Agentic AI & MCP-Based Offensive Security Recon Pipeline

Internet → Perimeter (firewall, WAF) → Application → Authentication → Data

Domain Input
    │
    ├──▶ crt.sh + Subfinder + Amass ──▶ Subdomain list
    │         │
    │         ▼
    │    DNSx + SecurityTrails ──▶ Historical DNS + IPs
    │         │
    │         ▼
    │    Shodan + Censys + FOFA ──▶ Exposed services per IP
    │         │
    │         ▼
    │    VirusTotal + OTX ──▶ Reputation + passive DNS pivot
    │         │
    │         ▼
    │    URLScan + Waybackurls ──▶ Historical endpoints + params
    │         │
    │         ▼
    │    GitDorker + TruffleHog ──▶ Leaked secrets in code
    │         │
    │         ▼
    │    TheHarvester + CrossLinked ──▶ Employees + emails
    │         │
    │         ▼
    └──▶ MISP / OpenCTI ──▶ Correlate all IOCs into intel report

Old way:     Subfinder → manually review → Nuclei → review again

Agentic way: AI receives target → autonomously chains recon →
             enumeration → validation → report generation,
             making decisions at each step

┌─────────────────────────────────────────────┐
│              AI Agent (LLM Brain)            │
└──────────────────┬──────────────────────────┘
                   │ MCP Protocol
        ┌──────────┼──────────┐
        ▼          ▼          ▼
   [Tool Server] [Data MCP] [API MCP]
   nmap, nuclei  Shodan DB  VirusTotal
   subfinder     MISP feed  SecurityTrails

Target Input
    │
    ▼
[Recon Agent] ──▶ [Enum Agent] ──▶ [Analysis Agent] ──▶ [Report Agent]

        ┌──────────────────────────┐
        │      THINK               │
        │  "I found port 443 open" │
        └────────────┬─────────────┘
                     │
        ┌────────────▼─────────────┐
        │      ACT                 │
        │  Run TLS check on 443    │
        └────────────┬─────────────┘
                     │
        ┌────────────▼─────────────┐
        │      OBSERVE             │
        │  TLS 1.0 detected!       │
        └────────────┬─────────────┘
                     │
        ┌────────────▼─────────────┐
        │      THINK AGAIN         │
        │  Check cipher suites     │
        └──────────────────────────┘

                [Orchestrator Agent]
                        │
          ┌─────────────┼─────────────┐
          ▼             ▼             ▼
    [Recon Agent] [WebApp Agent] [Network Agent]
          │             │             │
          └─────────────┼─────────────┘
                        ▼
                [Correlation Agent]
                        │
                        ▼
                [Report Agent]

┌─────────────────────────────────────────────────────────┐
│                   Security MCP Servers                   │
├──────────────┬──────────────┬──────────────┬────────────┤
│  Recon MCP   │  Intel MCP   │  Scan MCP    │ Report MCP │
│              │              │              │            │
│ • Subfinder  │ • MISP API   │ • Nuclei     │ • Markdown │
│ • Amass      │ • OTX API    │ • Trivy      │ • PDF gen  │
│ • crt.sh     │ • VT API     │ • Semgrep    │ • Jira     │
│ • Shodan     │ • AbuseIPDB  │ • Grype      │ • Splunk   │
│ • SecurityT  │ • ThreatFox  │ • Gitleaks   │ • TheHive  │
└──────────────┴──────────────┴──────────────┴────────────┘
                          │
                          ▼
              ┌───────────────────────┐
              │   Orchestrator Agent  │
              │   (Claude / GPT-4o)   │
              │                       │
              │  • Plans recon steps  │
              │  • Interprets output  │
              │  • Decides next tool  │
              │  • Writes findings    │
              │  • Flags critical     │
              └───────────────────────┘

