HALO (GEMMA-by-GOOGLE)

A fully local, autonomous AI penetration-testing agent — Gemma 4-12B driving a 42-tool arsenal through recon, attack, and reporting, exposed as a standard Model Context Protocol (MCP) server. No cloud, no API keys.

HALO is an autonomous security agent that runs inside a Linux environment driven by a local LLM —Gemma 4-12B(uncensored / abliterated) served through LM Studio. It plans, runs reconnaissance, chains attacks based on what it finds, and writes a professional pentest report on its own. Everything runs locally: no cloud, no API keys, nothing leaves your machine.

- 🔍Autonomous recon— masscan + nmap to discover open ports and services
- ⚔️Autonomous attack loop— selects and chains tools based on what it finds
- 🌐Web recon → attack pipeline— apex-to-URL enumeration (subdomains, hosts, historical URLs), content discovery, template scanning and XSS, with automaticflag captureon CTF-style web targets
- ✅Verified breaches, not banners— every attempt carries a single-use challenge/nonce the exploit must echofrom inside the popped shell; a bareuid=0banner or a tarpit can't forge it, so a confirmed breach is a real one (execution-derived evidence, consume-once at the gate)
- 🎯Curated PoC library— deterministic, self-evident exploits (vsftpd 2.3.4, ingreslock, UnrealIRCd) fired through a sandboxed delivery primitive that returns a real shell, not a guess
- 🧠Persistent negative-experience cache— learns what fails acrossallsessions and stops wasting cycles on proven dead ends
- 🧩Adaptive skill injection— loads relevant attack playbooks into the prompt based on the current goal
- 📝Automatic HTML reports— compiles findings into a branded report on exit
- 🔒100% local— Gemma 4-12B in LM Studio; nothing leaves your machine

42 tools sit behind the agent's decision loop, all routed through the same failure-caching layer. They are defined once in theTOOLSschema registry inhalo_tools.pyand served over both transports (MCP and HTTP).

A single tool engine (halo_tools.py) owns the arsenal and its schemas; two thin transports sit on top of it, so the tools are defined exactly once:

agent_loop.py ──HTTP─► tool_server.py ─┐ ├─► halo_tools.py ──► security tools MCP clients ──stdio► mcp_server.py ──┘ (42-tool engine + schema registry) │ ├─► agent_cache.py (persistent negative-experience cache) ├─► skills.py (adaptive playbook injection) └─► report_generator.py (auto HTML pentest report on exit)

- mcp_server.py— a spec-compliantModel Context Protocolserver (stdio, JSON-RPC 2.0). Point any MCP client (Claude Desktop, IDE agents, inspectors) or an MCP registry at it to use HALO's arsenal as standard tools.
- tool_server.py— the local Flask HTTP tool server (port 8000) the autonomous agent loop drives.

Engagements are coordinated by a set of specialist agents that pass a shared message schema (agent_schema.py):

The negative-experience cache fingerprints every tool call. A call that fails gets one retry; fail twice and it is blacklisted, so the agent moves on to a more practical tool for the job. Over an engagement the agent structures its own trial-and-error learning — building context, avoiding repeated dead ends, and escalating intelligently — rather than re-running what it has already proven doesn't work.

The hard problem with an autonomous attacker is knowing whether itactuallybroke in or just parroted a hopeful banner. HALO answers this with a challenge-response gate:

- The orchestratormints a per-attempt nonce, bound to that target and the exact payload hash, before firing.
- A breach only counts if the tool output carries a structuredHALO-EVIDENCE nonce=… level=…line echoingthatnonce — which the delivery primitive (pocs/_delivery.py) can only produce by running codeinsidethe shell it claims to have.
- The nonce isconsume-once: the gate (exploitation_core.py:breach_confirmed) rejects a replayed or never-minted nonce, so a tarpit, a reflected string, or a staticuid=0banner cannot forge a confirmation.

HALO was built solo, from the ground up, in under six months by a self-taught developer and security researcher. The multi-agent core came together one specialist at a time, each verified against a real target before moving on:

- Shared language:a common message schema (agent_schema.py) so the agents can talk to each other
- Planner:turns a goal into an ordered plan, verified against live LM Studio
- Orchestrator:routes each task to the right specialist
- Vuln Discovery:surfaces candidate vulnerabilities, tested against a live Metasploitable target
- Attacker:branches into SQLi / brute-force / IDOR / SSRF / XSS / auth specialists
- Debugger:diagnoses failed tool runs and adjusts
- Validator + reporting:findings are confirmed against real evidence before they count, then compiled into a client-readable report

- Model: Gemma 4-12B Instruct Abliterated (GGUF via LM Studio) — works with any local model of your choosing
- Agent: Python autonomous loop with MCP tool calls
- Tool transports: a Model Context Protocol server (stdio) for MCP clients, plus a Flask HTTP tool server on port 8000 for the agent loop
- OS: Kali Linux (tested under UTM on Apple Silicon M1)
- Hardware reference: MacBook Pro M1, 16 GB RAM

git clone https://github.com/XenoCoreGiger31/GEMMA-by-GOOGLE.git cd GEMMA-by-GOOGLE python3 -m pip install -r requirements.txt cp engagement.example.yaml engagement.yaml # then fill in authorization + scope_targets python3 tool_server.py # terminal 1 — HTTP tool server on port 8000 python3 agent_loop.py # terminal 2 — the agent >>> engage 203.0.113.3 # full autonomous recon + attack >>> run nmap on 10.0.0.1 # single-goal query >>> exit # triggers HTML report generation

The unit tests use Python's built-inunittest— no extra dependencies:

Actively developed by an independent, self-taught developer and security researcher. New capabilities are pushed regularly.

This is a community project by an independent developer. It isnot affiliated with, endorsed by, or sponsored by Google LLC."Gemma" is a trademark of Google LLC.

⚠️Content warning:The referenced model is heavily abliterated and will respond to sensitive requests without the usual guardrails. Use responsibly, in appropriate environments only.

🔒Legal warning:This tool is intended strictly for authorized penetration testing and security research on systems you own or haveexplicit written permissionto test. Unauthorized use is illegal.

Transaction-complete hotel booking over MCP — 300K+ properties, real hotel confirmation numbers, loyalty points, secure checkout. Hotels are merchant of record. Builders set their own booking fee via Stripe Connect. Built on proven distribution infrastructure.

An MCP server for AI video generation. MCP server for AI video generation. Lets Claude, ChatGPT, OpenClaw , Hermes & other agents create AI videos and publish them to YouTube, TikTok, Instagram etc..

Institutional research and manager diligence reports on hedge funds, venture capital and private equity managers. Summary of filings, personnel changes, media screening and social signals delivered to you in minutes.

ALTER - identity infrastructure for the AI economy

D2C eCommerce fulfillment platform: manage orders, inventory, shipments, campaigns, and billing via AI agents

Apigene MCP Gateway is the runtime layer that connects AI agents to APIs and MCP servers via Model Context Protocol.

MCP to interface with multiple blockchains, staking, DeFi, swap, bridging, wallet management, DCA, Limit Orders, Coin Lookup, Tracking and more.

MCP server for Bitnovo Pay integration with AI agents. Provides cryptocurrency payment capabilities through Bitnovo Pay API. Features include payment creation, status checking, QR code generation, and webhook management with support for multiple tunnel providers (ngrok, zrok, manual).

Shop for gift cards, esims, phone topups. Pay with cards and crypto.