Metasploit's Ruby 3.3.8 console organizes authorized exploit work
Metasploit Framework currently pins Ruby 3.3.8 and centers its workflow on msfconsole. Operators search for a module, inspect its required options, configure a target and payload, then run it inside an authorized assessment. The repository separates exploit, auxiliary, payload, and post-exploitation code while sharing common session and datastore machinery. That is the main reason to use Metasploit: a tester learns one console instead of memorizing a different interface for every proof of concept.
The checkout also includes msfvenom for payload generation, msfdb for database setup, and JSON-RPC entry points for automation. Those components can turn an interactive lab tool into part of a repeatable test process, but they raise the cost of operating it safely. Generated files, listener addresses, captured credentials, and session records all need handling rules. Our measured repository contained 14,957 files and about 1,671,593 source lines, which is closer to a security platform than a single scanner.
The 201.6 MB checkout is too much for a scanner-only job
Metasploit occupied 201.6 MB immediately after checkout in our sandbox. That size buys shared module conventions, payload plumbing, documentation, APIs, and years of compatibility work across many target families. It also means a user looking only for open ports or one SQL injection check is taking on unrelated code and dependencies. Nmap is the clearer starting point for host and service discovery, while sqlmap stays focused on SQL injection.
Sliver and Empire address another slice of the same buyer's tool cabinet: adversary emulation and post-access command and control. They are alternatives when an exercise starts with an agent rather than a library of exploit modules. Metasploit remains the better general workbench when the task moves between checking, exploitation, payload generation, and sessions. The 20 CI workflow files we found match that breadth, but workflow count does not tell you whether the particular module and target version in front of you will behave correctly.
What happened when we ran it
Our run at commit 79c4de8 selected data/exploits/CVE-2026-75604/, a private Next.js project nested inside Metasploit's exploit data. Npm installed 272 packages in 30 seconds and consumed 330 MB on disk. Its build succeeded in 24 seconds. Those are useful facts about that checked-in exploit fixture, not an installation result for msfconsole, the Ruby gems, PostgreSQL, or the repository's main test suite.
The nested package exposed build, start, and production scripts but no test target, so the harness skipped tests. It reported no passing or failing cases. Npm audit found 3 known vulnerabilities, split into 1 critical and 2 high. The lab image was Node 22 in an unprivileged 3-CPU, 8 GB container with no secrets. Our measurement method did not execute an exploit, start the web fixture, or test a real target, so it says nothing about module effectiveness.
Nightly installers avoid the Ruby source dependency list
Rapid7's documentation says installers are built nightly for Windows, macOS, and Linux. They bundle dependencies such as Ruby and PostgreSQL, integrate with the host package manager, and perform database setup on first start. Metasploit also ships with Kali, which is the least surprising route for a tester who wants to use the console rather than change its code. Windows installation has a special cost: antivirus products often flag or remove the payload and exploit content.
A source checkout is developer work. The Linux guide installs Git, compiler tools, packet-capture headers, PostgreSQL headers, zlib, and SQLite headers before bundle install. It tells contributors to match .ruby-version, currently 3.3.8, instead of trusting a distribution's Ruby package. Database and REST API use can add PostgreSQL, Docker, migrations, and a non-root account. The repository README is brief, so anyone judging setup from that page alone will miss most of this dependency and service work.
The 493-issue queue makes module-level verification mandatory
GitHub search returned 493 open issues and 114 open pull requests on September 10, 2026. That is expected pressure for a project spanning old protocols, current products, payloads, and platform-specific behavior. It also means the project name is a poor proxy for whether one module is ready for your environment. Read that module's documentation, reproduce its stated target version, run its check path when available, and inspect open reports for the exact payload or protocol you intend to use.
Two current reports show why. Issue 21758 says a stageless PHP Meterpreter session fails with defaults unless stdapi is explicitly selected. Issue 21749 describes an MSSQL login scan leaving 7,962 sockets in CLOSE_WAIT in the reporter's environment, with descriptors released only after msfconsole exited. Neither report proves every related module is broken. Both are specific enough to justify a small target matrix, resource monitoring, and a forced cleanup path before unattended operation.
No GitHub release object does not mean Metasploit is dormant
The GitHub latest-release endpoint returned no release object, but the repository was pushed on September 9, 2026. GitHub listed 38,975 stars and 608 combined issues and pull requests when fetched. The issue search showed new activity in the same week, including a September 8 request for Windows AArch64 fetch-payload support followed by a pull request on September 9. Current code and triage activity are stronger health evidence here than an absent GitHub release record.
Distribution follows a different rhythm: the README sends users to nightly installers rather than a latest GitHub package. That suits security research, where module updates need to land quickly, but regulated teams must pin and promote a known build themselves. Metasploit earns its place in an isolated test environment because its shared console makes varied authorized work easier to repeat. The 3 audit findings in our nested fixture and the lack of a root Framework test result are enough reason to verify the exact path you plan to use before an engagement.