Kali-Terminus-v2

Kali-Terminus-v2 is a fine-tuned LFM2.5-350M model specialized for Kali Linux terminal command execution. It converts natural language instructions into precise shell commands with native LFM2.5 <|tool_call_start|>/<|tool_call_end|> JSON tool calls.

This is the Executor Agent in a multi-agent penetration-testing system — it translates one bounded instruction into one structured terminal action.

Model Details

Performance

Evaluated across 5 scenarios (26 turns) covering network recon, system enumeration, web recon, DNS recon, and self-correction:

Comparison with V1

Dataset

Fine-tuned on iselabvn/Kali-terminal-executor-v2, a curated collection of 2,418 shell command execution pairs combining 1,380 source records with 1,000 synthetically augmented records (DeepSeek-V4-Flash).

Top tools in training data: nmap · dig · gobuster · curl · whatweb · sqlmap · find · hydra · uname · ss · subfinder · dnsrecon · ffuf · id · nikto

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained("iselabvn/Kali-Terminus-v2", trust_remote_code=True)
tokenizer = AutoTokenizer.from_pretrained("iselabvn/Kali-Terminus-v2", trust_remote_code=True)

messages = [
    {"role": "user", "content": "Scan port 80 on 192.168.1.1"}
]
inputs = tokenizer.apply_chat_template(
    messages,
    tools=[{
        "type": "function",
        "function": {
            "name": "exec",
            "description": "Execute a shell command in the Kali terminal.",
            "parameters": {
                "type": "object",
                "properties": {"command": {"type": "string"}},
                "required": ["command"]
            }
        }
    }],
    add_generation_prompt=True,
    return_tensors="pt"
)
outputs = model.generate(**inputs, max_new_tokens=256)
response = tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False)
print(response)
# Expected: <|tool_call_start|>{"name": "exec", "arguments": {"command": "nmap -p 80 192.168.1.1"}}<|tool_call_end|>

Tool Call Format

Kali-Terminus-v2 produces native LFM2.5 tool calls wrapped in <|tool_call_start|> and <|tool_call_end|> tokens, output as JSON:

<|tool_call_start|>{"name": "exec", "arguments": {"command": "nmap -p 80 192.168.1.1"}}<|tool_call_end|>

A system instruction Output function calls as JSON. is prepended so the model emits JSON rather than the default Pythonic calls.

Tool Call Format

Kali-Terminus-v2 produces native LFM2.5 tool calls wrapped in <|tool_call_start|> and <|tool_call_end|> tokens, output as JSON:

<|tool_call_start|>{"name": "exec", "arguments": {"command": "nmap -p 80 192.168.1.1"}}<|tool_call_end|>

A system instruction Output function calls as JSON. is prepended so the model emits JSON rather than the default Pythonic calls.

Intended Use

• Executor Agent in multi-agent penetration-testing systems
• Single-Turn Kali Terminal Assistant — converts natural language to shell commands
• Not recommended for general conversation or chatbot use

Limitations

• Designed for single-turn command generation; multi-turn interaction requires external state management
• Commands target authorized lab environments only; not for production systems without human review
• Best performance on the 15 core Kali/Linux tools seen during training

Training Details

Citation

@misc{kali-terminus-v2,
  author = {ISeLab},
  title = {Kali-Terminus-v2: Fine-tuned LFM2.5-350M for Kali Linux Terminal Execution},
  year = {2026},
  publisher = {Hugging Face},
  url = {https://huggingface.co/iselabvn/Kali-Terminus-v2}
}