METATRON is a Python 3 CLI that takes a target IP or domain, orchestrates a suite of recon tools, and pipes the output into a locally-hosted LLM for triage and reporting — no cloud API, no key, everything stays on-box.

Pick native if you're already working inside a Kali/Parrot VM and want it wired into your existing toolchain. Pick Docker if you want it isolated, reproducible, or running alongside other lab containers.

1. Clone and enter the repo

   $ git clone https://github.com/sooryathejas/METATRON.git
   $ cd METATRON

2. Install the Python dependencies

   $ python3 -m venv venv && source venv/bin/activate
   $ pip install -r requirements.txt

3. Confirm the recon toolchain is present

   Kali ships these by default; verify anyway.

   $ for t in nmap nikto whatweb whois dig curl; do which $t; done

4. Install Ollama and pull the model

   $ curl -fsSL https://ollama.com/install.sh | sh
   $ ollama create metatron-qwen -f ./Modelfile
   $ ollama list   # confirm metatron-qwen is listed

5. Start MariaDB and launch

   $ sudo systemctl start mariadb
   $ sudo systemctl enable mariadb
   $ python3 metatron.py

Uses the cspenn/metatron-docker fork: a multi-stage Dockerfile plus a docker-compose.yml that wires up MariaDB and the app container together.

1. Clone and configure environment

   $ git clone https://github.com/cspenn/metatron-docker.git
   $ cd metatron-docker
   $ cp .env.example .env   # set DB creds, LLM URL, API token

2. Provision the SecLists volume (one-time)

   ffuf and related wordlist-driven tools will silently fail without this.

   $ docker compose run --rm metatron ./scripts/provision-seclists.sh

3. Build and bring the stack up

   $ docker compose build
   $ docker compose up -d mariadb
   $ docker compose run --rm metatron

4. Grant raw-socket capabilities

   Required for masscan/hping3. Confirm in docker-compose.yml:

   cap_add:
     - NET_RAW
     - NET_ADMIN

   On Docker Desktop hosts these caps can be stripped — you may need --privileged as a fallback in a lab-only environment.

Once launched, METATRON presents a menu-driven CLI. The core loop: point it at a target, let it run the recon chain, review the AI-generated analysis, export.

Treat the AI output as a first-pass triage layer, not ground truth — validate anything it flags before acting on it, same as you would with any automated scanner output.

Since METATRON just orchestrates standard tools, standard detections apply. Worth having on the blue-team side of your own lab for correlation testing:

sudo auditctl -w /usr/bin/nmap -p x -k recon_tool
sudo auditctl -w /usr/bin/nikto -p x -k recon_tool

Sequential port-probe patterns from a single source, plus a honeytoken endpoint (e.g. a fake /cgi-bin/debug route that alerts on any hit) are both cheap ways to validate your detection coverage against exactly this kind of automated recon.