# Nightcrawler

> An autonomous penetration testing agent that runs entirely on a smartphone, discovering hosts, mapping services, finding vulnerabilities, and generating a pentest report without cloud connectivity.

Nightcrawler is an autonomous penetration testing agent that runs entirely on an Android smartphone, tested on a OnePlus 8 running Kali NetHunter. Built by garagehq, it uses a small locally-running AI model on the phone's GPU to decide which hosts to probe, which tools to run, and which vulnerabilities to pursue, with no internet connection or cloud API involved.

## What It Is

Nightcrawler is a drop-box pentesting agent: you place the phone on a target network, walk away, and it performs reconnaissance, enumeration, exploitation, and report generation over hours or days. It is intended only for authorized engagements where the tester has written permission (Rules of Engagement) from the network owner, and it ships with a scope-enforcement layer that blocks out-of-scope actions. The project is open source, written in Python, and released under the MIT license.

## How It Thinks

The agent runs a continuous decision loop on the phone. A 1.2-billion-parameter local model (LFM2.5-1.2B) runs via llama.cpp on the Adreno 650 GPU using OpenCL, a scope proxy validates every command before it executes, and a Kali MCP server runs the actual network commands such as nmap, curl, and smbclient. Discovered hosts, services, and findings are stored in a local SQLite database. The loop picks a target using weighted selection, builds context from host memory, queries the model, validates the proposed command, runs it, parses the output, then resets its conversation context while keeping persistent memory before repeating.

## Key Capabilities

According to the project's README, Nightcrawler runs fully autonomously with no human in the loop during a run, using self-healing watchdogs for garbage, duplicate, and stuck detection. Inference is fully local, so no cloud connectivity is required. It ships with 27 multi-step exploit playbooks that run automatically for reliability, a 24,956-entry CVE database for version-aware vulnerability matching, and an offline WiFi breach mode that performs WPA2 cracking with an external USB adapter. A stealth-first design uses slow scan rates, host rotation, cover traffic, and passive mDNS, NBNS, DHCP, and ARP capture, and a downloadable report summarizes findings, exploit chains, and remediation advice.

## Hardware and Performance

The README states the project requires an Android phone with Kali NetHunter and root access via Magisk, with at least 12GB of RAM, and that it has been tested on a OnePlus 8 with a Snapdragon 865. An optional USB WiFi adapter enables the offline breach mode. Because Android throttles GPU performance on battery power, up to a sixfold slowdown, Nightcrawler includes a GPU governor daemon that forces maximum performance and auto-throttles at low battery.

## Current Status

The project is at v0.1.0. The README reports results from more than 72 hours of autonomous operation across multiple networks, and the author is seeking contributions in model fine-tuning, new playbooks, CVE database expansion, and adapter support. A web dashboard provides real-time monitoring, clickable host cards, a network map, and command-and-control over a Tailscale network.

## Features
- Fully autonomous penetration testing agent
- Fully local AI inference on phone GPU (no cloud required)
- 27 multi-step exploit playbooks
- 24,956-entry CVE database with version-aware matching
- WiFi breach mode (autonomous WPA2 cracking)
- Stealth-first scanning (slow scan rates, host rotation, cover traffic)
- Passive discovery via mDNS, NBNS, DHCP, and ARP capture
- Web dashboard with real-time monitoring and C2 controls
- Scope enforcement proxy (two-layer safety)
- Structured pentest report generation
- Self-healing watchdogs (garbage detection, stuck detection)
- Training capture for future model fine-tuning
- Multi-network support with MAC-keyed host isolation
- Dry-run mode for testing without real commands
- GPU governor daemon for sustained performance on battery

## Integrations
Kali NetHunter, llama.cpp, LFM2.5-1.2B-Instruct-Heretic, OpenCL (Adreno GPU), nmap, smbclient, curl, Magisk, Tailscale, Model Context Protocol (MCP), SQLite, Flask, Pwnagotchi (WiFi breach inspiration), NVIDIA AGX (optional remote model offload)

## Platforms
ANDROID, WEB

## Pricing
Open Source

## Version
v0.1.0

## Links
- Website: https://github.com/garagehq/nightcrawler
- Documentation: https://github.com/garagehq/nightcrawler/blob/main/docs/ARCHITECTURE.md
- Repository: https://github.com/garagehq/nightcrawler
- EveryDev.ai: https://www.everydev.ai/tools/nightcrawler-pentest-agent