- Category
- Cybersecurity
- Rank
- No. 200Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- keygraphhq
- GitHub
- 48.1k stars
- Latest release
- v3.2.0
- Date
About
An autonomous AI pentester that analyzes web application source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before production deployment. It performs white-box security testing with actual proof-of-concept attacks rather than just theoretical vulnerability scanning.
What it does
Shannon coordinates source reconnaissance, live application mapping, specialized vulnerability analysis, exploitation, and report generation. It runs locally through a command-line workflow backed by Docker, checkpoints each agent’s progress, and keeps only findings supported by a working proof of concept.
Why it's ranked here
Shannon has a compellingly narrow purpose: turn likely web flaws into demonstrated attacks. Read-only source mounting, preflight credential checks, resumable workspaces, authenticated flows, and reproducible evidence make it more operationally useful than a speculative alert generator. Its value still depends on safe targets and expert review.
What's good
The workflow connects code context to observed runtime behavior, then separates analysis from exploitation. Configuration supports login steps, test credentials, two-factor flows, scope rules, focus areas, and report filtering. Interrupted scans can resume from checkpoints. Reports can also emit SARIF for exploitative runs, making confirmed findings easier to route into code-scanning workflows.
Tradeoffs
The open-source edition requires source access and covers only authentication, authorization, injection, cross-site scripting, and server-side request forgery. It omits many dependency, policy, configuration, secrets, infrastructure, and broad static-analysis findings. Runs can mutate or delete test data, typically take about one to one-and-a-half hours, incur model costs, and still require human verification. Claude is the only officially supported model family.
How to use it well
Use Shannon for authorized, source-available web applications in disposable local or staging environments. Give it dedicated test accounts, explicit engagement rules, and a repository that cannot influence the agent through hostile content. Run it around builds or releases, review every result, fix manually, then rerun. Pair it with dependency, secrets, configuration, infrastructure, and policy scanners for broader AppSec coverage.
Technical notes+
package.json defines a private ESM TypeScript workspace managed with pnpm and Turbo. apps/cli/tsdown.config.ts targets Node 18 and emits an executable ESM CLI bundle. apps/cli/src/mode.ts distinguishes local source builds from npx execution, while apps/cli/src/home.ts selects repository-local or user-home workspace storage. apps/cli/src/env.ts loads mode-specific configuration, validates model credentials before Docker work, supports Pi authentication, and forwards only common settings plus the selected provider’s credentials. apps/cli/src/tty.ts gates prompts and terminal effects on TTY capabilities. docs/workspaces.md documents checkpointed state and PDF output; docs/configuration.md adds authenticated flows, scope controls, filtering, and optional SARIF.
Observed
- License
- AGPL-3.0 for Shannon Open Source
- Primary language
- TypeScript with ESM modules
- Install surface
- Runs through npx or a pnpm source build
- Interface
- Local command-line application with a Docker worker
- Runtime support
- Node.js 18 or newer and Docker are required
- Platforms
- Linux and macOS are supported; Windows requires WSL2
- Output
- Workspace state, logs, prompts, deliverables, and a final PDF report
- Target model
- Strictly white-box testing requires application source code
Read from README.md, package.json, docs/safety.md, docs/platforms.md, docs/workspaces.md, docs/development.md, docs/ai-providers.md, docs/configuration.md, docs/coverage-roadmap.md, docs/keygraph-platform.md, apps/cli/tsdown.config.ts, apps/cli/src/env.ts, apps/cli/src/tty.ts, apps/cli/src/home.ts, apps/cli/src/mode.ts.
What it can do
Analyze web application source code for security vulnerabilities
Web application source code → Security vulnerability report with identified attack vectors
Execute real exploits to prove vulnerabilities
Identified vulnerability and target application → Proof-of-concept exploit demonstration
Perform white-box security testing
Web application codebase with full access → Comprehensive security assessment report
Identify attack vectors in web applications
Application source code and architecture → List of potential attack paths and entry points
Generate proof-of-concept attacks
Discovered vulnerabilities → Working exploit code and attack demonstrations
Test API security vulnerabilities
API source code and endpoints → API security vulnerability assessment
Tags
Tech Stack
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.