shannon

Shannon, developed by Keygraph, is an autonomous AI penetration-testing agent for web applications and their underlying APIs. Its guiding rule is "no exploit, no report": a candidate issue only becomes a finding if Shannon can demonstrate it with a working proof of concept against the running application. How it works - Recon and vulnerability analysis explore the live application, connect runtime behaviour back to source, and run specialised agents across Injection, XSS, SSRF, Authentication and Authorization. - Agentic security code analysis maps architecture, trust boundaries, exposed interfaces, dependencies, data flows and high-risk assets, then opens targeted investigations. - Finding reconciliation merges and de-duplicates both candidate streams into an exploitation queue. - Exploitation agents attempt real proof-of-concept attacks; anything not demonstrated is discarded. - Reporting produces PDF and Markdown reports with attached evidence, plus structured JSON and SARIF 2.1.0 (written by default for exploit-mode scans) for downstream tools and CI/CD gates. Running it - Prerequisites: Docker for the worker container, Node.js 18+ for the recommended npx workflow, and your own AI provider credentials. - Launch with `npx @keygraph/shannon@latest setup`, then `npx @keygraph/shannon@latest start -u https://your-app.com -r /path/to/your/repo`. - The target repository is mounted read-only inside an ephemeral Docker container with an isolated workspace; results are written to a local workspace, and interrupted scans can be resumed. Configuration and coverage - Supports authenticated testing, login flows, TOTP and email authentication, focus areas and rules of engagement. - OWASP-focused coverage of exploitable injection, XSS, SSRF, broken authentication and broken authorization. - Provider-agnostic and BYOK: Anthropic, OpenAI, xAI and AWS Bedrock are built in, other harness-catalogue providers work, custom base URLs allow proxies or LLM gateways, and local models can be served through Ollama, vLLM or LM Studio. - Official integrations exist for GitHub Actions and GitLab CI/CD, preserving reports and logs, supporting PR, release and scheduled pentests, and optionally failing a pipeline when an exploited finding meets a configured severity threshold. Only findings with `status: exploited` count toward severity gates. Editions and caveats The open-source edition is positioned for individual developers and small teams running local or CI-driven tests, while the commercial Keygraph Enterprise Platform adds exhaustive agentic SAST, continuous pentesting and full-lifecycle vulnerability management. Shannon is not a passive scanner: its exploitation agents can create users, submit forms, mutate application state and trigger outbound requests. It should only be used against systems you own or are explicitly authorised to test, and preferably against sandboxed, staging or local environments with disposable data. Documented limitations include the need for human review of LLM-generated findings, a full run taking roughly one to one and a half hours, possible LLM API costs, varying model capability, and prompt-injection risk when pointed at untrusted codebases. It is licensed under the GNU AGPL v3.0, with commercial licensing available separately.