KeygraphHQ/shannon

What it solves

Shannon is an autonomous AI pentester designed to close the security gap between continuous code shipping and infrequent manual penetration tests. It identifies and proves vulnerabilities in web applications and APIs before they reach production, reducing the noise of speculative scanners by only reporting vulnerabilities that can be successfully exploited.

How it works

Shannon combines source-code analysis with live exploitation. It first maps the application's architecture, trust boundaries, and data flows to identify potential attack paths. It then uses browser automation and command-line tools to execute real proof-of-concept attacks against a running instance of the application. Only findings that are successfully exploited are included in the final report.

Who it’s for

It is built for individual developers and small teams who want to integrate automated, exploitation-backed security testing into their local development workflow or CI/CD pipelines (such as GitHub Actions and GitLab CI/CD).

Highlights

• No exploit, no report: Only reports vulnerabilities confirmed with a reproducible proof of concept.
• Autonomous execution: Handles reconnaissance, analysis, exploitation, and reporting from a single command.
• Provider agnostic: Supports a wide range of AI providers including Anthropic, OpenAI, xAI, AWS Bedrock, and local models via Ollama, vLLM, or LM Studio.
• CI/CD Integration: Native support for GitHub Actions and GitLab CI/CD to gate releases based on proven vulnerability severity.
• Private by design: Runs in the user's own infrastructure and stores results locally.