diff --git a/README.md b/README.md index aae9eeef..f55679e4 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ -Shannon - AI Pentester by Keygraph +Shannon, AI Pentester for Web Apps and APIs, by Keygraph KeygraphHQ%2Fshannon | Trendshift diff --git a/apps/cli/README.md b/apps/cli/README.md index 8f11858c..541103a5 100644 --- a/apps/cli/README.md +++ b/apps/cli/README.md @@ -1,22 +1,60 @@
-Shannon — AI Pentester for Web Applications and APIs +Shannon, AI Pentester for Web Apps and APIs, by Keygraph -# Shannon — AI Pentester by Keygraph +### Shannon is an autonomous, AI pentester for web applications and APIs. -Shannon is an autonomous, white-box AI pentester for web applications and APIs.
-It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production. +It analyzes your source code, identifies attack paths, and executes real exploits to prove vulnerabilities before they reach production. + +**This package is Shannon Open Source: the full agent, run locally from your command line.** --- -Announcements -Join Discord -Visit Keygraph.io -Follow Us on Linkedin +Join Discord      Visit Keygraph.io --- -**Full README and usage guide** -[https://github.com/KeygraphHQ/shannon#readme](https://github.com/KeygraphHQ/shannon#readme) -
+ +## Quick Start + +### Prerequisites + +- **Docker**: required for the worker container. +- **Node.js 18+**: required for the recommended `npx` workflow. +- **AI provider credentials**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, any other provider in the harness catalogue, and any endpoint that speaks the Anthropic Messages API or the OpenAI Chat Completions or Responses API through a custom base URL. You bring your own key, and Keygraph never proxies your model traffic. Shannon is provider-agnostic. +- **Cyber safeguards cleared with your provider**: Anthropic and OpenAI apply real-time safeguards to cyber-security workloads, which can interrupt a scan mid-run. Complete their guidance for legitimate security testers before your first run. + +### Run Shannon + +> **Warning:** Shannon actively executes exploits. Run it only against applications and environments you own or have explicit written authorization to test. Do not run Shannon against production systems. + +```bash +# Configure credentials with the interactive wizard. +npx @keygraph/shannon setup + +# Run a pentest against a source-available target. +npx @keygraph/shannon start -u https://your-app.com -r /path/to/your-repo +``` + +Shannon pulls the worker image from Docker Hub, starts the required local infrastructure, mounts the target repository read-only inside an ephemeral worker container, and writes results to a local workspace. + +## Editions + +Shannon ships in two ways. **Shannon Open Source** is this package: the standalone pentester you run yourself, on demand, and complete in that lane. The **Keygraph platform** is the commercial product that runs an enhanced build of Shannon continuously and closes the full AppSec lifecycle around it - code analysis, finding management, automated remediation, verification, and enterprise deployment. + +## Documentation + +**Full README, guides, and usage documentation:** [github.com/KeygraphHQ/shannon](https://github.com/KeygraphHQ/shannon#readme) + +## License + +Shannon Open Source is licensed under the [GNU Affero General Public License v3.0](https://github.com/KeygraphHQ/shannon/blob/main/LICENSE). + +Commercial and enterprise licensing is available for organizations that need different license terms, commercial support, private redistribution, managed-service use, or broader deployment options, including the Keygraph platform. + +For commercial licensing, contact [shannon@keygraph.io](mailto:shannon@keygraph.io). + +

+ Built by Keygraph +

diff --git a/apps/cli/package.json b/apps/cli/package.json index 0510dc61..e2c5a0da 100644 --- a/apps/cli/package.json +++ b/apps/cli/package.json @@ -1,7 +1,7 @@ { "name": "@keygraph/shannon", "version": "0.0.0", - "description": "Shannon - Autonomous white-box AI pentester for web applications and APIs by Keygraph", + "description": "Shannon is an autonomous white-box AI pentester for web applications and APIs, by Keygraph.", "type": "module", "main": "dist/index.mjs", "bin": { @@ -35,8 +35,12 @@ "appsec", "keygraph" ], - "author": "", + "author": "Keygraph, Inc.", "license": "AGPL-3.0-only", + "bugs": { + "url": "https://github.com/KeygraphHQ/shannon/issues" + }, + "homepage": "https://github.com/KeygraphHQ/shannon#readme", "repository": { "type": "git", "url": "git+https://github.com/KeygraphHQ/shannon.git", diff --git a/apps/cli/src/commands/start.ts b/apps/cli/src/commands/start.ts index 9f114fc0..0f58f5ae 100644 --- a/apps/cli/src/commands/start.ts +++ b/apps/cli/src/commands/start.ts @@ -26,7 +26,7 @@ import { } from '../paths.js'; import { indentFailureSegments } from '../scan/failure.js'; import { resolveWorkflowId } from '../session.js'; -import { displaySplash } from '../splash.js'; +import { displayPlainBanner, displaySplash } from '../splash.js'; import { getTerminalOutcome } from '../temporal-client.js'; import { stdoutIsTerminal } from '../tty.js'; import { tailUntilComplete } from './logs.js'; @@ -81,10 +81,12 @@ export