diff --git a/README.md b/README.md index 1513b2b..4a2adda 100644 --- a/README.md +++ b/README.md @@ -75,7 +75,7 @@ Sample penetration test reports from intentionally vulnerable applications, prod - **Docker**: required for the worker container. - **Node.js 18+**: required for the recommended `npx` workflow. -- **AI provider credentials**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, [any other provider](docs/ai-providers.md#any-other-provider) in the harness catalogue, and any endpoint that speaks the Anthropic Messages API or the OpenAI Chat Completions API through a [custom base URL](docs/ai-providers.md#custom-base-url). You bring your own key, and Keygraph never proxies your model traffic. Claude models currently score highest in our benchmarks, but Shannon is provider-agnostic. See [AI providers](docs/ai-providers.md#suggested-models) for suggested model IDs. +- **AI provider credentials**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, [any other provider](docs/ai-providers.md#any-other-provider) in the harness catalogue, and any endpoint that speaks the Anthropic Messages API or the OpenAI Chat Completions API through a [custom base URL](docs/ai-providers.md#custom-base-url). You bring your own key, and Keygraph never proxies your model traffic. Shannon is provider-agnostic; Claude models are the best-supported option, because Shannon's evaluations, internal testing, and agent harness are tuned for them. See [AI providers](docs/ai-providers.md#suggested-models) for suggested model IDs. - **Cyber safeguards cleared with your provider**: Anthropic and OpenAI apply real-time safeguards to cyber-security workloads, which can interrupt a scan mid-run. Complete their guidance for legitimate security testers before your first run - see [AI providers](docs/ai-providers.md#cyber-safeguards-do-this-before-your-first-scan). ### Run Shannon @@ -312,7 +312,7 @@ Important limitations: - Shannon Open Source focuses on actively exploitable issues such as Injection, XSS, SSRF, Broken Authentication, and Broken Authorization. Broader static-analysis coverage, including vulnerable dependencies and insecure configurations, is delivered through the Keygraph platform. - Findings still require human review. LLM-generated reports can contain weakly supported or incorrect details. -- Shannon is officially supported with Claude models. Smaller, alternative, or proxied non-Claude models may be incomplete or unstable. +- Anthropic, OpenAI, xAI, and AWS Bedrock are built-in providers, and any Anthropic Messages API or OpenAI Chat Completions API endpoint works through a custom base URL. Claude models remain the best-supported option: Shannon's evaluations, internal testing, and agent harness are tuned for them, and other models may not follow Shannon's instructions or tool-use constraints as reliably. - A full run can take roughly 1 to 1.5 hours and may incur LLM API costs depending on model pricing and application complexity. - Do not scan untrusted or adversarial codebases. AI-powered tools that read source code can be exposed to prompt injection. diff --git a/llms-full.txt b/llms-full.txt index d89cc2a..82e5643 100644 --- a/llms-full.txt +++ b/llms-full.txt @@ -84,7 +84,7 @@ Sample penetration test reports from intentionally vulnerable applications, prod - **Docker**: required for the worker container. - **Node.js 18+**: required for the recommended `npx` workflow. -- **AI provider credentials**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, [any other provider](docs/ai-providers.md#any-other-provider) in the harness catalogue, and any endpoint that speaks the Anthropic Messages API or the OpenAI Chat Completions API through a [custom base URL](docs/ai-providers.md#custom-base-url). You bring your own key, and Keygraph never proxies your model traffic. Claude models currently score highest in our benchmarks, but Shannon is provider-agnostic. See [AI providers](docs/ai-providers.md#suggested-models) for suggested model IDs. +- **AI provider credentials**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, [any other provider](docs/ai-providers.md#any-other-provider) in the harness catalogue, and any endpoint that speaks the Anthropic Messages API or the OpenAI Chat Completions API through a [custom base URL](docs/ai-providers.md#custom-base-url). You bring your own key, and Keygraph never proxies your model traffic. Shannon is provider-agnostic; Claude models are the best-supported option, because Shannon's evaluations, internal testing, and agent harness are tuned for them. See [AI providers](docs/ai-providers.md#suggested-models) for suggested model IDs. - **Cyber safeguards cleared with your provider**: Anthropic and OpenAI apply real-time safeguards to cyber-security workloads, which can interrupt a scan mid-run. Complete their guidance for legitimate security testers before your first run - see [AI providers](docs/ai-providers.md#cyber-safeguards-do-this-before-your-first-scan). ### Run Shannon @@ -321,7 +321,7 @@ Important limitations: - Shannon Open Source focuses on actively exploitable issues such as Injection, XSS, SSRF, Broken Authentication, and Broken Authorization. Broader static-analysis coverage, including vulnerable dependencies and insecure configurations, is delivered through the Keygraph platform. - Findings still require human review. LLM-generated reports can contain weakly supported or incorrect details. -- Shannon is officially supported with Claude models. Smaller, alternative, or proxied non-Claude models may be incomplete or unstable. +- Anthropic, OpenAI, xAI, and AWS Bedrock are built-in providers, and any Anthropic Messages API or OpenAI Chat Completions API endpoint works through a custom base URL. Claude models remain the best-supported option: Shannon's evaluations, internal testing, and agent harness are tuned for them, and other models may not follow Shannon's instructions or tool-use constraints as reliably. - A full run can take roughly 1 to 1.5 hours and may incur LLM API costs depending on model pricing and application complexity. - Do not scan untrusted or adversarial codebases. AI-powered tools that read source code can be exposed to prompt injection.