[opensourcedex]

shannon is a free, open source ai security & privacy project written in TypeScript and released under AGPL-3.0. It has 48,105 GitHub stars, 5,515 forks and 18 open issues, and was last pushed 9 days ago. On this registry it ranks #2 of 34 tracked projects in AI Security & Privacy, with 5 head-to-head comparisons available. It gained 66 stars over the last 3 tracked days.

What is shannon?

Shannon is an autonomous AI pentester for web applications and APIs that reads an application's source code, identifies attack paths, and executes real exploits so that only vulnerabilities with a working proof of concept are reported, built for AppSec, DevSecOps, and security engineering teams that ship code continuously.

What it is

Shannon is an autonomous AI pentester developed by Keygraph and published as Shannon Open Source: the full agent, run locally from the command line. It is written in TypeScript, licensed under AGPL-3.0, and carries topics including ai-penetration-testing, ai-security, api-security, appsec, ci-cd, devsecops, offensive-security, owasp, and penetration-testing. It performs security testing of web applications and their underlying APIs by combining source-code analysis with live exploitation: it analyzes source to identify potential attack vectors, then uses browser automation and command-line tools to execute real exploits against the running application and its APIs. Only vulnerabilities with a working proof-of-concept are included in the final report, a rule the README states as "No exploit, no report."

The problem it solves is timing. The README's own framing is that AI coding assistants such as Claude Code and Cursor let teams ship code non-stop, while the penetration test happens once a year, leaving a security gap for the other 364 days. Shannon closes that gap by providing on-demand, automated penetration testing that can run against every build or release. In effect, it replaces the calendar-bound, point-in-time pentest engagement with an agent you run yourself. This repository is the standalone agent; the same Shannon also powers the Keygraph platform, Keygraph's commercial pentesting product, and the README's Editions section compares the two.

Key capabilities

  • Autonomous exploitation with proof: only vulnerabilities with a working proof-of-concept are included in the final report.
  • Source-code analysis to find attack vectors, followed by browser automation and command-line tools to execute exploits against the live application and its APIs.
  • Rebuilt CLI in Shannon 3.0, launched with npx @keygraph/shannon@latest, with an interactive launcher that guides setup and a first pentest.
  • Native CI/CD integration, including GitHub Actions, so pentests can run per build or release.
  • Professional PDF reports and SARIF output in Shannon 3.0 for ingestion by other tooling.
  • Deeper security code analysis and more thoroughly vetted findings in Shannon 3.0.
  • llms.txt and llms-full.txt files that map the repository for AI agents and LLMs.

Who uses it and how

  • AppSec and security engineering teams that want pentest coverage between annual engagements, running Shannon on demand instead of waiting for a scheduled test.
  • DevSecOps teams wiring it into CI/CD pipelines and GitHub Actions, running it against every build or release.
  • Teams shipping quickly with AI coding assistants such as Claude Code and Cursor, where the README identifies the annual-pentest gap as the core risk.
  • Teams testing web applications together with their underlying APIs, matching the OWASP and API-security focus of the project's topics.
  • Organizations comparing a self-run agent against a commercial product: this repository is the open-source edition, while the same Shannon powers the Keygraph platform.

Getting started

Run npx @keygraph/shannon@latest; the interactive launcher walks through setup and a first pentest. The README's Prerequisites and Quick Start sections cover the details.

How it compares

The facts provide no list of paid products that Shannon replaces, and they name no comparable open-source pentester either, so within this registry it stands alone. The only named relation is the Keygraph platform, the same vendor's commercial pentesting product, which the same Shannon agent powers and which the README's Editions section contrasts with this open-source edition.

When to use it — and when not to

This is the full agent, run locally from your command line, so the operator owns execution, scope, and configuration, including the AI provider and bring-your-own-key questions the README addresses; no hosted option is described for this repository. It is explicitly not a replacement for human pentesters, who bring business understanding, unanticipated attack chaining, and years of judgment, so teams wanting a fully managed, zero-operation service should look elsewhere. Anyone unwilling to work under AGPL-3.0 terms should also weigh that licence first, and the README's Safety, Scope, and Limitations section should be read before running Shannon against any target.

project readme (upstream, from github) — read inline

[!NOTE] Shannon 3.0 is live: deeper security code analysis, more thoroughly vetted findings, a rebuilt CLI, native CI/CD, professional PDF reports, and SARIF.

