VectraYX-Nano: A 42M-Parameter Spanish Cybersecurity LLM with Native MCP Tool Integration

We present VectraYX-Nano, a 41.95M-parameter decoder-only language model trainedfrom scratch in Spanish for cybersecurity, with a Latin-American regional focusand native tool invocation via the Model Context Protocol (MCP). The model isbuilt around four contributions. (i) Corpus: VectraYX-Sec-ES, a 170M-tokenSpanish corpus assembled by an eight-VM distributed pipeline at ~$25 USD of cloudcompute, partitioned into three curriculum phases: conversational (42M tokens,OpenSubtitles-ES and OASST1), cybersecurity (118M tokens, NVD, Wikipedia-ES,in-house Spanish CVE mirror, security blogs), and offensive-security tooling(10M tokens, ExploitDB, HackTricks, OWASP). (ii) Architecture: a 42M-parameterTransformer decoder combining Grouped-Query Attention, QK-Norm, RMSNorm, SwiGLU,RoPE, and a z-loss auxiliary, paired with a domain-balanced 16,384-tokenbyte-fallback BPE tokenizer. (iii) Curriculum with replay: continual pre-trainingacross three phases with a replay buffer mitigates catastrophic forgetting andyields a monotonic loss descent (9.80 -> 3.17 -> 3.00 -> 2.16). After SFT thereleased model attains a conversational gate of 0.78 +/- 0.05 over N=4 seeds.(iv) Two empirical findings: A controlled bootstrap-corpus ablation exposes aloss-versus-register inversion -- lower-perplexity bootstraps yield worseconversational behavior at the nano scale. A post-hoc LoRA study shows that thetool-selection floor of 0.000 on the mixed SFT corpus is a corpus-densityartifact: a tool-dense corpus (2,801 examples, ratio 1:21) raises B4 to0.145 +/- 0.046 on Nano 42M and 0.445 +/- 0.201 on a 260M mid-tier (N=4 seeds).The released GGUF artifact is 81 MB in F16 (~20 MB in 4-bit), runs atsub-second time-to-first-token on commodity hardware, and is, to our knowledge,the first published Spanish-native cybersecurity LLM with end-to-end MCPintegration.