Shannon is the agent. This repository is Shannon Open Source, the standalone pentester you run yourself. The same Shannon also powers the Keygraph platform, Keygraph's commercial pentesting product. See Editions for how the two compare.

Why Shannon Exists

Thanks to tools like Claude Code and Cursor, your team ships code non-stop. But your penetration test? That happens once a year. This creates a massive security gap. For the other 364 days, you could be unknowingly shipping vulnerabilities to production.

Shannon closes that gap by providing on-demand, automated penetration testing that can run against every build or release.

Shannon in Action

Sample penetration test reports from intentionally vulnerable applications, produced by Shannon Open Source:

Quick Start

Prerequisites

• Docker: required for the worker container.
• Node.js 18+: required for the recommended npx workflow.
• AI provider credentials: Anthropic is recommended. AWS Bedrock and compatible proxy setups are documented separately.

Run Shannon

[!WARNING] Shannon actively executes exploits. Run it only against applications and environments you own or have explicit written authorization to test. Do not run Shannon against production systems.

# Configure credentials with the interactive wizard.
npx @keygraph/shannon setup

# Run a pentest against a source-available target.
npx @keygraph/shannon start -u https://your-app.com -r /path/to/your-repo

Shannon pulls the worker image from Docker Hub, starts the required local infrastructure, mounts the target repository read-only inside an ephemeral worker container, and writes results to a local workspace.

For source builds, authenticated scans, provider-specific setup, and platform notes, see Documentation.

Key Capabilities

• Proof-by-exploitation reports: Shannon reports validated findings with reproducible proof-of-concept steps instead of speculative warnings.
• White-box attack planning: Shannon uses source-code analysis to guide dynamic testing and focus on realistic attack paths.
• Autonomous execution: Shannon launches reconnaissance, vulnerability analysis, exploitation, and report generation from a single command.
• Authenticated testing: configuration files can describe login flows, test credentials, TOTP, email-based login flows, focus areas, and rules of engagement.
• OWASP-focused coverage: Shannon targets exploitable Injection, XSS, SSRF, Broken Authentication, and Broken Authorization issues.
• Resumable workspaces: Shannon can resume interrupted runs without re-running completed agents.

Editions

Shannon ships in two ways: Shannon Open Source, the pentester you run yourself, and the Keygraph platform, the commercial pentesting product that runs Shannon continuously and closes the full AppSec lifecycle around it.

Shannon Open Source (this repository) is the standalone pentester: a CLI agent for white-box, proof-by-exploitation testing of web applications and APIs you own or are authorized to test. It reads your source, plans attacks, executes real exploits, and reports only what it can prove. It runs on demand and is complete in that lane. You point it at a target, it pentests, it reports.

The Keygraph platform is the enterprise-ready, continuous pentesting product powered by Shannon. In the Keygraph platform, an enhanced build of Shannon runs continuously in a hardened, orchestrated environment fed by Keygraph's full code-analysis stack. Around that engine, the platform closes the entire vulnerability lifecycle, from analysis to a verified fix:

• Analyze: Code Property Graph SAST, SCA with reachability, secrets, IaC, and container scanning. First-class detection in their own right, and context that sharpens Shannon's attacks.
• Prove: autonomous black-box and source-aware white-box pentests turn candidate findings into proven, exploited vulnerabilities rather than speculative alerts.
• Manage: one canonical record per vulnerability per repository, deduplicated across every source, with ownership, status, SLA tracking, dashboards, and bidirectional Jira sync.
• Remediate and verify: patches written automatically and re-tested against the patched code before delivery, landing in your existing review workflow rather than auto-applied.
• Deploy: self-hosted and air-gapped environments, strict bring-your-own-key model access, and customer-controlled LLM gateway patterns, so source, results, and model traffic stay inside your perimeter.

Shannon is the proof engine at the center of the Keygraph platform. Shannon Open Source gives you that engine to run yourself. The Keygraph platform surrounds Shannon with continuous analysis, finding management, remediation, verification, and enterprise deployment.

Learn more on the Keygraph website, read the Keygraph platform technical overview, start a free trial or book a demo, or contact shannon@keygraph.io.

Architecture

Shannon uses a multi-agent workflow that combines source-code analysis with live exploitation:

        ┌──────────────────────┐
        │   Pre-Reconnaissance │
        │   (source code scan) │
        └──────────┬───────────┘
                   │
                   ▼
        ┌──────────────────────┐
        │   Reconnaissance     │
        │  (attack surface     │
        │   mapping)           │
        └──────────┬───────────┘
                   │
                   ▼
        ┌──────────┴───────────┐
        │          │           │
        ▼          ▼           ▼
  ┌───────────┐ ┌───────────┐ ┌───────────┐
  │ Vuln      │ │ Vuln      │ │   ...     │
  │(Injection)│ │  (XSS)    │ │           │
  └─────┬─────┘ └─────┬─────┘ └─────┬─────┘
        │              │             │
        ▼              ▼             ▼
  ┌───────────┐ ┌───────────┐ ┌───────────┐
  │ Exploit   │ │ Exploit   │ │   ...     │
  │(Injection)│ │  (XSS)    │ │           │
  └─────┬─────┘ └─────┬─────┘ └─────┬─────┘
        │              │             │
        └──────┬───────┴─────────────┘
               │
               ▼
        ┌──────────────────────┐
        │      Reporting       │
        └──────────────────────┘

At a high level:

• Pre-reconnaissance identifies frameworks, entry points, data flows, and likely attack surfaces from the repository.
• Reconnaissance explores the live application and correlates runtime behavior with code-level context.
• Vulnerability analysis runs specialized agents for Injection, XSS, SSRF, Authentication, and Authorization.
• Exploitation attempts real proof-of-concept attacks and discards hypotheses that cannot be proven.
• Reporting compiles validated findings, evidence, and remediation guidance into a final Markdown report.

Each scan runs in an ephemeral Docker container with an isolated workspace and per-invocation orchestration.

Documentation

Use these guides for operational detail: