Legion

A local security guard for your machine.
It watches your packages, files, and network, flags what looks wrong, and a built-in analyst named Ares explains it in plain English. Everything runs on your box. No accounts, no cloud, no telemetry.

---

How it works

Open the dashboard. Legion looks around your machine, ranks anything risky, and you click into it. Ares tells you what it is and what to do next. That is the whole loop.

What it watches

• Risky packages. Scans Cargo, npm, and pip for known CVEs, and flags typosquats and sketchy AI SDK packages.
• Bad connections. Catches your machine talking to IP addresses known for malicious activity.
• Suspicious files. A pure-Rust YARA engine scans with rules that keep themselves up to date.
• Drift. Learns what normal looks like on first run, then points out new processes, peers, and packages later.
• Live threat intel. Pulls fresh data from public sources like CISA KEV and AbuseIPDB.
• Windows events. Turns the noisy Event Log into alerts you can actually read.

Alerts, live telemetry, threat feeds, and scan status in one view.

Ask Ares what a finding means. It answers from what Legion actually sees.

Requirements

Operating system

Platform	Status	Notes
Linux x86_64	Supported	AppImage bundles a static runtime, so no libfuse2 needed
Windows 10/11 x86_64	Supported	Uses PowerShell, netstat and tasklist, all built in
Linux/Windows ARM64	Builds from source	No bundled model server — supply your own llama-server
macOS	Not supported	No release build, and the loopback peer-credential check has no macOS implementation

Legion binds only to 127.0.0.1. On Linux it asks for administrator rights via polkit/pkexec (or sudo on a terminal) to read privileged telemetry; on Windows it uses UAC. Both are skippable with --no-elevate — you lose system event logs and the full process table, nothing else.

Hardware

	Minimum	Recommended
CPU	2 cores, x86_64	8 cores or more
RAM	4 GB	8 GB or more
Free disk	2 GB	4 GB
GPU	None — CPU fallback is automatic	3 GB or more free VRAM, with a Vulkan driver

Disk is dominated by the optional AI model (below). Without it, Legion needs well under 200 MB plus its SQLite database.

The Ares analyst (optional)

Everything except the LLM analyst runs with no model at all — scanning, CVE/OSV correlation, YARA, the package sensor and the DPRK detections are all deterministic. If no model is available, hunts still run and report engine-only.

If you do want the analyst:

	Download	Free VRAM to run on GPU
qwen3-1.7b (default)	1.11 GB	~3 GB
qwen3-4b	2.50 GB	~6 GB

Plus about 120 MB for the model server itself. The server binary needs glibc 2.34 or newer (Ubuntu 22.04+, Debian 12+, RHEL 9+); Legion's own binary does not, so on an older distribution the dashboard still runs and only the analyst is unavailable.

Legion will not take your machine hostage. It is a background monitor, so it deliberately leaves resources for your actual work:

• Reserves the greater of 768 MB or 20% of VRAM for other processes, and runs on the CPU instead of offloading when the model would not fit in what is left.
• Caps the model server at half your CPU cores and runs it at nice 10.
• Bounds each YARA pass to 90 seconds (max_scan_seconds to change) and tells you when coverage was cut short rather than reporting a partial scan as clean.

Two deliberate choices worth knowing, both from measurement on a Quadro T2000:

• Integrated GPUs are never used. An Intel iGPU measured 28 tok/s prompt processing against 446 tok/s on the CPU of the same machine — offloading there is a 16x regression, and because an iGPU reports shared system memory it would otherwise look like the card with the most free VRAM.
• The model is offloaded whole or not at all. A half-offloaded model measured 5.9 tok/s generation against 4.0 on CPU alone — not worth the VRAM.

For reference, the same 4,490-token hunt prompt on that machine: 835 tok/s prompt and 59 tok/s generation on the discrete GPU, versus 446 and 4.0 on CPU. A CPU-only host works, it just answers more slowly.

Get started

Legion ships as a single app: the dashboard. It opens your browser at http://localhost:3000 and needs no sign-in.