2023 ──▶ LLM assists human analysts (copilot)
2024 ──▶ LLM executes single tasks autonomously (tool use)
2025 ──▶ Multi-agent swarms handle full recon-to-report (agentic)
2026 ──▶ Continuous autonomous red team vs blue team agents
Future ▶ Self-healing infrastructure via agentic remediation

nmap outputs XML/text ──▶ Nuclei needs host:port
                     ──▶ Shodan needs IP only
                     ──▶ Metasploit needs IP + port + service
                     ──▶ TheHive needs structured JSON alert
                     ──▶ Nikto needs URL with protocol

nmap -oX scan.xml
        │
        ▼
  NmapParser.parse()
        │
        ├──▶ HostResult objects (typed, normalized)
        │         │
        │    ┌────┴─────────────────────────────────┐
        │    │         ToolFormatters                │
        │    │                                       │
        │    ├── to_nuclei_targets()  → URL list     │
        │    ├── to_nikto_targets()   → host+port    │
        │    ├── to_shodan_ips()      → IP list      │
        │    ├── to_msf_targets()     → rhost/rport  │
        │    ├── to_thehive_alert()   → JSON alert   │
        │    ├── to_cpe_list()        → CPE strings  │
        │    └── to_searchsploit()    → query string │
        │                                            │
        └────────────────────────────────────────────┘
                          │
                          ▼
              Agent reasons → selects tools
                          │
                          ▼
              Tools execute with correct input
                          │
                          ▼
              Results accumulate in agent memory
                          │
                          ▼
              Final normalized report → TheHive/MISP

┌─────────────────────────────────────────────────────────────────┐
│  MODEL              │ STRENGTHS            │ SECURITY CONCERNS  │
├─────────────────────┼──────────────────────┼────────────────────┤
│  Claude 3.5/3.7     │ Long context         │ Data sent to       │
│  Sonnet/Opus        │ Strong reasoning     │ Anthropic servers  │
│                     │ Tool use reliable    │ Logs retained      │
│                     │ Low hallucination    │ API key exposure   │
├─────────────────────┼──────────────────────┼────────────────────┤
│  GPT-4o             │ Fast inference       │ Microsoft/OpenAI   │
│  o1 / o3            │ Strong tool calling  │ data retention     │
│                     │ Vision capable       │ Training opt-out   │
│                     │ Structured outputs   │ needed explicitly  │
├─────────────────────┼──────────────────────┼────────────────────┤
│  Gemini 1.5 Pro     │ 1M token context     │ Google data        │
│  Gemini 2.0         │ Multimodal           │ residency concerns │
│                     │ Code execution       │                    │
└─────────────────────┴──────────────────────┴────────────────────┘

┌─────────────────────────────────────────────────────────────────┐
│  MODEL              │ STRENGTHS            │ USE CASE           │
├─────────────────────┼──────────────────────┼────────────────────┤
│  Llama 3.1/3.3 70B  │ Fully local          │ Internal tool use  │
│  (Meta, OSS)        │ No data leaves org   │ Sensitive infra    │
│                     │ Fine-tuneable        │ Air-gapped SOC     │
├─────────────────────┼──────────────────────┼────────────────────┤
│  Mistral Large      │ Strong reasoning     │ EU data residency  │
│  Mixtral 8x22B      │ Self-hostable        │ Compliance-heavy   │
│                     │ Fast MoE arch        │ environments       │
├─────────────────────┼──────────────────────┼────────────────────┤
│  DeepSeek R1        │ Strong reasoning     │ Caution: Chinese   │
│                     │ Cheap to run         │ origin, telemetry  │
│                     │ Open weights         │ concerns flagged   │
├─────────────────────┼──────────────────────┼────────────────────┤
│  Falcon 40B/180B    │ UAE-origin OSS       │ Sovereign AI use   │
│  (TII)              │ Fully open           │ cases              │
├─────────────────────┼──────────────────────┼────────────────────┤
│  Phi-3 / Phi-4      │ Small, fast, local   │ Edge agents        │
│  (Microsoft OSS)    │ Surprisingly capable │ Lightweight tasks  │
└─────────────────────┴──────────────────────┴────────────────────┘

┌─────────────────────────────────────────────────────────────────┐
│  MODEL              │ BUILT FOR            │ STATUS             │
├─────────────────────┼──────────────────────┼────────────────────┤
│  Google SecLM       │ Security reasoning   │ Limited access     │
│                     │ Threat intel         │ Enterprise only    │
├─────────────────────┼──────────────────────┼────────────────────┤
│  Vulnhuntr Model    │ Zero-day discovery   │ Open source        │
│  (ProtectAI)        │ Code analysis        │ Claude-backed      │
├─────────────────────┼──────────────────────┼────────────────────┤
│  HackingBuddyGPT    │ Privilege escalation │ Research tool      │
│                     │ research             │ GPT-4 backed       │
└─────────────────────┴──────────────────────┴────────────────────┘

