LuciMAGI is not a scanner and not a chatbot. It is a fully local security-research assistant for authorized labs, CTFs, and in-scope assessments: local models, a Kali tool container, a reusable skill corpus, and evidence that survives between stages and operator sessions.
Two interfaces share the same brain. The automated assessment pipeline — ./run.sh <target> — runs a staged sequence: passive reconnaissance, web reconnaissance, web analysis, non-web service triage, exploitation, and persistence validation. Scout work uses LFM2.5-230M through Ollama in a tool-call loop inside a Dockerized Kali environment (nmap, nuclei, feroxbuster, sqlmap, and the rest). A thinking judge compresses probe signals; Ornith-1.0-35B on a local OpenAI-compatible endpoint drives heavy exploitation and persistence decisions. Shared Findings state and turbovec memory (qwen3-embedding) carry tool output forward so each stage builds on the last instead of restarting.
The Luciv3 operator toolkit — ./bin/luciv3 and the stdio MCP server — is the other half. Route and retrieve across 42 security workflows covering web and API testing, reverse engineering, mobile, Active Directory, cloud, firmware, radio, forensics, and related domains. Initialize auditable cases with explicit authorization scope, run scope gates before active work, capture evidence and findings, generate reports, and inspect append-only traces. External agent clients (OpenCode and others) connect through MCP with the same routing, RAG, and case primitives.
The web path is built to reduce noise: SPA catch-all detection, public static asset filtering, recursive directory enumeration, signal classification, and ranked handoff to later stages. Tool traces, run digests, and partial results persist under logs/ and work/<case>/ so interrupted runs still leave useful artifacts.
It is built for environments where sending assessment data to a cloud service is a non-starter. Models run locally. Tools run locally. Evidence stays on the operator machine. The pipeline has demonstrated an end-to-end chain against OWASP Juice Shop with local scout and heavy models, shared memory, and operator-owned targets. Broader deployment surfaces, reporting polish, and additional specialist lanes continue to harden.