shannon

Shannon is an autonomous AI penetration testing tool developed by Keygraph that performs security testing against web applications and their underlying APIs. It first analyzes the application's source code to identify potential attack paths, then executes real exploits against the running application through browser automation and command-line tools, including in the final report only vulnerabilities with a working proof of concept (PoC).

[Purpose] Shannon is designed to shift penetration testing left into the software development lifecycle (SDLC), providing on-demand, automated security testing for every build or release to fill security gaps beyond traditional annual penetration testing. It is intended for application environments that you own or have explicit written authorization to test, and is especially suitable for running in staging or local development environments.

[Key Capabilities]

• No exploit, no report: Reports only vulnerabilities confirmed by a reproducible PoC, reducing scanner noise.
• Advanced code analysis: Before sending trusted attack paths to the live penetration testing agent, it first maps out the architecture, trust boundaries, interfaces, data flows, and critical assets.
• Autonomous execution: A single command runs the entire reconnaissance, analysis, exploitation, and reporting workflow.
• Real-time terminal experience: Simplifies scan setup, displays agent progress and results, and does not expose orchestration logs.
• Authenticated testing: Supports credentials, login flows, TOTP, email authentication, focus areas, and rules of engagement through configuration.
• OWASP coverage: Tests exploitable injection, XSS, SSRF, broken authentication, and broken authorization.
• Resumable workspaces: Interrupted scans can be resumed without repeating completed work.
• Native CI/CD integration: Runs through the official GitHub Action or GitLab CI/CD component, preserves artifacts, publishes findings, and can gate releases based on proven vulnerabilities.
• Multi-format reporting: Provides evidence-rich PDF and Markdown reports, as well as JSON and SARIF 2.1.0; SARIF is enabled by default in exploit-mode scans.
• Provider-agnostic and BYOK: Supports Anthropic, OpenAI, xAI, AWS Bedrock, compatible APIs, and LLM gateways, as well as local models provided through Ollama, vLLM, or LM Studio.
• Privacy by design: Runs in your infrastructure, stores results locally, and sends model requests directly to the endpoint you choose; local endpoints can keep data within the environment.

[Usage] Prerequisites: Docker (required for worker containers), Node.js 18+ (npx workflow recommended), AI provider credentials (bring your own key; Keygraph does not proxy model traffic), and clearing network security safeguards at the provider (Anthropic and OpenAI have real-time safeguards for network security workloads that may interrupt scans; their guidance for legitimate security testers must be completed before the first run). Run: Shannon pulls the worker image from Docker Hub, starts the required local infrastructure, mounts the target repository read-only into a temporary worker container, and writes results to the local workspace. An interactive launcher guides you through setup and the first penetration test. For source builds, authenticated scans, provider-specific setup, and platform instructions, see the documentation. If you prefer to use subscriptions instead of API credits: OpenAI Codex (supports ChatGPT Plus and Pro subscriptions) and xAI (Grok) have corresponding setup guides; Claude Code subscriptions are not supported by the latest version, but you can use the final version 1.9.0 based on the Claude Agent SDK and its guide.

[Use cases]

• Continuous penetration testing of pre-release and development environments.
• Integration into GitHub Actions or GitLab CI/CD, where it can run on pull requests, releases, or scheduled tasks, retain PDF, Markdown, and SARIF reports and logs, and optionally fail the pipeline when exploited vulnerabilities at or above a configured severity threshold are found. The severity gate only counts findings with a status of exploited.
• Suitable for teams with understaffed security teams that need coverage for long-tail internal applications and rapidly iterating services.

[Limitations]

• Shannon is not a passive scanner: its exploitation agent can create users, submit forms, change application state, trigger outbound requests, etc., so sandboxed, pre-release, or local development environments and disposable data must be used.
• Must not be run against production systems, systems, repositories, or applications you do not own or are not authorized to test.
• Does not scan untrusted or adversarial codebases, because AI tools that read source code may face prompt injection risks.
• Findings still require human review; LLM-generated reports may contain weak evidence or incorrect details.
• Model capabilities vary, and models that do not follow Shannon's instructions or tool-use constraints will produce weaker results.
• A full run takes about 1 to 1.5 hours,and may incur LLM API costs depending on model pricing and application complexity.
• Shannon is tuned for fast, code-based daily development and CI/CD penetration testing; exhaustive agentic SAST, broader scanner coverage, centralized governance, and full-lifecycle vulnerability management are provided by the commercial Pro, Enterprise, and Community Program offerings.
• Licensed under GNU AGPL v3.0; for commercial and enterprise licensing, contact shannon@keygraph.io.
• External code contributions are not currently accepted, but bug reports and feature requests via Issues are welcome.