┌─────────────────────────────────────────────────────────┐
│              MODEL SAFETY FILTER LOGIC                   │
│                                                          │
│  Input Prompt                                            │
│       │                                                  │
│       ▼                                                  │
│  ┌─────────────────────┐                                │
│  │  Intent Classifier  │ ◀── Trained on harmful         │
│  │                     │     intent patterns            │
│  └────────┬────────────┘                                │
│           │                                              │
│     ┌─────┴──────┐                                      │
│     ▼            ▼                                       │
│  BENIGN       AMBIGUOUS ──▶ Context Analyzer            │
│     │            │               │                       │
│     │            ▼               ▼                       │
│     │        FLAGGED ──▶  Hard Refusal                  │
│     │        UNCLEAR ──▶  Soft Refusal / Watered down   │
│     ▼                                                    │
│  PROCEED                                                 │
└─────────────────────────────────────────────────────────┘

HIGH RISK TRIGGERS (almost always blocked)
├── "exploit", "payload", "shellcode", "reverse shell"
├── "bypass authentication", "privilege escalation"
├── "exfiltrate data", "extract credentials"
├── Specific CVE numbers + "how to exploit"
└── Tool names in offensive context (Metasploit + attack intent)

MEDIUM RISK TRIGGERS (context-dependent)
├── "nmap scan" + target (flagged if target looks external/public)
├── "password cracking" without defensive framing
├── "port scan" on IP ranges
├── "vulnerability assessment" without authorization context
└── Combining recon + exploitation terminology

LOW RISK / USUALLY PASSES
├── "vulnerability assessment" with org context
├── "authorized penetration test"
├── "security audit", "hardening", "compliance check"
├── Defensive tool discussion without live execution
└── Abstract architecture and logic discussion

┌────────────────────────────────────────────────────┐
│  WHAT GETS SENT TO CLOUD LLM API                   │
│                                                     │
│  ❌ Raw nmap output  → exposes internal IPs        │
│  ❌ Service banners  → exposes software versions   │
│  ❌ Hostnames        → exposes internal naming     │
│  ❌ CVE findings     → exposes vulnerability data  │
│  ❌ Credentials      → catastrophic if logged      │
│  ❌ Network topology → exposes architecture        │
└────────────────────────────────────────────────────┘

RAW SCAN DATA
      │
      ▼
┌─────────────────────────────────────────────────────┐
│              SANITIZATION PIPELINE                   │
│                                                      │
│  STEP 1 — TOKENIZATION                              │
│  192.168.1.45  ──▶  HOST_A                         │
│  10.0.0.100    ──▶  HOST_B                         │
│  db-prod-01    ──▶  HOSTNAME_1                      │
│  api-internal  ──▶  HOSTNAME_2                      │
│                                                      │
│  STEP 2 — SENSITIVITY CLASSIFICATION               │
│  [PUBLIC]   service name, port number, protocol     │
│  [INTERNAL] IP, hostname, MAC, OS fingerprint       │
│  [CRITICAL] credentials, keys, tokens              │
│                                                      │
│  STEP 3 — SELECTIVE STRIPPING                       │
│  Send to LLM:   [PUBLIC] fields only                │
│  Keep local:    [INTERNAL] + [CRITICAL] fields      │
│                                                      │
│  STEP 4 — CORRELATION MAP (local only)             │
│  HOST_A = 192.168.1.45  (never leaves environment) │
│  HOST_B = 10.0.0.100    (never leaves environment) │
│                                                      │
│  STEP 5 — DE-TOKENIZATION after LLM response       │
│  LLM says: "HOST_A has critical vuln on port 443"  │
│  Agent maps back: 192.168.1.45:443                 │
└─────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────┐
│                   HYBRID ARCHITECTURE                     │
│                                                          │
│  SENSITIVE DATA PATH          PUBLIC DATA PATH           │
│                                                          │
│  Raw Scan Results             Service Names              │
│       │                       Port Numbers               │
│       ▼                            │                     │
│  Local LLM                         ▼                     │
│  (Llama 70B)                  Cloud LLM                  │
│  Air-gapped                   (Claude/GPT)               │
│       │                            │                     │
│       └──────────┬─────────────────┘                    │
│                  ▼                                       │
│           Merged Results                                 │
│           (local only)                                   │
└──────────────────────────────────────────────────────────┘

PRINCIPLE: LLM only ever sees what it NEEDS to reason about

Task: "Analyze this service for vulnerabilities"
                │
                ▼
What LLM receives:
├── Service: Apache HTTP Server
├── Version: 2.4.49
├── Port: 443
└── OS family: Linux

