Shannon is an open-source AI-powered pentester for web apps and APIs. It analyzes source code and runs real exploits to prove vulnerabilities, with Docker-based execution and a CLI workflow.
Collecting history — the radar snapshots this repo daily. The trend line appears after 3 days of data (1 so far).
What it is
Shannon is an autonomous AI pentester for web applications and APIs. It analyzes your source code to identify attack vectors and executes real exploits to prove vulnerabilities before production. This repository is Shannon Open Source, the standalone pentester run locally from the command line.
How it works
Shannon combines source-code analysis with live exploitation. It analyzes the repository to identify attack surfaces, then interacts with the running application (via browser automation and command-line tools) to attempt proofs-of-concept and generate reports containing validated findings and remediation guidance. Each scan runs in an ephemeral Docker container with an isolated workspace and per-invocation orchestration.
Getting started
Prerequisites
- Docker: required for the worker container.
- Node.js 18+: required for the recommended
npxworkflow. - AI provider credentials: Anthropic, OpenAI, xAI, or AWS Bedrock. Claude models are recommended.
- Cyber safeguards cleared with your provider: Anthropic and OpenAI apply real-time safeguards to cyber-security workloads.
Run Shannon
# Configure credentials with the interactive wizard.
npx @keygraph/shannon setup
# Run a pentest against a source-available target.
npx @keygraph/shannon start -u https://your-app.com -r /path/to/your-repo
Shannon pulls the worker image from Docker Hub, starts the required local infrastructure, mounts the target repository read-only inside an ephemeral worker container, and writes results to a local workspace.
For additional setup and platform notes, see Documentation in the repo.
Recent releases
- v2.2.0 (2026-08-04): includes worker upgrades and prompt substitution fixes.
- v2.1.0 (2026-07-30): multi-provider model support, SARIF output, and exploit-mode fixes.
- v2.0.0 (2026-07-16): migrant runtime improvements to agent framework.
- v1.9.0 (2026-07-04): CLI run-folder restructuring and terminal UX improvements.
- v1.8.1 (2026-06-23): bug fixes.
Traction
- stars: 46425
- forks: 5360
- open_issues: 33
License
Shannon Open Source is licensed under the GNU Affero General Public License v3.0. Commercial licensing is available. For license details, see LICENSE and related sections in the README.
Behind the repo
Keygraph is the company behind Shannon and the commercial Keygraph platform. This section is not present as a linked startup/company in the provided facts beyond the organization name in the README context.
Caveats
- License: AGPL-3.0 for the Open Source version.
- A full run can take roughly 1 to 1.5 hours and may incur LLM API costs depending on model pricing and application complexity.
- Shannon actively executes exploits and should be used only on systems you own or have explicit authorization to test; do not run against production.
- Claude models are officially supported; other models may be incomplete or unstable.