Shannon

Shannon is an autonomous AI pentester that combines source-code analysis with live exploit execution against web applications and APIs. Unlike static scanners that flag potential issues, Shannon only reports a finding when it can produce a working proof-of-concept, making every item in the report a confirmed, exploitable vulnerability. It covers OWASP-focused classes including SQL injection, XSS, SSRF, broken authentication, IDOR, and authorization bypasses.

Shannon runs via npx on Node.js 18+ with Docker providing the ephemeral worker container. Start with `npx @keygraph/shannon setup` to configure your AI provider credentials through an interactive wizard, then run `npx @keygraph/shannon start -u https://your-app.com -r /path/to/your-repo` to kick off a pentest. Anthropic is the recommended AI provider, but AWS Bedrock and Google Vertex AI are also documented. Never run Shannon against a system you don't own or have explicit written authorization to test.

Shannon Open Source is released under the AGPL-3.0 license and is free to run yourself. You will incur AI provider costs (Anthropic, AWS Bedrock, or Google Vertex AI) per scan, as Shannon does not include an LLM. The commercial Keygraph platform, which wraps Shannon with continuous scanning, managed findings, and automated remediation, has separate enterprise pricing; the Keygraph site notes that early-stage startups and non-profits get free access to the full platform.

Shannon is best for development teams that ship code continuously and want more than an annual pen test. It is particularly strong for white-box, source-aware testing where having the repository enables Shannon to plan realistic attack paths rather than blind fuzzing. Teams validating OWASP vuln classes (injection, XSS, SSRF, auth, authorization) with reproducible PoCs, before a release or as part of a CI pipeline, get the most value from it.

Shannon Open Source is white-box only and runs on demand from the CLI, producing a local Markdown report. The Keygraph platform adds continuous black-box and grey-box pentest modes, Code Property Graph SAST, SCA with reachability analysis, secrets and container scanning, a canonical findings system with deduplication across sources, SLA tracking, Jira sync, automated fix PRs verified by point re-test, and self-hosted or air-gapped deployment. Per the README comparison table, the open-source edition is complete for proof-by-exploitation testing; the platform closes the full AppSec lifecycle around that engine.

Shannon executes real exploits, so it must only be run against applications and environments you own or have explicit written authorization to test; the README warns explicitly against running it against production systems. The open-source edition supports white-box mode only, black-box and grey-box require the Keygraph platform. Automated remediation (an auto-opened PR with a fix) is also a platform-only feature; in the open-source edition you fix manually from the report. Docker and Node.js 18+ are hard requirements.