README

[!NOTE]
 php2shell upgrade verification: confirm your PHP apps are patched against the php2shell RCE chain with the experimental --exp-php2shell probe. See the test results.











 Shannon is an autonomous, AI pentester for web applications and APIs.

It analyzes your source code, identifies attack paths, and executes real exploits to prove vulnerabilities before they reach production. No exploit, no report.

This repository is Shannon: the full open-source agent, run locally from your command line.

Launch Shannon

bash
npx @keygraph/shannon@latest


The interactive launcher will guide you through setup and your first pentest.

---

      

---



 [!TIP]
 AI agents and LLMs: start with llms.txt for a concise map of this repository, or use llms-full.txt for the README and docs combined into one file.



 Table of Contents

- Table of Contents
- What is Shannon?
  - Why Shannon Exists
  - Why "Shannon"?
  - Not a replacement for human pentesters
- Shannon in Action
- Quick Start
  - Prerequisites
  - Run Shannon
- Key Capabilities
- CI/CD Integrations
  - GitHub Actions
- Editions
- Architecture
- Documentation
- Safety, Scope, and Limitations
- License
- Acknowledgements
- About Keygraph
- Community and Support
- Common Questions
  - Can I self-host Shannon?
  - Does Shannon support bring your own key (BYOK)?
  - Does Shannon output SARIF?
  - Which AI providers does Shannon support?
  - Can I run Shannon on a local or self-hosted model?
  - Does Shannon actually exploit vulnerabilities, or just scan?



 What is Shannon?

Shannon is an autonomous AI pentester developed by Keygraph. It performs security testing of web applications and their underlying APIs by combining source-code analysis with live exploitation.

Shannon analyzes your web application's source code to identify potential attack vectors, then uses browser automation and command-line tools to execute real exploits against the running application and its APIs. Only vulnerabilities with a working proof-of-concept are included in the final report.

Shannon is the agent. This repository is Shannon, the open-source pentester you run yourself. The same Shannon also powers Keygraph's commercial editions, Pro and Enterprise. See Editions for how Shannon compares with Pro, Enterprise, and the Community Program.



Why Shannon Exists

Thanks to tools like Claude Code and Cursor, your team ships code non-stop. But your penetration test? That happens once a year. This creates a massive security gap. For the other 364 days, you could be unknowingly shipping vulnerabilities to production.

Shannon closes that gap by providing on-demand, automated penetration testing that can run against every build or release.





Why "Shannon"?

It's named after Claude Shannon, the father of information theory. At its core, pentesting is an information problem: every probe reduces uncertainty about a system's state. The best tools maximize the signal gained from every request

Top issues

Discussions

Latest release

3.5.0 (2026-10-27)


 Bug Fixes

 cli: repair shannon stop and speed up orphan/empty stops (493) (494) (4bd88c1)
 report: lay out the PDF cover like the Keygraph report design (6f306b5)
 report: pin the cover title spacing to the design (27645df)
 report: use the Keygraph wordmark on the PDF cover and link it (f5054dc)


 Features

 cli: add experimental --exp-php2shell upgrade-verification probe (501) (74c1c93)