From 6c39101071a3c30d3511544e5c4de283bd70e9aa Mon Sep 17 00:00:00 2001 From: george-keygraph Date: Thu, 13 Aug 2026 15:43:29 -0700 Subject: [PATCH] docs: drop Claude-preference claims from model guidance Remove the best-supported/recommended framing from the README prerequisites and limitations, docs/safety.md, and docs/ai-providers.md. The remaining caveat is model-neutral: capability varies, and a model that does not follow Shannon's instructions or tool-use constraints reliably produces weaker pentests. Co-Authored-By: Claude Opus 5 --- README.md | 4 ++-- docs/ai-providers.md | 4 ++-- docs/safety.md | 2 +- llms-full.txt | 10 +++++----- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 4a2adda..eb918b4 100644 --- a/README.md +++ b/README.md @@ -75,7 +75,7 @@ Sample penetration test reports from intentionally vulnerable applications, prod - **Docker**: required for the worker container. - **Node.js 18+**: required for the recommended `npx` workflow. -- **AI provider credentials**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, [any other provider](docs/ai-providers.md#any-other-provider) in the harness catalogue, and any endpoint that speaks the Anthropic Messages API or the OpenAI Chat Completions API through a [custom base URL](docs/ai-providers.md#custom-base-url). You bring your own key, and Keygraph never proxies your model traffic. Shannon is provider-agnostic; Claude models are the best-supported option, because Shannon's evaluations, internal testing, and agent harness are tuned for them. See [AI providers](docs/ai-providers.md#suggested-models) for suggested model IDs. +- **AI provider credentials**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, [any other provider](docs/ai-providers.md#any-other-provider) in the harness catalogue, and any endpoint that speaks the Anthropic Messages API or the OpenAI Chat Completions API through a [custom base URL](docs/ai-providers.md#custom-base-url). You bring your own key, and Keygraph never proxies your model traffic. Shannon is provider-agnostic. See [AI providers](docs/ai-providers.md#suggested-models) for suggested model IDs. - **Cyber safeguards cleared with your provider**: Anthropic and OpenAI apply real-time safeguards to cyber-security workloads, which can interrupt a scan mid-run. Complete their guidance for legitimate security testers before your first run - see [AI providers](docs/ai-providers.md#cyber-safeguards-do-this-before-your-first-scan). ### Run Shannon @@ -312,7 +312,7 @@ Important limitations: - Shannon Open Source focuses on actively exploitable issues such as Injection, XSS, SSRF, Broken Authentication, and Broken Authorization. Broader static-analysis coverage, including vulnerable dependencies and insecure configurations, is delivered through the Keygraph platform. - Findings still require human review. LLM-generated reports can contain weakly supported or incorrect details. -- Anthropic, OpenAI, xAI, and AWS Bedrock are built-in providers, and any Anthropic Messages API or OpenAI Chat Completions API endpoint works through a custom base URL. Claude models remain the best-supported option: Shannon's evaluations, internal testing, and agent harness are tuned for them, and other models may not follow Shannon's instructions or tool-use constraints as reliably. +- Anthropic, OpenAI, xAI, and AWS Bedrock are built-in providers, and any Anthropic Messages API or OpenAI Chat Completions API endpoint works through a custom base URL. Model capability varies, and a model that does not follow Shannon's instructions or tool-use constraints reliably will produce weaker results. - A full run can take roughly 1 to 1.5 hours and may incur LLM API costs depending on model pricing and application complexity. - Do not scan untrusted or adversarial codebases. AI-powered tools that read source code can be exposed to prompt injection. diff --git a/docs/ai-providers.md b/docs/ai-providers.md index 96f2b34..36dbd7e 100644 --- a/docs/ai-providers.md +++ b/docs/ai-providers.md @@ -25,7 +25,7 @@ Shannon forwards only the selected provider's credential into the scan container ### Any other provider -Shannon accepts any provider and model present in the Pi harness catalogue. Browse them at [pi.dev/models](https://pi.dev/models). These are technically supported but not recommended. Claude models are best-supported (see the note below). +Shannon accepts any provider and model present in the Pi harness catalogue. Browse them at [pi.dev/models](https://pi.dev/models). ```bash export SHANNON_AI_API_KEY=your-api-key # the provider's API key @@ -37,7 +37,7 @@ This path covers providers whose credential is a single API key. Providers that `npx @keygraph/shannon setup` exposes this as the **Other provider** option. > [!IMPORTANT] -> Claude models are the best-supported option. Shannon's evaluations, internal testing, and agent harness are tuned for Claude. Other models are permitted and validated against the harness catalogue, but may not follow Shannon's instructions or tool-use constraints as reliably. Use them at your own risk. +> Models are validated against the harness catalogue, but capability varies. A model that does not follow Shannon's instructions or tool-use constraints reliably will produce weaker pentests. Evaluate the model you choose against your own targets before depending on its results. ## Cyber safeguards (do this before your first scan) diff --git a/docs/safety.md b/docs/safety.md index cf4422f..bd97f11 100644 --- a/docs/safety.md +++ b/docs/safety.md @@ -28,7 +28,7 @@ For maximum isolation, run Shannon inside a disposable virtual machine. ## LLM and Automation Caveats - **Verification is required**: Shannon uses a proof-by-exploitation methodology, but final reports can still contain weakly supported or incorrect details. Human review is essential. -- **Model support**: Shannon is officially supported only with Claude