-
-
- 
-
- Built by Keygraph -
+**Built by [Keygraph](https://keygraph.io)** \ No newline at end of file diff --git a/docs/keygraph-platform.md b/docs/keygraph-platform.md index 7b539015..0332b89b 100644 --- a/docs/keygraph-platform.md +++ b/docs/keygraph-platform.md @@ -33,13 +33,15 @@ The platform connects discovery, triage, remediation, and verification in one co ## Exhaustive Agentic SAST -Shannon 3.0's open-source code analysis is tuned for fast, everyday pentest runs. The Enterprise engine is designed for exhaustive audits. It parses the codebase and builds structural context before asking agents to reason about security: +Shannon 3.0's open-source code analysis runs a multi-stage agentic workflow. It models application architecture, trust boundaries, exposed interfaces, and data flows, opens targeted investigations, reviews the candidates they turn up, and hands the survivors to live pentesting agents. That workflow is built for practical local and CI/CD runs. + +The Enterprise engine goes further, for audits at organization scale. It parses the codebase and builds persistent structural context before agents start reasoning about security: - **Repository and architecture modeling** identifies services, frameworks, entry points, assets, trust boundaries, and cross-repository relationships. - **Interprocedural call and data-flow analysis** traces values across functions, files, fields, containers, and framework-managed request lifecycles. - **Source, sink, and sanitizer modeling** follows untrusted input to sensitive operations and records where validation, encoding, authorization, or other controls alter the path. - **Threat-driven decomposition** breaks large applications into risk, taint-flow, framework, and specialist analysis tasks so deep scans remain systematic. -- **Adversarial verification** challenges each candidate as a potential false positive and weighs code evidence before it becomes a finding. +- **Exhaustive adversarial verification** challenges candidates across multiple review passes, weighing structural evidence against what the agents found, then asks whether each one is viable in the application's production configuration. - **Semantic deduplication and exploit-chain analysis** consolidate variants of the same defect and identify combinations whose impact is greater than any isolated issue. - **Business-logic invariant testing** derives rules the code is supposed to preserve—such as tenant isolation, workflow order, approval limits, balances, and state transitions—then agents fuzz those invariants for application-specific flaws. @@ -117,10 +119,10 @@ Keygraph maintains a SOC 2 Type II audit and makes the current report available | | Shannon Open Source | Keygraph Enterprise Platform | | --- | --- | --- | | Best for | Individual developers and teams running pentests locally or in CI/CD | Security organizations running a continuous AppSec program across many teams and repositories | -| Code analysis | Fast, attack-oriented analysis maps routes, data flows, architecture, and likely attack paths | Exhaustive agentic SAST traces interprocedural source-to-sink paths, models sanitizers, adversarially verifies candidates, deduplicates findings, and analyzes exploit chains | +| Code analysis | Multi-stage agentic review maps architecture, trust boundaries, exposed interfaces, and data flows, filters candidate vulnerabilities, and hands the survivors to live pentesting agents | Exhaustive parsed-code analysis: persistent Code Property Graphs, interprocedural source-to-sink and sanitizer modeling, cross-repository context, exploit-chain analysis, and business-logic invariant testing | | Pentesting | On-demand, source-aware white-box pentesting with proof by exploitation | Continuous white-box, black-box, and grey-box pentesting across applications and environments | | Additional AppSec coverage | Not included | SCA with reachability, secrets scanning, and business-logic invariant testing | -| CI/CD and reporting | GitHub Actions and GitLab workflows, severity gating, PDF, Markdown, JSON, and SARIF | Central policies and gating, APIs and integrations, canonical findings, dashboards, analytics, SLA tracking, and compliance evidence | +| CI/CD and reporting | Official GitHub Action and reusable GitLab CI/CD component; staging, release, merge-request, and scheduled pentests; demonstrated-vulnerability severity gates; PDF, Markdown, JSON, SARIF, artifacts, and native security-workflow ingestion | Organization-wide policies and gating, centrally managed integrations, canonical findings, dashboards, analytics, SLA tracking, and compliance evidence | | Automated remediation and verification | Not included | AI-authored pull requests with targeted code and exploit verification | | Enterprise governance | N/A — local, single-operator