Linux

Grab the AppImage from the releases page, make it runnable, and start it:

chmod +x Legion-*-x86_64.AppImage
./Legion-*-x86_64.AppImage

No install, no admin prompt. If you want system event logs, the setup screen has a one-click grant-administrator step.

Windows

Download the latest release, then run the app:

.\legion-web.exe

Your browser opens at http://localhost:3000 automatically.

From source

You need Rust 1.87 or newer and make. SQLite is bundled, so there is nothing else to install.

make legion        # build the dashboard and launch it

Legion scans your home directory by default on Linux and macOS, and F:\dev on Windows. Change SCAN_ROOT in the Makefile or pass --scan-root to point it somewhere else.

Meet Ares

Ares is the blue-team analyst built into Legion. Ask it about a finding and it answers in plain English, grounded in what Legion sees: your alerts, packages, scans, drift, events, and connections. It reads and explains. It never edits your files or runs code.

Ares runs entirely on your machine. On first launch Legion pulls the right-sized model from HuggingFace (tburns-actual/legion-ares), verifies it against a SHA-256, and serves it through a local model server — an OpenAI-compatible endpoint (e.g. llama.cpp) on 127.0.0.1:8080. It picks a size that fits your GPU so replies stay fast.

Model tiers and how one gets chosen

Legion auto-selects the tier that stays fully GPU-resident (sized by loaded footprint, not disk size):

Tier	Picked when	Notes
legion-ares:qwen3-1.7b	under 6 GB VRAM (incl. 4 GB laptop GPUs)	fast default
legion-ares:qwen3-4b	6 to 8 GB VRAM	mid tier
legion-ares:qwen3-8b	8 GB VRAM or more	high-VRAM option

A model that does not fully fit spills to CPU and gets slow, so the cutoffs are deliberately conservative. The chosen tier is shown on the Agent page, and you can pin a larger one. If no published build matches your hardware, Legion builds Ares from a stock qwen3 base instead. DeepSeek models are blocked by policy. Ares is a small local analyst. It is not Claude or any other third-party model, and is told never to claim to be one. Design notes: docs/MODEL-DISTRIBUTION.md.

Privacy and safety

Legion binds to localhost only and leans on your operating system for access control, so there is no extra password to manage and nothing is exposed to the network by default. Full details in SECURITY.md, with the control mapping (OWASP Top 10, NIST 800-53, SOC 2) in COMPLIANCE.md.

Security highlights

• Loopback by default. The app binds 127.0.0.1, rejects non-loopback Host headers (DNS-rebinding guard), sends no CORS headers, sets strict security headers, caps request bodies, and rate-limits.
• Opt-in elevation. It starts non-elevated. The setup screen offers a grant-administrator step (UAC or polkit) only when you want privileged telemetry.
• Session token. Every /api route needs a per-process token from the OS random source, delivered to the dashboard as a SameSite=Strict, HttpOnly cookie and written to an owner-only file.
• Feed integrity. Threat-feed bodies are size-capped and hashed for the audit log. CISA KEV can be pinned to a SHA-256, and Ed25519 signed feeds are supported. A mismatch rejects the body.
• Model integrity. The Ares model is SHA-256-verified (fail-closed) against the pinned manifest before the local model server loads it, so a tampered download is rejected.
• Owner-only data. The database, config, cached rules, and session token are created 0600 or 0700 on Unix.

Command line and API (also built from source)

A source build also produces the legion CLI and legion-tui terminal dashboard.

legion scan [PATH]              Scan packages for known vulnerabilities
legion alerts [--json]          List alerts
legion ack <ID>                 Acknowledge an alert
legion status                   System and alert summary
legion yara scan [PATH]         Scan a path with the rule set
legion baseline run [PATH]      Capture the baseline, or show drift after

Every dashboard action has a matching /api route on http://localhost:3000 (token required). See docs/ for the full endpoint and rules reference.

Where your data lives

Platform	Path
Windows	%APPDATA%\legion\legion.db
Linux	~/.local/share/legion/legion.db

License

MIT, see LICENSE. Ares is a local profile built on Qwen3 (Qwen Team, Alibaba Cloud, Apache-2.0). The base weights are pulled by you at install time and are not redistributed here.