AI product Open source
Shannon is an open-source autonomous AI penetration-testing tool developed by Keygraph for web applications and APIs. It analyzes source code to map architecture, trust boundaries, data flows, interfaces, dependencies, and potential attack paths, then combines those candidates with live reconnaissance and specialized testing for injection, XSS, SSRF, authentication, and authorization. Exploitation agents use browser automation and command-line tools against a running application to produce reproducible proof-of-concept attacks; candidates that cannot be demonstrated are discarded, so only exploited vulnerabilities become findings.
Shannon runs locally from the command line or in CI/CD, including GitHub Actions and GitLab CI/CD, and can test deployed staging or development environments on pull-request, release, or scheduled workflows. It produces evidence-rich PDF and Markdown reports plus JSON and SARIF 2.1.0 output, supports authenticated testing and resumable workspaces, and can gate a pipeline on proven vulnerabilities at configured severity levels. The open-source edition runs in an ephemeral Docker worker, mounts the target repository read-only, stores results locally, and uses credentials supplied for a selected model provider or compatible local endpoint.
Shannon is licensed under AGPL-3.0. It actively executes exploits and may mutate application state, so the project requires authorization and recommends sandboxed, staging, or local environments rather than production systems.
1 use taken from transcripts — each links to the moment in the video.
An open-source AI penetration testing tool from Keygraph that reads source code while attacking a running application, exploits vulnerabilities one class at a time, and reports only findings with proven working exploits. Can run in CI, on every release, or on a schedule.
1 in the library.