Charon's AI driver — the one that crawls, exploits and writes the engagement report — talks to a local model. Your traffic, credentials and findings never leave your machine, which is what makes it usable on a real engagement.
Three steps: install LM Studio, drop the model where it looks for it, then point Charon at it.
Get it from lmstudio.ai (free, Windows and macOS). Open it once so it creates its folders, then close it.
LM Studio expects <models>/<publisher>/<model>/file.gguf — two folder levels, or it won't appear in the list.
macOS
~/.lmstudio/models/charon/charon-ai/Charon-AI-Q6_K.gguf
Windows
%USERPROFILE%\.lmstudio\models\charon\charon-ai\Charon-AI-Q6_K.gguf
If you changed LM Studio's models directory, use that path instead — it's shown under My Models in the app. The two folder levels (charon/charon-ai) still apply.
>_ tab).http://localhost:1234.In Charon, open Settings → AI and enter:
Provider OpenAI-compatible Base URL http://localhost:1234 Model charon-ai API key (leave blank)
Save, then toggle AI on. The model name must match what LM Studio shows in its dropdown. The base URL is the host only — Charon appends the rest of the path itself, so don't include /v1.
You're set: the AI tab now has Watch and Auto, the engagement log, and the report.
Memory. The model holds about 7.4 GB while loaded. On a 16 GB machine, running it at the same time as a thorough scan and a browser will push the machine into swap and slow everything down. Charon releases the model when you close a project and reloads it on demand, so you rarely need to think about it — but if a scan feels slow, eject the model in LM Studio for the duration.
What the AI needs the model for. The exploitation chains are deterministic and run without it. The model is what decides the next move, explains a finding, and writes the report.