Show HN: Nightcrawler – A local AI pentesting agent running on a smartphone

Nightcrawler An autonomous penetration testing agent that runs entirely on a smartphone. Drop the phone on a network, walk away, and it discovers hosts, maps services, finds vulnerabilities, and generates a pentest report — all without cloud connectivity. ░█▄░█ █ █▀▀ █░█ ▀█▀ █▀▀ █▀█ ▄▀█ █░█░█ █░░ █▀▀ █▀█ ░█░▀█ █ █▄█ █▀█ ░█░ █▄▄ █▀▄ █▀█ ▀▄▀▄▀ █▄▄ ██▄ █▀▄ v0.1.0 AUTONOMOUS MOBILE PENTEST AGENT OnePlus 8 · NetHunter · LFM2.5-1.2B · OpenCL GPU What is this? Penetration testing (pentesting) is the practice of testing a computer network's security by simulating an attack — with the network owner's explicit permission. Professional pentesters are hired to find vulnerabilities before real attackers do. Nightcrawler automates this process on a phone. It uses a small AI model (LFM2.5-1.2B-Instruct-Heretic, 1.2 billion parameters) running locally on the phone's GPU to decide what to do next — which host to probe, which tool to use, what to look for. No internet connection or cloud API required. Demo ▶️ Watch Nightcrawler in action on Instagram How it works WiFi Breach (optional) — If dropped without WiFi, it can autonomously crack WPA2 networks using an external USB WiFi adapter Reconnaissance — Discovers devices on the network using stealthy scans Enumeration — Probes discovered services (web servers, file shares, SSH, DNS, etc.) Exploitation — Tests for known vulnerabilities and default credentials Reporting — Generates a structured pentest report with findings and remediation advice The agent operates like a patient human pentester — it rotates across hosts, does one small action per turn, and builds knowledge gradually over hours. This makes it much harder to detect than traditional vulnerability scanners that blast every host at once. Key concepts Term What it means Drop box A device left on a target network to perform testing autonomously Scope The set of networks/hosts you're authorized to test Rules of Engagement (ROE) A legal document specifying what you're allowed to do Stealth Techniques to avoid detection by network monitoring (IDS/IPS) MCP Model Context Protocol — a standard interface for AI tool use C2 Command and Control — the web dashboard for monitoring and steering the agent Architecture ┌──────────────────────────────────────────────────────────┐ │ PHONE (OnePlus 8) │ │ │ │ ┌─────────────┐ ┌──────────────────┐ │ │ │ LFM2.5 │ │ Agent Loop │ │ │ │ 1.2B model │◄───►│ (main.py) │ │ │ │ on GPU │ │ Decides what │ │ │ │ (:8080) │ │ to do next │ │ │ └─────────────┘ └────────┬─────────┘ │ │ │ │ │ ┌────────▼─────────┐ │ │ │ Scope Proxy │ ← Safety layer │ │ │ Validates every │ Blocks out- │ │ │ command before │ of-scope │ │ │ execution │ actions │ │ └────────┬─────────┘ │ │ │ │ │ ┌────────▼─────────┐ │ │ │ Kali MCP Server │ ← Runs the │ │ │ nmap, curl, │ actual │ │ │ smbclient, ... │ commands │ │ └──────────────────┘ │ │ │ │ ┌──────────────────┐ ┌──────────────────┐ │ │ │ Web Dashboard │ │ SQLite DB │ │ │ │ (:8888) │ │ Hosts, vulns, │ │ │ │ Monitor & steer │ │ creds, commands │ │ │ └──────────────────┘ └──────────────────┘ │ └───────────────