What LLM NEVER receives:
├── IP address
├── Hostname
├── Organization name
├── Internal network range
└── Any credential material

CORPORATE NETWORK BOUNDARY
┌──────────────────────────────────────────────────────┐
│                                                      │
│   Security Agent                                     │
│        │                                             │
│        ▼                                             │
│   Local Ollama / vLLM / TGI Server                  │
│   Running Llama 3.1 70B / Mistral Large             │
│        │                                             │
│        ▼                                             │
│   All data stays inside perimeter                   │
│   No API calls leave the network                    │
│   Full audit log of every prompt/response           │
│                                                      │
└──────────────────────────────────────────────────────┘
         ❌ NO OUTBOUND DATA TO CLOUD APIs

START: What data will the agent process?
              │
     ┌────────┴────────┐
     ▼                 ▼
SENSITIVE           PUBLIC/GENERIC
(IPs, hostnames,    (service names,
credentials, PII)   CVE IDs, ports)
     │                 │
     ▼                 ▼
Self-hosted LLM    Cloud LLM OK
(Llama/Mistral)    (Claude/GPT-4o)
     │                 │
     ▼                 ▼
Is air-gap         Is latency
required?          critical?
     │                 │
   Yes/No           Yes/No
     │                 │
     ▼                 ▼
Offline Ollama    GPT-4o-mini /
+ local inference  Claude Haiku

┌──────────────────┬────────┬────────┬────────┬────────┐
│ Requirement      │ Claude │ GPT-4o │ Llama  │Mistral │
│                  │ API    │ API    │ Local  │ Local  │
├──────────────────┼────────┼────────┼────────┼────────┤
│ SOC 2 Type II    │  ✅    │  ✅    │  ✅    │  ✅    │
│ ISO 27001        │  ✅    │  ✅    │  ✅    │  ✅    │
│ GDPR             │ ⚠️ DPA │ ⚠️ DPA │  ✅    │  ✅    │
│ HIPAA            │ ⚠️ BAA │ ⚠️ BAA │  ✅    │  ✅    │
│ Air-gap required │  ❌    │  ❌    │  ✅    │  ✅    │
│ Data residency   │ ⚠️     │ ⚠️     │  ✅    │  ✅    │
│ No training use  │ ⚠️ opt │ ⚠️ opt │  ✅    │  ✅    │
│ FedRAMP          │  ❌    │  ✅    │  ✅    │  ❌    │
└──────────────────┴────────┴────────┴────────┴────────┘

┌─────────────────────────────────────────────────────────┐
│                GOLDEN RULES                              │
│                                                          │
│  1. Sensitive data + Cloud LLM = Architecture failure   │
│                                                          │
│  2. Sanitize → Send → Correlate → De-tokenize           │
│                                                          │
│  3. Model flags = signal, not blocker                   │
│     Engineer your prompts and context to be             │
│     unambiguously defensive in framing                  │
│                                                          │
│  4. Self-hosted models for internal infra always        │
│                                                          │
│  5. Cloud LLMs only for generic reasoning tasks         │
│     that contain zero org-specific context              │
│                                                          │
│  6. Every prompt + response = audit log entry           │
└─────────────────────────────────────────────────────────┘

Llama 3.1 70B    ──▶  ~40GB  (Q4 quantized)
Llama 3.1 70B    ──▶  ~140GB (full precision)
Mistral Large    ──▶  ~24GB  (Q4 quantized)
Mixtral 8x22B    ──▶  ~80GB  (Q4 quantized)
─────────────────────────────────────────────
Internal SSD     ──▶  often 256GB-512GB total
OS + Tools       ──▶  already consuming 100GB+
─────────────────────────────────────────────
External SSD     ──▶  SOLUTION ✅

DEFAULT PATH                    EXTERNAL PATH
~/.ollama/models/               /external-ssd/ollama/models/
      │                                    │
      │    Override via                    │
      └──── OLLAMA_MODELS ───────────────▶│
            environment var               │
                                          ▼
                                   Model loads from
                                   external SSD path

Environment Variable Approach:
─────────────────────────────
OLLAMA_MODELS = /path/to/external-ssd/ollama/models

This single variable redirects:
├── Model downloads      ──▶ external SSD
├── Model storage        ──▶ external SSD
├── Cache files          ──▶ external SSD
└── Blob storage         ──▶ external SSD

