shannon for autonomous AI-driven pentesting of web apps and APIs

shannon is an autonomous AI pentesting agent that combines source-code analysis with live, PoC-backed exploitation of web applications and APIs, built for authorized pre-production security testing.

Tool	KeygraphHQ/shannon — open-source autonomous AI pentester for web applications and APIs that proves vulnerabilities with working exploits
Category	AI-driven offensive security automation / application security testing
Primary Use	Running exploitation-backed pentests against staging environments and release candidates in the SDLC, with PDF, Markdown, and SARIF output gating CI/CD pipelines
Safe Use	Explicitly authorized assessments of systems you own or have written permission to test; the README warns against production targets. Designed for staging environments, labs, and internal security programs
Telemetry Note	Runs locally with Docker worker containers, local workspaces, and BYOK model traffic sent directly to your chosen provider — defenders observe it via the ephemeral worker containers, read-only repo mounts, and network traffic it generates against the target

shannon, published by KeygraphHQ, is an autonomous AI pentesting agent for web applications and APIs, and its positioning is unusually blunt for the genre: no exploit, no report. Rather than emitting the speculative finding lists that plague traditional SAST and DAST scanners, shannon combines static source-code analysis with live exploitation via browser automation and command-line tooling, and only vulnerabilities confirmed by a working proof of concept make it into the final report. The repository is Shannon Open Source — the full agent runnable from your own CLI — while the same engine powers Keygraph's commercial platform. The project sits at roughly 48 thousand stars, is written in TypeScript, and ships under AGPL-3.0, which is a meaningful licensing signal for anyone embedding it into a commercial pipeline.

The stated rationale in the README is a cadence argument. Expert human pentests happen perhaps annually, while AI-assisted coding tools ship code continuously, leaving a 364-day gap where vulnerabilities reach production untested. shannon addresses the long tail of internal apps, APIs, and fast-moving services that never get human attention, shifting pentesting left into the software development lifecycle. Notably, the authors explicitly disclaim replacement of human pentesters — the README argues that expert judgment, business context, and creative attack chaining remain human territory, and positions the agent as coverage for what security teams cannot scale to reach.

Getting started is deliberately minimal. The interactive launcher is invoked with npx @keygraph/shannon@latest, and prerequisites are Docker for the worker container, Node.js 18+, and AI provider credentials. The agent is provider-agnostic and strictly bring-your-own-key: Anthropic, OpenAI, xAI, and AWS Bedrock are supported, along with any OpenAI-compatible endpoint, LLM gateway via custom base URL, or fully local models served through Ollama, vLLM, or LM Studio. Keygraph claims never to proxy model traffic, so a local endpoint keeps both source code and scan data entirely inside your environment — a privacy posture that matters when the target repo is proprietary.

Architecturally, shannon separates orchestration from execution. The CLI pulls a worker image from Docker Hub, starts local infrastructure, mounts the target repository read-only inside an ephemeral worker container, and writes results to a local workspace. This sandboxing is the right instinct: the agent reads your code in an isolated container rather than running free on a developer workstation. The two-phase methodology is the more interesting design decision — a deep code-analysis phase maps architecture, trust boundaries, interfaces, data flows, and critical assets first, then feeds credible candidate attack paths to live pentesting agents that attempt actual exploitation against the running application. That contrasts with scanners that blast generic payloads blind.

Shannon 3.0, the current major release, brought deeper security code analysis, more thoroughly vetted findings, a rebuilt CLI, native CI/CD support, professional PDF reports, and SARIF output. CI/CD integration is a first-class capability rather than an afterthought: an official GitHub Action and a GitLab CI/CD component let you preserve artifacts, publish findings, and gate releases on proven vulnerabilities. For a security automation tool, release-gating on demonstrated — not theoretical — flaws is the correct semantics, since it avoids the alert fatigue generated by unverified scanner noise that development teams routinely ignore.

The reporting layer produces evidence-rich PDF and Markdown reports plus JSON and SARIF 2.1.0, with SARIF enabled by default for exploit-mode scans. SARIF matters because it makes findings consumable by GitHub code scanning and standard vulnerability management tooling, bridging offensive output into defensive workflows. The README publishes benchmark reports from scans of Photoview 2.4.0, the same target used in Doyensec's comparison of Aikido and XBOW, with PDFs and SARIF files from runs using models including DeepSeek, Grok, and Claude Opus variants — a level of public methodological transparency that most security vendors avoid, though the associated follow-up comparison document naturally favors the vendor's own tool and should be read critically.

Authenticated testing is supported through configuration, including credentials, login flows, TOTP, email authentication, focus areas, and rules of engagement. This is where autonomous agents typically either prove their worth or fall apart, since authenticated attack surface — broken authorization, IDOR, privilege escalation — is where the exploitable bugs actually live, and the OWASP-focused coverage list explicitly targets injection, XSS, SSRF, broken authentication, and broken authorization. Resumable workspaces add operational maturity: interrupted scans resume without repeating completed work, which matters when an LLM-driven run burns API credits by the hour.

Safety framing deserves specific attention. The README carries an explicit warning that shannon actively executes exploits and must only be run against applications you own or have explicit written authorization to test, and never against production. There is also a refreshingly honest prerequisite: Anthropic and OpenAI apply real-time cyber safeguards that can interrupt a scan mid-run, and the docs instruct legitimate security testers to complete provider guidance before the first run. This acknowledges a real operational friction point for AI-assisted offensive tooling that most projects in this space quietly omit. Any professional use should sit inside a defined scope of engagement, against staging or otherwise disposable environments, with rules of engagement configured up front.

From a defender's perspective, shannon leaves observable traces worth understanding. It generates real network traffic against the target — reconnaissance, probing, and exploitation attempts from browser automation and CLI tooling — so WAF logs, application logs, and anomaly detection will see patterns resembling a human-driven pentest, just faster and more repetitive. On the operator side, the ephemeral Docker worker, read-only repo mount, local workspace, and direct-to-provider model traffic define its footprint. Blue teams running it against their own staging environments should expect findings gated on working PoCs, meaning every reported item has a reproducible exploit path rather than a pattern-match heuristic.

There are trade-offs to weigh. The dependency on commercial LLM APIs means recurring cost per scan, though subscription-based routes via OpenAI Codex and xAI are supported, and version 1.9.0 was the last release built on the Claude Agent SDK for Claude Code subscription users — a compatibility note worth checking before committing to a workflow. The AGPL license may complicate embedding in closed-source CI infrastructure for some organizations. And the vendor-run benchmark comparisons, while transparently published, should be independently validated against your own applications before trusting coverage claims.

Where shannon fits in an authorized workflow is clear: continuous, exploitation-backed testing of staging environments and release candidates, with SARIF feeding existing vulnerability management and CI gates preventing proven flaws from shipping. It does not replace the annual deep assessment, and its authors say so plainly. What it offers is a credible attempt to make proof-of-concept-verified pentesting a routine build-step event rather than an annual exception — and the no-exploit-no-report discipline is the design choice that makes that ambition defensible. For AppSec teams drowning in scanner noise, an agent that reports only what it can actually break is a meaningful filter, provided it stays pointed exclusively at systems you are authorized to test.

Official project repository for KeygraphHQ/shannon.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.