Shannon

Overview

Shannon is an open-source whitebox AI pentester for web applications and APIs from Keygraph. It analyzes source code, identifies attack vectors, and executes real exploits to prove vulnerabilities. The Keygraph platform extends this with continuous agentic pentesting on every build, covering whitebox and blackbox testing, business logic testing, code analysis, and verified remediation workflows.

Key Features

• Agentic whitebox and blackbox pentesting that reads code or attacks the app from the outside and reports findings with working exploits.
• Business logic testing to prove where application logic breaks.
• Code analysis including agentic SAST, SCA limited to reachable CVEs, and secrets scanning verified across history.
• Code remediation that generates verified fixes as reviewable pull requests.
• Reporting and analytics with deduplicated findings, dashboards, and Jira sync.
• Signed attestation reports for audits.

Use Cases

• Continuous penetration testing on every build to close the gap between scheduled pentests.
• Validating application security findings by requiring a working exploit before reporting.
• Reviewing source code and dependencies for reachable vulnerabilities, leaked secrets, and business logic flaws.
• Managing remediation and audit reporting through pull requests, dashboards, and signed reports.

Deployment & Requirements

• Self-hosted and BYOK deployments are available.

Before You Adopt

• License: AGPL-3.0. Review its terms before using, modifying, or distributing the project.
• Code remediation auto-patching is not yet available for GitLab repositories.