Internal disk usage:
├── Ollama binary        ──▶ stays internal (~50MB)
├── Config files         ──▶ stays internal (~1MB)
└── Runtime logs         ──▶ stays internal

LINUX
─────
Set in:  /etc/systemd/system/ollama.service
         ~/.bashrc or ~/.zshrc
         /etc/environment (system-wide)

MACOS
─────
Set in:  ~/Library/LaunchAgents/ollama.plist
         ~/.zshrc
         launchctl setenv (runtime)

WINDOWS
───────
Set in:  System Environment Variables (GUI)
         PowerShell $env:OLLAMA_MODELS
         Registry for persistence

LOGIC:
─────────────────────────────────────────────
1. Install Ollama normally (internal disk)
2. Move ~/.ollama/models → /external-ssd/models
3. Create symlink: ~/.ollama/models ──▶ /external-ssd/models
4. Ollama sees original path, data lives externally

Pros: No config changes needed
Cons: Symlink breaks if external SSD unmounts

vLLM STORAGE LAYERS
─────────────────────────────────────────────────
Layer 1: HuggingFace Model Cache
         Default: ~/.cache/huggingface/hub/
         Override: HF_HOME or HF_HUB_CACHE
         Size:     LARGEST — full model weights here

Layer 2: vLLM Runtime Cache
         Default: ~/.cache/vllm/
         Override: VLLM_CACHE_ROOT
         Size:     Medium — compiled kernels, configs

Layer 3: Python Package
         Default: site-packages/
         Size:     Small — stays internal is fine
─────────────────────────────────────────────────

REDIRECT LOGIC:
HF_HOME          = /external-ssd/huggingface
HF_HUB_CACHE     = /external-ssd/huggingface/hub
VLLM_CACHE_ROOT  = /external-ssd/vllm/cache

KV CACHE = temporary attention cache during inference

Default: GPU VRAM (fastest)
         ──▶ CPU RAM (overflow)
         ──▶ Disk (last resort)

If GPU VRAM insufficient:
┌─────────────────────────────────────────────┐
│  vLLM disk offload ──▶ external SSD         │
│                                             │
│  Performance impact:                        │
│  NVMe internal   ──▶ ~7000 MB/s read        │
│  USB 3.2 SSD     ──▶ ~1000 MB/s read        │
│  Thunderbolt SSD ──▶ ~3000 MB/s read        │
│                                             │
│  Recommendation: Thunderbolt SSD for        │
│  KV cache offload in production             │
└─────────────────────────────────────────────┘

DOCKER RUN LOGIC:
─────────────────────────────────────────────
Host path (external SSD)   Container path
/external-ssd/tgi/models ──▶ /data
                               │
                               ├── model weights
                               ├── tokenizer files
                               └── config files
─────────────────────────────────────────────

TGI STORAGE BREAKDOWN
──────────────────────────────────────────────────────
Component          Default Location    Size
──────────────────────────────────────────────────────
Model weights      /data/              LARGE (redirect)
HF cache           ~/.cache/hf/        LARGE (redirect)
Compiled kernels   /tmp/tgi-kernels/   Medium
Flash attention    auto-compiled       Small
Router binary      /usr/local/bin/     Small (internal ok)
──────────────────────────────────────────────────────

Environment overrides:
HUGGING_FACE_HUB_TOKEN  = your_token
HF_HOME                 = /external-ssd/hf
MODEL_ID                = meta-llama/Llama-3.1-70B

┌─────────────────────────────────────────────────────────┐
│  CONNECTION    │ MAX SPEED  │ LATENCY  │ RECOMMENDED?   │
├────────────────┼────────────┼──────────┼────────────────┤
│ Thunderbolt 4  │ 3500 MB/s  │ Very low │ ✅ Best        │
│ Thunderbolt 3  │ 2800 MB/s  │ Very low │ ✅ Excellent   │
│ USB 3.2 Gen2x2 │ 2000 MB/s  │ Low      │ ✅ Good        │
│ USB 3.2 Gen2   │ 1000 MB/s  │ Low      │ ✅ Acceptable  │
│ USB 3.2 Gen1   │  500 MB/s  │ Medium   │ ⚠️ Slow load   │
│ USB 3.0        │  400 MB/s  │ Medium   │ ⚠️ Painful     │
│ USB 2.0        │   60 MB/s  │ High     │ ❌ Unusable    │
└────────────────┴────────────┴──────────┴────────────────┘