KeygraphHQ%2Fshannon | Trendshift

Shannon is an autonomous, AI pentester for web applications and APIs.

It analyzes your source code, identifies attack paths, and executes real exploits to prove vulnerabilities before they reach production. No exploit, no report.

This repository is Shannon Open Source: the full agent, run locally from your command line.

Launch Shannon

npx @keygraph/shannon@latest

The interactive launcher will guide you through setup and your first pentest.

      

[!TIP] AI agents and LLMs: start with llms.txt for a concise map of this repository, or use llms-full.txt for the README and docs combined into one file.

Table of Contents

What is Shannon?

Shannon is an autonomous AI pentester developed by Keygraph. It performs security testing of web applications and their underlying APIs by combining source-code analysis with live exploitation.

Shannon analyzes your web application's source code to identify potential attack vectors, then uses browser automation and command-line tools to execute real exploits against the running application and its APIs. Only vulnerabilities with a working proof-of-concept are included in the final report.

Shannon is the agent. This repository is Shannon Open Source, the standalone pentester you run yourself. The same Shannon also powers the Keygraph platform, Keygraph's commercial pentesting product. See Editions for how the two compare.

Why Shannon Exists

Thanks to tools like Claude Code and Cursor, your team ships code non-stop. But your penetration test? That happens once a year. This creates a massive security gap. For the other 364 days, you could be unknowingly shipping vulnerabilities to production.

Shannon closes that gap by providing on-demand, automated penetration testing that can run against every build or release.

Why "Shannon"?

It's named after Claude Shannon, the father of information theory. At its core, pentesting is an information problem: every probe reduces uncertainty about a system's state. The best tools maximize the signal gained from every request, turning those bits of knowledge into an exploit path.

Also, we wanted you to be able to say, "Hey Claude, run Shannon" to find all the security flaws in your vibe-coded app.

Not a replacement for human pentesters

Shannon is built to work alongside expert pentesters and red teamers, not replace them. Great pentesters understand the business, chain attacks in ways nobody anticipated, and bring years of judgment that current models can't match.

Shannon solves a different problem: there is far more software to test than security teams have time to cover. Critical systems get periodic expert assessments, while the long tail of internal apps, APIs, and fast-moving services rarely gets tested at all.

Shannon shifts pentesting left into the software development lifecycle (SDLC). Use it to run exploitation-backed tests against staging environments and releases at the cadence they actually ship, and save expert human time for the risks that need someone who knows the organization.

Shannon in Action

Shannon running an autonomous pentest

These reports are from Shannon Open Source scans of Photoview 2.4.0, one of the applications in Doyensec's comparison of Aikido and XBOW. We ran Shannon against the same application version and evaluated its results separately. Read the Doyensec study and our Shannon follow-up comparison for the methodology, limitations, costs, and results.

Model Report SARIF
DeepSeek v4 Flash View report SARIF
Grok 4.6 View report SARIF
Claude Opus 5 View report SARIF

Quick Start

Prerequisites

  • Docker: required for the worker container.
  • Node.js 18+: required for the recommended npx workflow.
  • AI provider credentials: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, and any other provider in the harness catalogue — each of which you can point at a proxy or LLM gateway through a custom base URL, and a model the catalogue does not yet carry can be described with a custom model configuration. You bring your own key, and Keygraph never proxies your model traffic. Shannon is provider-agnostic. See AI providers for suggested model IDs.
  • Cyber safeguards cleared with your provider: Anthropic and OpenAI apply real-time safeguards to cyber-security workloads, which can interrupt a scan mid-run. Complete their guidance for legitimate security testers before your first run - see AI providers.

Run Shannon

[!WARNING] Shannon actively executes exploits. Run it only against applications and environments you own or have explicit written authorization to test. Do not run Shannon against production syste

readme truncated — read the full docs on github

Frequently asked questions

Is shannon free to use?

shannon is open source under the AGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does shannon do?

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabi

What is shannon written in?

shannon is primarily written in TypeScript. Its source is publicly available at https://github.com/KeygraphHQ/shannon, and it has 48,105 GitHub stars.