CLI | SSO, SCIM, teams, ReBAC/ABAC/RBAC, audit logs, API keys, ownership, and SLA policies | | Deployment and AI | Self-hosted, no telemetry, BYOM, and fully air-gapped with a local model | Fully on-premises or air-gapped, BYOK/BYOM, and granular routing through customer-controlled gateways | diff --git a/llms-full.txt b/llms-full.txt index cdfe197b..6f5d831a 100644 --- a/llms-full.txt +++ b/llms-full.txt @@ -8,51 +8,51 @@ # File: README.md > [!NOTE] -> **[Shannon 2.0 is officially here](https://github.com/KeygraphHQ/shannon/discussions/405)** +> **Shannon 3.0 is live:** deeper security code analysis, a rebuilt terminal experience, native CI/CD workflows, professional PDF reports, and SARIF—still fully open source, self-hosted, and bring-your-own-model. -
-
- 
-
- Built by Keygraph -
+Shannon executes real exploits. It reports a finding only when it has produced a working proof-of-concept, and discards hypotheses it cannot prove. It is a pentester, not a passive scanner. +**Built by [Keygraph](https://keygraph.io)** --- # File: docs/development.md @@ -1102,7 +1155,6 @@ For broader coverage, the Keygraph platform adds black-box and white-box agentic A full test run typically takes roughly 1 to 1.5 hours. LLM API costs vary by model pricing, target complexity, selected provider, and concurrency. - --- # File: docs/coverage-roadmap.md @@ -1135,97 +1187,136 @@ For organizations that need broader static and organizational coverage now, see # File: docs/keygraph-platform.md -# Keygraph Platform +# Keygraph Enterprise Platform -The Keygraph platform is Keygraph's commercial continuous pentesting and AppSec platform for teams running security across many repositories, services, and environments. While Shannon is a local white-box pentesting CLI, the Keygraph platform is a complete AppSec system: it combines parsed-code SAST, source-to-sink analysis, black-box and white-box agentic pentesting, verified remediation, CI/CD gating, SLA tracking, and reporting for security and compliance teams. +Shannon 3.0 makes advanced, code-informed autonomous pentesting available to everyone. The open-source CLI maps routes and data flows, understands application architecture, executes real attacks, and produces PDF and SARIF results—locally, in CI/CD, or fully air-gapped with your own model. -This repository contains Shannon, the AGPL-3.0 open-source CLI for strictly white-box pentesting. The Keygraph platform supports both white-box and black-box agentic pentesting and adds static analysis, finding management, remediation workflows, reporting, and enterprise deployment options. +The **Keygraph Enterprise Platform** is the commercial AppSec operating system for organizations that need to run that process continuously across many repositories, teams, and environments. It adds exhaustive agentic SAST, business-logic and source-to-sink analysis, broader scanner coverage, centralized vulnerability management, automated remediation and targeted verification, enterprise governance, and organization-wide reporting. -## Who Should Consider the Keygraph Platform +> Shannon Open Source is a complete autonomous pentester, not a trial edition. Keygraph Enterprise is for teams that need greater analysis depth, shared control, and a closed-loop vulnerability-management program. -The Keygraph platform is intended for organizations that need: +## Who It Is For -- Continuous AppSec coverage across many repositories and services -- White-box pentesting when source code is available -- Black-box pentesting against deployed applications and APIs without source-code access -- Agentic SAST, SCA with reachability, secrets scanning, IaC scanning, container scanning, and business logic testing -- Canonical finding management, deduplication, ownership, status tracking, and severity tracking -- Sync into developer workflows, including ticketing and source-control systems -- User-initiated remediation with verification before delivery -- SLA tracking, reporting dashboards, and compliance evidence -- Commercial support -- Self-hosted, air-gapped, BYOK, and customer-controlled LLM gateway deployment options +Keygraph Enterprise is designed for organizations that need to: -## Full Vulnerability Lifecycle +- continuously test hundreds or thousands of repositories, services, applications, and APIs; +- combine agentic pentesting, SAST, SCA, secrets, and business-logic findings in one system; +- enforce security policy in GitHub Actions, GitLab CI, and enterprise delivery pipelines; +- give developers one canonical, actionable record for each vulnerability instead of duplicate scanner alerts; +- assign owners, apply SLAs, track status, and measure risk and remediation performance across the organization; +- generate fixes and verify them without rerunning an entire scan; +- enforce enterprise