Real world model load times (70B Q4 ~40GB):
Thunderbolt 4   ──▶  ~12 seconds
USB 3.2 Gen2    ──▶  ~40 seconds
USB 3.0         ──▶  ~100 seconds

PERMISSION FLOW:
─────────────────────────────────────────────────
External SSD mount
      │
      ├── Must be mounted with execute permissions
      │   (noexec flag will break model loading)
      │
      ├── Ollama daemon user needs read/write
      │
      ├── vLLM process user needs read/write
      │
      └── Docker (TGI) needs volume mount permissions
          ── rootless Docker: user namespace mapping
          ── root Docker:     straightforward

RISK SCENARIO:
─────────────────────────────────────────────────
External SSD unmounts during inference
      │
      ▼
Model weights inaccessible mid-generation
      │
      ▼
┌─────────────────────────────────────────────┐
│  Ollama  ──▶ crashes, requires restart      │
│  vLLM    ──▶ SIGKILL, loses active request │
│  TGI     ──▶ container error, auto-restart │
└─────────────────────────────────────────────┘

MITIGATIONS:
├── Auto-mount via /etc/fstab (Linux)
├── Disable sleep/hibernate during inference
├── Use powered USB hub (prevents power-related unmounts)
└── Monitor mount status in agent health check

RECOMMENDED SETUP:
─────────────────────────────────────────────────
External NVMe SSD (Thunderbolt)
      │
      ├── /models/ollama/     ──▶ Ollama weights
      ├── /models/vllm/       ──▶ vLLM + HF cache
      ├── /models/tgi/        ──▶ TGI model data
      ├── /cache/             ──▶ Shared kernel cache
      └── /audit-logs/        ──▶ Agent prompt/response logs

Internal SSD (keep light):
      ├── OS + binaries
      ├── Docker engine
      ├── Ollama/vLLM/TGI executables
      └── Config files only

                    OLLAMA
                   ────────
Best for:   Quick iteration, testing multiple models
            Single-user security workstation
            Easiest external SSD setup (one env var)
            Best for: your daily driver agent work

                    vLLM
                   ──────
Best for:   Production-grade inference server
            Multi-user SOC team access
            OpenAI-compatible API (drop-in replacement)
            Best for: team-shared internal LLM endpoint

                    TGI
                   ─────
Best for:   HuggingFace-native model ecosystem
            Containerized deployment (Docker/K8s)
            Token streaming heavy workloads
            Best for: CI/CD integrated security pipelines

CAPABILITY REQUIREMENTS
─────────────────────────────────────────────────────
✅ Strong structured output (JSON tool calls)
✅ Long context (scan results can be massive)
✅ Multi-step reasoning (ReAct loop)
✅ Code understanding (parsing, formatting logic)
✅ Security domain knowledge (CVEs, services, protocols)
✅ Tool use reliability (no hallucinated function calls)
✅ Low hallucination on technical facts
✅ Runs comfortably on consumer/prosumer hardware
─────────────────────────────────────────────────────

