CyraFlow AI Pentest Lab Network Topology demonstrates an isolated, air-gapped penetration testing environment where an AI-driven attacker VM (Kali Linux at 192.168.56.101) orchestrates reconnaissance and exploitation against a deliberately vulnerable target (Metasploitable 2 at 192.168.56.102). The ReAct engine, classifiers, and MCP manager coordinate nmap reconnaissance, Metasploit RPC calls, and post-exploit tools through the HexStrike MCP server, while Ollama provides local LLM inference to eliminate data exfiltration risks. This architecture exemplifies secure red team automation: all AI reasoning stays on-machine, attack traffic flows through isolated host-only networking, and the human analyst maintains supervisory control via the Operator interface. Fork this diagram to customize your own autonomous pentest lab, integrate alternative LLM providers, or adapt the MCP server configuration for your threat modeling scenarios. The dashed async/attack traffic notation clarifies command-and-control patterns without exposing sensitive payloads.