# Shannon

An autonomous AI penetration tester that analyzes a web application's source code, finds attack paths, and runs real exploits to prove vulnerabilities before they reach production.

Shannon is an autonomous AI pentester for web applications and their APIs, developed by Keygraph. It analyzes an application's source code to identify potential attack vectors, then uses browser automation and command-line tools to run real exploits against the running application, including only vulnerabilities with a working proof of concept in its final report rather than unconfirmed findings.

This repository is Shannon Open Source, the standalone agent that runs from the command line and is described as not a replacement for human penetration testers. The same underlying agent also powers Keygraph's commercial pentesting platform.

Shannon's third major version adds deeper security code analysis, a rebuilt CLI, native CI/CD integration including GitHub Actions, professional PDF reports and SARIF output, and it documents support for bring-your-own-key setups and running against local or self-hosted models.

Website: https://keygraph.io/