┌─────────────────────────────────────────────────────────────┐
│  llama3.1:70b                                               │
│  ─────────────────────────────────────────────────────────  │
│  Context:     128K tokens ✅ (massive scan outputs fit)     │
│  Tool use:    Native function calling ✅                    │
│  Reasoning:   Best in class for local models ✅             │
│  Security IQ: Strong CVE, protocol, service knowledge ✅    │
│  JSON output: Very reliable ✅                              │
│  VRAM needed: 48GB (Q4) — needs good GPU or CPU offload    │
│  Disk space:  ~40GB on external SSD                        │
│                                                             │
│  VERDICT: Best capability, highest hardware requirement     │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  llama3.1:8b                                                │
│  ─────────────────────────────────────────────────────────  │
│  Context:     128K tokens ✅                                │
│  Tool use:    Native function calling ✅                    │
│  Reasoning:   Good for structured tasks ✅                  │
│  Security IQ: Moderate — knows common CVEs/services        │
│  JSON output: Reliable ✅                                   │
│  VRAM needed: 8GB ✅ (runs on most GPUs)                   │
│  Disk space:  ~5GB on external SSD                         │
│                                                             │
│  VERDICT: Best balance of performance vs hardware ✅        │
│           RECOMMENDED STARTING POINT                        │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  mistral:7b / mistral-nemo:12b                              │
│  JSON output: Very reliable (trained heavily on it)        │
│  VERDICT: Excellent JSON reliability, good for              │
│           formatter and router agent roles                  │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  deepseek-r1:14b / deepseek-r1:32b                         │
│  Reasoning:   Exceptional — chain of thought native ✅      │
│  VERDICT: Best pure reasoning, use for analysis layer       │
│  ⚠️  Data sovereignty concern — Chinese origin model        │
│      Use only on air-gapped internal lab                    │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  qwen2.5:14b / qwen2.5-coder:14b                           │
│  Security IQ: Excellent code + config understanding ✅      │
│  VERDICT: Best for code analysis tasks (SAST, config audit)│
│  ⚠️  Same sovereignty note as DeepSeek                      │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  RedSage (8B)                                               │
│  ─────────────────────────────────────────────────────────  │
│  Purpose:    BUILT specifically for cybersecurity           │
│  Size:       8B — runs on consumer hardware ✅              │
│  Origin:     arxiv.org/html/2509.13021v1                   │
│  Strength:   Security-domain fine-tuned                     │
│              ── CVE reasoning                               │
│              ── Vulnerability classification                │
│              ── Offensive/defensive terminology             │
│              ── Tool output interpretation                  │
│  Privacy:    Fully local ✅                                 │
│  VRAM:       8GB minimum                                    │
│                                                             │
│  VERDICT: Slot as PRIMARY analysis agent                    │
│           Understands security context natively             │
│           without prompt engineering workarounds            │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  Qwen3:8b / Qwen3:14b / Qwen3:32b                         │
│  ─────────────────────────────────────────────────────────  │
│  Thinking mode: Qwen3 has built-in think/no-think toggle   │
│                 ── Think ON  = deep reasoning (analysis)   │
│                 ── Think OFF = fast response (formatting)  │
│  VERDICT: Most flexible model in the stack                  │
│           One model doing two agent roles                   │
└─────────────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────────┐
│                  AGENT PIPELINE MODEL MAP                    │
│                                                              │
│  [Orchestrator Agent]  ──▶  llama3.1:70b                   │
│   Plans, reasons,             or llama3.1:8b                │
│   routes decisions            (best reasoning + tool use)   │
│          │                                                   │
│          ▼                                                   │
│  [Parser / Formatter]  ──▶  mistral-nemo:12b               │
│   Normalizes data,            (reliable JSON output)        │
│   routes to tools                                            │
│          │                                                   │
│          ▼                                                   │
│  [Analysis Agent]      ──▶  deepseek-r1:14b                │
│   CVE correlation,            (deep chain-of-thought)       │
│   risk scoring,                                              │
│   prioritization                                             │
│          │                                                   │
│          ▼                                                   │
│  [Code Audit Agent]    ──▶  qwen2.5-coder:14b              │
│   Config review,              (best code understanding)     │
│   SAST logic,                                                │
│   secret detection                                           │
│          │                                                   │
│          ▼                                                   │
│  [Embedding / Search]  ──▶  nomic-embed-text               │
│   Historical scan             (semantic correlation)        │
│   correlation                                                │
└──────────────────────────────────────────────────────────────┘

Burp Suite Professional
        │
        │  MontoyaAPI / Extension
        ▼
┌─────────────────────────┐
│   Burp LLM Extension    │
│                         │
│   Sends to local LLM:   │
│   ── HTTP request data  │
│   ── Response analysis  │
│   ── Param suggestions  │
│   ── Payload ideas      │
└────────────┬────────────┘
             │
             │  Ollama API (localhost:11434)
             ▼
┌─────────────────────────┐
│   Local Ollama Server   │
│   Running RedSage:8b    │
│   or Qwen3:14b          │
│                         │
│   Returns:              │
│   ── Vuln classification│
│   ── Risk assessment    │
│   ── Next test steps    │
│   ── Remediation notes  │
└─────────────────────────┘

