Shannon

Shannon is an autonomous AI penetration testing tool developed by Keygraph that performs white-box security testing of web applications and their underlying APIs. It combines source code analysis with live exploitation to identify and validate vulnerabilities, ensuring only findings with working proof-of-concept exploits are included in the final report. Shannon is available as Shannon Lite (AGPL-3.0, open source) for local testing and Shannon Pro (commercial) for organizations needing a full AppSec platform with SAST, SCA, secrets scanning, and CI/CD integration.

• Fully Autonomous Operation: Launch a full pentest with a single command; Shannon handles 2FA/TOTP logins, browser navigation, exploitation, and report generation without manual intervention.
• Reproducible Proof-of-Concept Exploits: The final report contains only proven, exploitable findings with copy-and-paste PoCs — vulnerabilities that cannot be exploited are not reported.
• OWASP Vulnerability Coverage: Identifies and validates Injection, XSS, SSRF, and Broken Authentication/Authorization, with additional categories in development.
• Code-Aware Dynamic Testing: Analyzes source code to guide attack strategy, then validates findings with live browser and CLI-based exploits against the running application.
• Integrated Security Tooling: Leverages Nmap, Subfinder, WhatWeb, and Schemathesis during reconnaissance and discovery phases.
• Parallel Processing: Vulnerability analysis and exploitation phases run concurrently across all attack categories for faster results.
• Workspace & Resume Support: Every run creates a checkpointed workspace; interrupted scans can be resumed without re-running completed agents.
• Multi-Provider AI Support: Works with Anthropic API keys, AWS Bedrock, Google Vertex AI, or any Anthropic-compatible custom endpoint.
• Shannon Pro — All-in-One AppSec: Adds agentic SAST, SCA with reachability analysis, secrets detection, business logic testing, static-dynamic correlation, and native CI/CD integration with self-hosted deployment.
• Getting Started: Install via npx @keygraph/shannon setup, configure your AI provider credentials, then run npx @keygraph/shannon start -u https://your-app.com -r /path/to/your-repo.