models. Alternative models may be incomplete, inaccurate, or unstable. +- **Model support**: results vary by model. A model that does not follow Shannon's instructions or tool-use constraints reliably may produce incomplete, inaccurate, or unstable runs. - **Prompt injection risk**: Do not point Shannon at untrusted or adversarial codebases. AI-powered tools that read source code can be influenced by malicious repository content. ## Scope of Analysis diff --git a/llms-full.txt b/llms-full.txt index 82e5643..58af481 100644 --- a/llms-full.txt +++ b/llms-full.txt @@ -84,7 +84,7 @@ Sample penetration test reports from intentionally vulnerable applications, prod - **Docker**: required for the worker container. - **Node.js 18+**: required for the recommended `npx` workflow. -- **AI provider credentials**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, [any other provider](docs/ai-providers.md#any-other-provider) in the harness catalogue, and any endpoint that speaks the Anthropic Messages API or the OpenAI Chat Completions API through a [custom base URL](docs/ai-providers.md#custom-base-url). You bring your own key, and Keygraph never proxies your model traffic. Shannon is provider-agnostic; Claude models are the best-supported option, because Shannon's evaluations, internal testing, and agent harness are tuned for them. See [AI providers](docs/ai-providers.md#suggested-models) for suggested model IDs. +- **AI provider credentials**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, [any other provider](docs/ai-providers.md#any-other-provider) in the harness catalogue, and any endpoint that speaks the Anthropic Messages API or the OpenAI Chat Completions API through a [custom base URL](docs/ai-providers.md#custom-base-url). You bring your own key, and Keygraph never proxies your model traffic. Shannon is provider-agnostic. See [AI providers](docs/ai-providers.md#suggested-models) for suggested model IDs. - **Cyber safeguards cleared with your provider**: Anthropic and OpenAI apply real-time safeguards to cyber-security workloads, which can interrupt a scan mid-run. Complete their guidance for legitimate security testers before your first run - see [AI providers](docs/ai-providers.md#cyber-safeguards-do-this-before-your-first-scan). ### Run Shannon @@ -321,7 +321,7 @@ Important limitations: - Shannon Open Source focuses on actively exploitable issues such as Injection, XSS, SSRF, Broken Authentication, and Broken Authorization. Broader static-analysis coverage, including vulnerable dependencies and insecure configurations, is delivered through the Keygraph platform. - Findings still require human review. LLM-generated reports can contain weakly supported or incorrect details. -- Anthropic, OpenAI, xAI, and AWS Bedrock are built-in providers, and any Anthropic Messages API or OpenAI Chat Completions API endpoint works through a custom base URL. Claude models remain the best-supported option: Shannon's evaluations, internal testing, and agent harness are tuned for them, and other models may not follow Shannon's instructions or tool-use constraints as reliably. +- Anthropic, OpenAI, xAI, and AWS Bedrock are built-in providers, and any Anthropic Messages API or OpenAI Chat Completions API endpoint works through a custom base URL. Model capability varies, and a model that does not follow Shannon's instructions or tool-use constraints reliably will produce weaker results. - A full run can take roughly 1 to 1.5 hours and may incur LLM API costs depending on model pricing and application complexity. - Do not scan untrusted or adversarial codebases. AI-powered tools that read source code can be exposed to prompt injection. @@ -710,7 +710,7 @@ Shannon forwards only the selected provider's credential into the scan container ### Any other provider -Shannon accepts any provider and model present in the Pi harness catalogue. Browse them at [pi.dev/models](https://pi.dev/models). These are technically supported but not recommended. Claude models are best-supported (see the note below). +Shannon accepts any provider and model present in the Pi harness catalogue. Browse them at [pi.dev/models](https://pi.dev/models). ```bash export SHANNON_AI_API_KEY=your-api-key # the provider's API key @@ -722,7 +722,7 @@ This path covers providers whose credential is a single API key. Providers that `npx @keygraph/shannon setup` exposes this as the **Other provider** option. > [!IMPORTANT] -> Claude models are the best-supported option. Shannon's evaluations, internal testing, and agent harness are tuned for Claude. Other models are permitted and validated against the harness catalogue, but may not follow Shannon's instructions or tool-use constraints as reliably. Use them at your own risk. +> Models are validated against the harness catalogue, but capability varies. A model that does not follow Shannon's instructions or tool-use constraints reliably will produce weaker pentests. Evaluate the model you choose against your own targets before depending on its results. ## Cyber safeguards (do this before your first scan) @@ -1082,7 +1082,7 @@ For maximum isolation, run Shannon inside a disposable virtual machine. ## LLM and Automation Caveats - **Verification is required**: Shannon uses a proof-by-exploitation methodology, but final reports can still contain weakly supported or incorrect details. Human review is essential. -- **Model support**: Shannon is officially supported only with Claude models. Alternative models may be incomplete, inaccurate, or unstable. +- **Model support**: results vary by model. A model that does not follow Shannon's instructions or tool-use constraints reliably may produce incomplete, inaccurate, or unstable runs. - **Prompt injection risk**: Do not point Shannon at untrusted or adversarial codebases. AI-powered tools that read source code can be influenced by malicious repository content. ## Scope of Analysis