async function start(args: StartArgs): Promise { const repo = resolveRepo(args.repo); const config = args.config ? resolveConfig(args.config) : undefined; - // Inputs are valid — show the splash before the Docker/Temporal setup work. - // Skip it off a real terminal (e.g. CI) so piped/logged output stays clean. + // Inputs are valid — identify the run before the Docker/Temporal setup work. + const bannerVersion = isLocal() ? undefined : args.version; if (stdoutIsTerminal()) { - displaySplash(isLocal() ? undefined : args.version); + displaySplash(bannerVersion); + } else { + displayPlainBanner(bannerVersion); } // 4. Ensure workspaces dir is writable by container user (UID 1001) diff --git a/apps/cli/src/index.ts b/apps/cli/src/index.ts index 20d5e810..c35407e7 100644 --- a/apps/cli/src/index.ts +++ b/apps/cli/src/index.ts @@ -1,5 +1,5 @@ /** - * Shannon CLI — AI Penetration Testing Framework + * Shannon CLI — AI Pentester for Web Apps and APIs * * Unified CLI supporting two modes: * Local mode: Run from cloned repo — builds locally, mounts prompts, uses ./workspaces/ @@ -79,7 +79,7 @@ function showHelp(withSplash: boolean): void { const mode = getMode(); const prefix = commandPrefix(); - const header = withSplash ? '' : '\nShannon - AI Penetration Testing Framework\n'; + const header = withSplash ? '' : '\nShannon — AI Pentester by Keygraph\n'; console.log(`${header} Usage: diff --git a/apps/cli/src/splash.ts b/apps/cli/src/splash.ts index 6d3955a9..6a02adcc 100644 --- a/apps/cli/src/splash.ts +++ b/apps/cli/src/splash.ts @@ -75,3 +75,20 @@ export function displaySplash(version?: string): void { console.log(lines.join('\n')); } + +/** Matches the divider width the CI wrappers and the scan renderer already use. */ +const RULE_WIDTH = 60; + +/** + * Plain-text banner for non-terminal output (CI logs, pipes, redirects). + * Drops the wordmark but keeps the authorized-use notice, which a reader of + * someone else's pipeline log still needs to see. + */ +export function displayPlainBanner(version?: string): void { + const rule = '─'.repeat(RULE_WIDTH); + console.log(rule); + console.log(version ? ` Shannon v${version}` : ' Shannon'); + console.log(' AI Pentester for Web Apps and APIs, by Keygraph'); + console.log(' Authorized security testing only.'); + console.log(rule); +} diff --git a/apps/worker/src/branding.ts b/apps/worker/src/branding.ts new file mode 100644 index 00000000..c7a7fe56 --- /dev/null +++ b/apps/worker/src/branding.ts @@ -0,0 +1,18 @@ +// Copyright (C) 2025 Keygraph, Inc. + +/** + * Centralized brand strings for report deliverables. + * + * Kept in two parts because the two renderers join them differently: the Typst + * template splits its `brand` input on a pipe to set the cover's two lines + * (`report.typ:212`), while a human-read line takes an em dash. + */ + +export const PRODUCT_NAME = 'Shannon'; +export const PRODUCT_DESCRIPTOR = 'AI Pentester by Keygraph'; + +/** Cover wordmark for the Typst template, which parses the pipe. */ +export const TYPST_BRAND = `${PRODUCT_NAME} | ${PRODUCT_DESCRIPTOR}`; + +/** Attribution line for prose surfaces. */ +export const BRAND_LOCKUP = `${PRODUCT_NAME} — ${PRODUCT_DESCRIPTOR}`; diff --git a/apps/worker/src/services/pdf-renderer.ts b/apps/worker/src/services/pdf-renderer.ts index 71442318..a3d268e6 100644 --- a/apps/worker/src/services/pdf-renderer.ts +++ b/apps/worker/src/services/pdf-renderer.ts @@ -22,13 +22,14 @@ import { copyFile, cp, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'; import { tmpdir } from 'node:os'; import path from 'node:path'; import { promisify } from 'node:util'; +import { TYPST_BRAND } from '../branding.js'; import { adaptReportToTypst } from './report-json-adapter.js'; import type { ReportData } from './report-renderer.js'; const execFileAsync = promisify(execFile); const DEFAULT_TESTER = 'Shannon'; -const DEFAULT_BRAND = 'Shannon | AI Pentester by Keygraph'; +const DEFAULT_BRAND = TYPST_BRAND; const DATA_FILENAME = 'data.json'; const TEMPLATE_FILENAME = 'report.typ'; diff --git a/apps/worker/src/services/report-renderer.ts b/apps/worker/src/services/report-renderer.ts index 8ed68a4a..af04396f 100644 --- a/apps/worker/src/services/report-renderer.ts +++ b/apps/worker/src/services/report-renderer.ts @@ -12,6 +12,7 @@ * report agent previously wrote by hand. No LLM in the loop. */ +import { BRAND_LOCKUP } from '../branding.js'; import type { AddFindingInput, AdditionalSection, StepItem, StructuredStep } from '../collectors/finding-collector.js'; import type { VulnClass } from '../types/config.js'; @@ -212,6 +213,8 @@ export function renderReport(data: ReportData): string { // 1. Executive Summary sections.push('# Security Assessment Report'); sections.push(''); + sections.push(`*${BRAND_LOCKUP}*`); + sections.push(''); sections.push('## Executive Summary'); sections.push(`- Target: ${report_meta.target}`); sections.push(`- Assessment Date: ${report_meta.assessment_date}`); diff --git a/llms-full.txt b/llms-full.txt index 997835ac..f635757f 100644 --- a/llms-full.txt +++ b/llms-full.txt @@ -15,7 +15,7 @@ -Shannon - AI Pentester by Keygraph +Shannon, AI Pentester for Web Apps and APIs, by Keygraph KeygraphHQ%2Fshannon | Trendshift