identity, authorization, audit, and API-access controls; and +- deploy fully on-premises or air-gapped with customer-controlled models, keys, and routing. -The Keygraph platform is designed to cover the full vulnerability lifecycle, not only discovery: +## Close the Entire AppSec Loop -1. **Find** exploitable issues with white-box pentesting, black-box pentesting, SAST, SCA, secrets, IaC, container, and business logic testing. -2. **Normalize** results into canonical findings so duplicate scanner outputs become one tracked vulnerability per repository. -3. **Prioritize** findings using exploit evidence, reachability, severity, ownership, and business context. -4. **Sync** work into developer workflows through ticketing and source-control integrations. -5. **Remediate** with user-initiated patch generation when teams want help moving from evidence to code changes. -6. **Verify** fixes by re-running the relevant scanner or exploit workflow before a remediation is delivered. -7. **Track** ownership, status, SLAs, MTTR, and drift over time. -8. **Report** through dashboards for risk, trends, compliance evidence, and security program operations. +The platform connects discovery, triage, remediation, and verification in one continuous workflow: -## Pentesting Modes +1. **Analyze** every repository with exhaustive agentic SAST and complementary scanners. +2. **Prove** exploitability with source-aware white-box, black-box, and grey-box pentesting. +3. **Normalize and deduplicate** results into a canonical finding per vulnerability and repository. +4. **Prioritize and assign** using severity, reachability, exploit evidence, ownership, policy, and business context. +5. **Remediate** with an AI-authored patch delivered as a reviewable pull request. +6. **Verify** the specific fix with deterministic checks and adversarial agent reasoning—without rerunning the full scan. +7. **Track and govern** status, exceptions, SLAs, audit history, trends, and compliance evidence until closure. -Shannon is strictly white-box: it requires access to the target application's source code and repository layout. +## Exhaustive Agentic SAST -The Keygraph platform supports two pentesting modes: +Shannon 3.0's open-source code analysis runs a multi-stage agentic workflow. It models application architecture, trust boundaries, exposed interfaces, and data flows, opens targeted investigations, reviews the candidates they turn up, and hands the survivors to live pentesting agents. That workflow is built for practical local and CI/CD runs. -- **White-box agentic pentesting**: Agents use source-code context to understand architecture, identify realistic attack paths, and validate exploitability against the running application. -- **Black-box agentic pentesting**: Agents test deployed applications and APIs without source-code access, useful for third-party surfaces, production-like external validation, or environments where source access is unavailable. +The Enterprise engine goes further, for audits at organization scale. It parses the codebase and builds persistent structural context before agents start reasoning about security: -Both modes follow the same core principle: do not report what might be vulnerable when an exploit can prove what is vulnerable. +- **Repository and architecture modeling** identifies services, frameworks, entry points, assets, trust boundaries, and cross-repository relationships. +- **Interprocedural call and data-flow analysis** traces values across functions, files, fields, containers, and framework-managed request lifecycles. +- **Source, sink, and sanitizer modeling** follows untrusted input to sensitive operations and records where validation, encoding, authorization, or other controls alter the path. +- **Threat-driven decomposition** breaks large applications into risk, taint-flow, framework, and specialist analysis tasks so deep scans remain systematic. +- **Exhaustive adversarial verification** challenges candidates across multiple review passes, weighing structural evidence against what the agents found, then asks whether each one is viable in the application's production configuration. +- **Semantic deduplication and exploit-chain analysis** consolidate variants of the same defect and identify combinations whose impact is greater than any isolated issue. +- **Business-logic invariant testing** derives rules the code is supposed to preserve—such as tenant isolation, workflow order, approval limits, balances, and state transitions—then agents fuzz those invariants for application-specific flaws. -## AppSec Coverage +The result is broad vulnerability hunting with precise paths back to the relevant code, not a flat list of pattern matches. -The Keygraph platform combines agentic pentesting with broader AppSec coverage: +
+ 
+
+ 
+
+ 
+
+ 
+
+ 
+