keygraphhq/shannon
★ 49,111 stars
Covered in week 2026-W11 · the 2026-03 report
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
What shannon is
This repository is Shannon Open Source: the full agent, run locally from your command line.
From the repository README · read it on GitHub →
Transcript
What if your pentester worked 24/7 and never reported a false positive? Shannon is a fully autonomous AI pentester that reads your source code, finds vulnerabilities, and actually exploits them to prove they're real. It scored 96% on the XBOW benchmark with a strict "no exploit, no report" policy. One command launches the entire test—from reconnaissance through exploitation—against your web apps and APIs. Star the repo at github.com/KeygraphHQ/shannon