto, whatweb, etc.) instead of simulating reconnaissance
• Maintains structured scan history across five linked MariaDB tables with full CRUD from the CLI
• Generates PDF and HTML vulnerability reports from historical scan data
• DuckDuckGo web search and CVE lookup without paid API keys

Caveats

• The README demonstrates database setup with the hardcoded password '123', which is an eyebrow-raising default for a security project
• You must keep two terminal tabs open—one for the Ollama model and one for the METATRON CLI
• The default 9B model requires roughly 8.4 GB of RAM, and the documentation targets Parrot OS specifically

Verdict

A solid experiment for penetration testers and security students who want AI-assisted analysis without cloud dependencies or subscription fees. Pass if you need a polished, cross-platform SaaS experience or if your hardware cannot spare the memory for a local LLM.