# Shannon

> Shannon is an autonomous, white-box AI pentester for web applications and APIs that analyzes source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

Shannon is an autonomous AI penetration testing tool developed by Keygraph that performs white-box security testing of web applications and their underlying APIs. It combines source code analysis with live exploitation to identify and validate vulnerabilities, ensuring only findings with working proof-of-concept exploits are included in the final report. Shannon is available as Shannon Lite (AGPL-3.0, open source) for local testing and Shannon Pro (commercial) for organizations needing a full AppSec platform with SAST, SCA, secrets scanning, and CI/CD integration.

- **Fully Autonomous Operation**: *Launch a full pentest with a single command; Shannon handles 2FA/TOTP logins, browser navigation, exploitation, and report generation without manual intervention.*
- **Reproducible Proof-of-Concept Exploits**: *The final report contains only proven, exploitable findings with copy-and-paste PoCs — vulnerabilities that cannot be exploited are not reported.*
- **OWASP Vulnerability Coverage**: *Identifies and validates Injection, XSS, SSRF, and Broken Authentication/Authorization, with additional categories in development.*
- **Code-Aware Dynamic Testing**: *Analyzes source code to guide attack strategy, then validates findings with live browser and CLI-based exploits against the running application.*
- **Integrated Security Tooling**: *Leverages Nmap, Subfinder, WhatWeb, and Schemathesis during reconnaissance and discovery phases.*
- **Parallel Processing**: *Vulnerability analysis and exploitation phases run concurrently across all attack categories for faster results.*
- **Workspace & Resume Support**: *Every run creates a checkpointed workspace; interrupted scans can be resumed without re-running completed agents.*
- **Multi-Provider AI Support**: *Works with Anthropic API keys, AWS Bedrock, Google Vertex AI, or any Anthropic-compatible custom endpoint.*
- **Shannon Pro — All-in-One AppSec**: *Adds agentic SAST, SCA with reachability analysis, secrets detection, business logic testing, static-dynamic correlation, and native CI/CD integration with self-hosted deployment.*
- **Getting Started**: *Install via `npx @keygraph/shannon setup`, configure your AI provider credentials, then run `npx @keygraph/shannon start -u https://your-app.com -r /path/to/your-repo`.*

## Features
- Autonomous AI penetration testing
- White-box source code analysis
- Live exploit execution and validation
- Proof-of-concept exploit generation
- OWASP vulnerability coverage (Injection, XSS, SSRF, Auth)
- 2FA/TOTP login handling
- Browser automation for dynamic testing
- Parallel vulnerability analysis and exploitation
- Workspace checkpointing and resume support
- Multi-agent architecture
- Nmap, Subfinder, WhatWeb, Schemathesis integration
- AWS Bedrock and Google Vertex AI support
- Custom Anthropic-compatible endpoint support
- Shannon Pro: Agentic SAST with CPG-based data flow analysis
- Shannon Pro: SCA with reachability analysis
- Shannon Pro: Secrets detection with liveness validation
- Shannon Pro: Business logic security testing
- Shannon Pro: Static-dynamic correlation
- Shannon Pro: CI/CD and GitHub PR scanning
- Shannon Pro: Self-hosted runner deployment

## Integrations
Anthropic Claude, AWS Bedrock, Google Vertex AI, Docker, Nmap, Subfinder, WhatWeb, Schemathesis, LiteLLM, GitHub Actions, Temporal

## Platforms
WINDOWS, MACOS, LINUX, WEB, API, CLI

## Pricing
Open Source, Free tier available

## Links
- Website: https://keygraph.io/
- Documentation: https://github.com/KeygraphHQ/shannon
- Repository: https://github.com/KeygraphHQ/shannon
- EveryDev.ai: https://www.everydev.ai/tools/shannon-ai-pentester