Shannon

What it is

An open-source agent from Keygraph that studies an application's code, then attacks the running app and its APIs through browser automation and command-line tools. Only issues backed by a working proof of concept make it into the report. The same engine powers Keygraph's paid Pro and Enterprise editions.

What it helps with

- Testing for injection, XSS, SSRF, and broken authentication or authorization
- Confirming each finding with a reproducible proof of concept
- Running pentests on every build through GitHub Actions or GitLab CI/CD
- Producing PDF, Markdown, JSON, and SARIF reports

Who it's for

AppSec and pentest teams testing web apps and APIs they own or are explicitly authorized to assess. Authorized use only.

Worth knowing

Each scan runs in a throwaway Docker container, and you bring your own model provider key, such as Anthropic, OpenAI, xAI, AWS Bedrock, or a local model. A full run takes about 1 to 1.5 hours.

Is Shannon free?
The open-source edition is free under AGPL-3.0, while Pro and Enterprise are paid.

Can I run it against production?
No, it executes real exploits, so point it at staging or development environments.

How does it compare with Strix or XBOW?
In our view they solve the same problem of AI-driven pentesting, and Shannon stands out by using source code to guide its attacks.