DATA PRIVACY MAINTAINED:
HTTP traffic never leaves your machine ✅

┌────────────────────────────────────────────────────────────────┐
│              COMPLETE LOCAL SECURITY AGENT STACK               │
│                                                                │
│  INTERFACE LAYER                                               │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐        │
│  │  Open WebUI  │  │  Burp Suite  │  │  CLI Agent   │        │
│  │  (chat UI)   │  │  Extension   │  │  (automated) │        │
│  └──────┬───────┘  └──────┬───────┘  └──────┬───────┘        │
│         └─────────────────┼─────────────────┘                 │
│                           │                                    │
│  OLLAMA API LAYER (localhost:11434)                           │
│  ┌────────────────────────▼───────────────────────────┐       │
│  │              Ollama Server                          │       │
│  │  ┌──────────────┐      ┌──────────────────────┐   │       │
│  │  │ RedSage:8b   │      │ Qwen3:14b            │   │       │
│  │  │ Security     │      │ Orchestrator         │   │       │
│  │  │ Specialist   │      │ + Formatter          │   │       │
│  │  └──────────────┘      └──────────────────────┘   │       │
│  │  ┌──────────────┐      ┌──────────────────────┐   │       │
│  │  │DeepSeek-R1   │      │ nomic-embed-text     │   │       │
│  │  │Attack Path   │      │ Semantic Search      │   │       │
│  │  │Reasoning     │      │ Historical Scans     │   │       │
│  │  └──────────────┘      └──────────────────────┘   │       │
│  └────────────────────────────────────────────────────┘       │
│                           │                                    │
│  TOOL LAYER (MCP Servers)                                     │
│  ┌──────────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐   │
│  │ Nmap MCP │ │Nuclei  │ │Shodan  │ │TheHive │ │  MISP  │   │
│  │ Parser   │ │MCP     │ │MCP     │ │MCP     │ │  MCP   │   │
│  └──────────┘ └────────┘ └────────┘ └────────┘ └────────┘   │
│                           │                                    │
│  STORAGE LAYER (External SSD)                                 │
│  ┌────────────────────────▼───────────────────────────┐       │
│  │  /models/     /cache/     /scan-data/   /audit/    │       │
│  │  (weights)    (kernels)   (results)     (logs)     │       │
│  └────────────────────────────────────────────────────┘       │
└────────────────────────────────────────────────────────────────┘

MODEL STORAGE BUDGET
──────────────────────────────────────────────
Model                   Q4 Size    Priority
──────────────────────────────────────────────
llama3.1:8b             5GB        ✅ Must have
llama3.1:70b            40GB       ✅ If GPU allows
mistral-nemo:12b        7GB        ✅ Must have
deepseek-r1:14b         9GB        ✅ Recommended
qwen2.5-coder:14b       9GB        ✅ Recommended
phi4:14b                8GB        ⚠️  Optional
nomic-embed-text        0.5GB      ✅ Must have
──────────────────────────────────────────────
Minimum viable stack:   ~22GB
Full stack:             ~79GB
──────────────────────────────────────────────

MINIMUM VIABLE (16GB RAM + 8GB VRAM)
──────────────────────────────────────
Runs:
├── RedSage:8b          ✅ Primary security analyst
├── llama3.1:8b         ✅ Orchestrator
├── nomic-embed-text    ✅ Embeddings
└── One model at a time (swap between roles)
External SSD budget: ~15GB

RECOMMENDED (32GB RAM + 16GB VRAM)
──────────────────────────────────────
Runs:
├── RedSage:8b          ✅ Security analysis agent
├── Qwen3:14b           ✅ Orchestrator + formatter
├── DeepSeek-R1:14b     ✅ Deep reasoning agent
├── nomic-embed-text    ✅ Embedding agent
└── Two models simultaneously in VRAM
External SSD budget: ~35GB

OPTIMAL (64GB RAM + 24GB+ VRAM)
──────────────────────────────────────
Runs:
├── llama3.1:70b        ✅ Master orchestrator
├── RedSage:8b          ✅ Security specialist
├── Qwen3:32b           ✅ Complex reasoning
├── DeepSeek-R1:32b     ✅ Attack path analysis
├── qwen2.5-coder:14b   ✅ Code/config auditor
└── nomic-embed-text    ✅ Semantic search
External SSD budget: ~100GB

┌─────────────────────────────────────────────────────────┐
│                                                         │
│  General LLMs (Llama, Mistral)                         │
│  ── Good orchestrators and formatters                   │
│  ── Need heavy prompt engineering for security          │
│  ── May soft-refuse certain security terminology        │
│                                                         │
│  Security-Specialized (RedSage)                        │
│  ── Understands security context natively               │
│  ── No refusal friction on legitimate offsec tasks      │
│  ── Less prompt engineering overhead                    │
│  ── Slot as your analysis + classification agent        │
│                                                         │
│  BEST ARCHITECTURE:                                     │
│  General LLM orchestrates                              │
│  + Security LLM analyzes                               │
│  + Embedding model correlates                           │
│  = Full capability, minimal friction                    │
│                                                         │
└─────────────────────────────────────────────────────────┘