Kali-Terminus-v3

Kali-Terminus-v3 is a fine-tuned version of Qwen/Qwen3.5-0.8B-Base on the iselabvn/Kali-terminal-executor-v2 dataset. It is designed to generate accurate Kali Linux terminal commands from natural language instructions, with built-in reasoning via Qwen3.5's native thinking/ response tokens.

Model Details

Performance

Evaluated across 5 scenarios (26 turns) covering network recon, system enumeration, web recon, DNS recon, and self-correction:

Comparison with Kali-Terminus-v2

Tool Call Format

This model uses Qwen3.5's native tool call format with <tool_call> XML tags:

<tool_call>
<function=exec>
<parameter=command>
nmap -p- 127.0.0.1
</parameter>
</function>
</tool_call>

The model also outputs reasoning before tool calls using Qwen3.5's native thinking/ response tokens:

<|im_start|>assistant
 thinking
The user wants to scan all 65535 ports. I'll use nmap with -p-.
 response

<tool_call>
<function=exec>
<parameter=command>
nmap -p- 127.0.0.1
</parameter>
</function>
</tool_call><|im_end|>

Usage (Transformers)

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model_path = "iselabvn/Kali-Terminus-v3"
tokenizer = AutoTokenizer.from_pretrained(model_path, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(
    model_path,
    torch_dtype=torch.bfloat16,
    device_map="auto",
    trust_remote_code=True,
)

exec_tool = [{
    "type": "function",
    "function": {
        "name": "exec",
        "description": "Execute a shell command in the Kali Linux terminal.",
        "parameters": {
            "type": "object",
            "properties": {"command": {"type": "string"}},
            "required": ["command"],
        },
    },
}]

messages = [{"role": "user", "content": "Scan all open ports on 127.0.0.1"}]
inputs = tokenizer.apply_chat_template(
    messages, tools=exec_tool, add_generation_prompt=True,
    enable_thinking=True, tokenize=True, return_dict=True, return_tensors="pt",
)
inputs = {k: v.to(model.device) for k, v in inputs.items()}

with torch.no_grad():
    outputs = model.generate(**inputs, max_new_tokens=256, pad_token_id=tokenizer.eos_token_id)

response = tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False)
print(response)
# Expected: <|im_start|>assistant
#  thinking
# I need to scan all ports...
#  response
# 
# <tool_call>
# <function=exec>
# <parameter=command>
# nmap -p- 127.0.0.1
# </parameter>
# </function>
# </tool_call><|im_end|>

Usage (llama.cpp GGUF)

The GGUF version is available at Kali-Terminus-v3-GGUF/kali-terminus-v3-bf16.gguf. Run with llama-server:

llama-server -m kali-terminus-v3-bf16.gguf --host 127.0.0.1 --port 8080 -ngl 99

Training Details

Dataset

• Source: iselabvn/Kali-terminal-executor-v2
• Splits: 2,084 train / 232 validation / 102 test
• Features: Each sample includes reasoning_content for natural language reasoning before tool calls

Fine-Tuning Parameters

Limitations

• The model is specialized for Kali Linux terminal command generation and may not generalize well to other domains
• Performance may vary with complex multi-step scenarios
• The model uses Qwen3.5's native thinking/ response reasoning tokens; for optimal results, use enable_thinking=True in the generation config

Files

Citation

If you use this model, please cite:

@misc{kali-terminus-v3,
  title  = {Kali-Terminus-v3: Fine-tuned Qwen3.5 for Kali Linux Terminal Command Generation},
  author = {iselabvn},
  year   = {2026},
}