HALO is an autonomous security agent that runs inside a Linux environment driven by a local LLM — Gemma 4-12B (uncensored / abliterated) served through LM Studio. It plans, runs reconnaissance, chains attacks based on…
gemma-by-google source profile. From the maintainer documentation: “HALO is an autonomous security agent that runs inside a Linux environment driven by a local LLM — Gemma 4-12B (uncensored / abliterated) served through LM Studio. It plans, runs reconnaissance, chains attacks based on what it finds, and writes a professional pentest report on its own. Everything runs locally: no cloud, no API keys, nothing leaves your machine.”
Project documentation · Repository · Discovery listing. This profile records the public documentation checked on 2026-10-08.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| run_subfinder | Subdomain enumeration |
| run_theharvester | Passive OSINT — emails, subdomains, hosts |
| run_httpx | HTTP probing and fingerprinting |
| run_katana | Web crawling |
| run_sherlock | Username OSINT across 90+ platforms |
| run_shodan | Internet-exposure intelligence lookups |
| run_phoneinfoga | Phone-number OSINT |
| run_phonextract | Phone-number OSINT / extraction |
| run_ghosttrack | OSINT for username / IP / phone |
| run_cloudfox | Cloud-infrastructure enumeration |
| run_wafw00f | WAF / security-solution fingerprinting |
| run_amass | Subdomain enumeration (passive by default) |
| run_dnsx | DNS resolution and probing |
| run_gau | Known URLs from OTX / Wayback / Common Crawl |
| run_waybackurls | Historical URLs from the Wayback Machine |
| run_gowitness | Web screenshotting for visual recon |
| run_spiderfoot | Headless multi-module OSINT scanning |
| run_recon_ng | recon-ng OSINT framework (non-interactive) |
| run_masscan | Fast port discovery |
| run_nmap | Deep service/version scanning |
| run_nikto | Web vulnerability scanning |
| run_nuclei | Template-based vulnerability scanning |
| run_netstat | Network connection analysis |
| run_gobuster | Web directory brute forcing |
| run_ffuf | Web fuzzing |
| run_feroxbuster | Recursive content discovery |
| run_dalfox | XSS scanning (reflected / stored / DOM) |
| run_curl | HTTP request testing |
| run_wget | File retrieval |
| run_sqlmap | SQL injection testing |
| run_searchsploit | Exploit lookup |
| run_metasploit | Fire a chosen Metasploit module at a target (human-approved) |
| run_exploit | Sandboxed execution of custom PoC scripts |
| run_setoolkit | Social-engineering toolkit |
| run_hydra | Credential brute forcing |
| run_ncrack | Network authentication cracking |
| run_medusa | Fast parallel brute forcing |
| run_john | Hash cracking |
| run_enum4linux | SMB / Samba enumeration |
| run_command | Arbitrary command execution |
| read_file | Read file contents |
| write_file | Write output to files |
Provides IP address geolocation data via IP-API.com without requiring an API key.
Free web lookups; PDF to Markdown, audio transcripts, screenshots, WHOIS/DNS paid per call via x402.
"It's like gmail for your coding agents!"
Pay-per-call web extract, DNS/WHOIS/IP lookup, PDF/RSS/sitemap tools. x402 USDC on Base/Algorand.
Pay-per-call DNS, WHOIS/RDAP, IP and domain reports for agents. x402 USDC on Base or Algorand.
Security intelligence via x402 on Base. CVE lookup, IP reputation, secret scanning.