KeygraphHQ/shannon

What it solves

Shannon is an autonomous AI pentester designed to close the security gap between rapid code shipping and infrequent manual penetration tests. It identifies and proves vulnerabilities in web applications and APIs by combining source-code analysis with live exploitation, ensuring that only confirmed vulnerabilities—rather than speculative scanner noise—are reported.

How it works

Shannon operates through a multi-stage pipeline:

1. Analysis: It performs agentic security code analysis to map architecture, trust boundaries, and data flows, while simultaneously conducting reconnaissance on the running application.
2. Reconciliation: It merges findings from both the code and runtime analysis into a prioritized exploitation queue.
3. Exploitation: Autonomous agents attempt to execute real proof-of-concept attacks against the running target.
4. Validation: Any candidate that cannot be successfully exploited is discarded.
5. Reporting: Confirmed vulnerabilities are documented in PDF, Markdown, JSON, or SARIF formats.

Who it’s for

It is built for individual developers and small teams who want to integrate automated, exploitation-backed security testing into their local development workflow or CI/CD pipelines (such as GitHub Actions and GitLab CI/CD).

Highlights

• No exploit, no report: Only reports vulnerabilities with a reproducible proof of concept.
• Provider agnostic: Supports a wide range of AI providers including Anthropic, OpenAI, xAI, AWS Bedrock, and local models via Ollama or vLLM.
• CI/CD Integration: Can gate releases by failing pipelines when vulnerabilities above a certain severity threshold are exploited.
• Private by design: Runs in the user's own infrastructure using Docker, sending requests directly to the chosen LLM endpoint.
• Authenticated testing: Supports complex login flows, TOTP, and email authentication.