The mobile security workspace
that just works.
Lupus brings a professional penetration-testing toolkit — the Metasploit Framework, Nmap, Nuclei and a full recon, web and Active Directory arsenal — to one Android app that runs on modern devices without root or manual setup, driven by an autonomous AI agent. For authorized security testing.
An AI agent that runs the engagement
Point the Lupus AI Agent at a target and it drives the whole workflow — reconnaissance, scanning, exploitation, post-exploitation and reporting — orchestrating Metasploit, Nmap, Nuclei and the full arsenal, and writing every finding into the workspace database. Connect your own Claude access; it works in both local and remote mode. For authorized engagements only.
Explore the arsenal →Everything you need, on the phone in your pocket
Industry-standard frameworks
Run the Metasploit Framework — msfconsole and the full module workflow — from a clean mobile UI instead of a cramped terminal.
Recon & vulnerability scanning
Nmap and Nuclei scanning with profiles, plus a workspace database for hosts, services, findings and vulnerabilities.
Runs on modern Android
Self-contained environment that runs on Android 13/14/15 — no root, no manual Termux setup.
Session management
Manage remote sessions with a file explorer, process view and background tasks — on systems you are authorized to test.
No tiny-keyboard pain
The GUI is the point: do in a tap what would take a long command on a phone keyboard.
Your data, your engine
Everything runs on the engine you choose — your phone in local mode, or your own server in remote mode. Built for authorized security testing and learning.
Start hands-on, no cost
Core penetration-testing modules, msfconsole, Nmap, session management and the full read-only workspace database — free, on every device.
Unlock the full workflow
Advanced session tools (file explorer, process & network views), post-assessment modules, payload generation, Nuclei, advanced Nmap, DB export/import and background tasks.
View plansFrequently asked questions
What is Lupus?
Lupus is a professional penetration-testing workspace for Android. It brings the Metasploit Framework, Nmap, Nuclei and a full arsenal of recon, web, Active Directory and post-exploitation tools — plus an autonomous AI pentest agent — into one app that runs on modern Android without root or manual Termux setup. For authorized security testing.
Do I need to root my phone to use Lupus?
No. Lupus runs on stock, unrooted Android, and the core toolkit — the Metasploit Framework, Nmap, Nuclei and the workspace database — works without root. Root is optional: on a rooted device an "Execute as root" toggle runs the Metasploit engine elevated, which unlocks privileged Nmap scans (SYN, UDP and OS detection) and tools that must bind privileged ports, such as Responder. Lupus never roots your device or runs itself as root; without root those specific capabilities fall back or stay unavailable while everything else works normally.
Do I need a PC? What are local and remote mode?
No PC is required. Lupus runs the same engine — Metasploit, Nmap, Nuclei and the database — in one of two places. In local mode the app bundles and launches that whole stack on the phone itself (a one-time install of about 2 GB). In remote mode you run the same engine on your own Linux box — a VPS, lab or server you control — and the phone becomes a thin console that drives it over an encrypted gRPC link. The remote agent is your own tool-runner, not the target you are testing; targets are set separately inside each module. It is a deployment choice, not a paid feature.
What tools does Lupus include?
The Metasploit Framework (exploits, auxiliary, msfvenom payloads, handlers, post-exploitation and Meterpreter sessions), Nmap and Nuclei, plus Impacket, NetExec, Responder and smbclient for Active Directory and SMB; sqlmap, ffuf, feroxbuster, gobuster, httpx and katana for web; subfinder, dnsx and dnsrecon for DNS and OSINT; naabu, Ncat and tshark for networking and capture; and searchsploit/Exploit-DB — all orchestrated by the autonomous Lupus AI Agent. See the full arsenal on the Tools page.
Is there really an AI agent?
Yes. The Lupus AI Agent is an autonomous pentest agent that drives the workflow end to end — reconnaissance, scanning, exploitation, post-exploitation and reporting — orchestrating the tools above and writing its findings into the workspace database. You connect your own Claude (Anthropic) access, and it works in both local and remote mode. For authorized engagements only.
Is Lupus free? How much does Pro cost?
The core toolkit is free forever — msfconsole, testing modules, Nmap, remote session management and read-only access to the workspace database. Lupus Pro unlocks the full workflow (file explorer, process and network views, payload generation, Nuclei, advanced Nmap, database export/import, background tasks and the AI pentest agent) for $19/month or $149/year, each with a 7-day free trial. Teams are billed per seat at $39 per member per month.
Is it legal to use Lupus?
Lupus is built for lawful, authorized security testing and learning — assessing systems you own or have explicit written permission to test. Using it against systems you are not authorized to test is illegal; it is intended for professionals, students and researchers working within scope.
How is Lupus different from installing Metasploit in Termux?
Lupus gives you a self-contained environment with no manual Termux setup or dependency wrangling, plus a graphical mobile UI over msfconsole, Nmap and Nuclei — so you tap through the workflow instead of typing long commands on a phone keyboard. It also curates a full arsenal and an autonomous AI agent on top. Raw msfconsole is still there when you want it.
Get Lupus on your device
Available on Google Play and as a direct download. Lawful and authorized use only.