mirror of
https://github.com/KeygraphHQ/shannon.git
synced 2026-10-08 01:01:10 +02:00
george-keygraphandClaude Opus 5.5
5d961820b3
Drop "Shannon Open Source" and "the Keygraph platform" as product names. The open-source project is Shannon (Shannon OSS where a contrast helps), and the commercial editions are Keygraph Pro and Keygraph Enterprise, plus the Community Program. The one retired-names line now maps Shannon Lite to Shannon and Shannon Pro to Keygraph Pro. Also covers the npm README, the coverage and safety docs, llms.txt and the regenerated llms-full.txt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
61 lines
3.4 KiB
Markdown
61 lines
3.4 KiB
Markdown
<div align="center">
|
|
|
|
<img src="https://raw.githubusercontent.com/KeygraphHQ/shannon/main/assets/github-banner-light.png" alt="Shannon, AI Pentester for Web Apps and APIs, by Keygraph" width="100%">
|
|
|
|
### Shannon is an autonomous, AI pentester for web applications and APIs.
|
|
|
|
It analyzes your source code, identifies attack paths, and executes real exploits to prove vulnerabilities before they reach production.
|
|
|
|
**This package is Shannon: the full open-source agent, run locally from your command line.**
|
|
|
|
---
|
|
|
|
<a href="https://discord.gg/9ZqQPuhJB7"><img src="https://raw.githubusercontent.com/KeygraphHQ/shannon/main/assets/discord_button_light.png" height="40" alt="Join Discord"></a> <a href="https://keygraph.io/"><img src="https://raw.githubusercontent.com/KeygraphHQ/shannon/main/assets/keygraph_button_light.png" height="40" alt="Visit Keygraph.io"></a>
|
|
|
|
---
|
|
|
|
</div>
|
|
|
|
## Quick Start
|
|
|
|
### Prerequisites
|
|
|
|
- **Docker**: required for the worker container.
|
|
- **Node.js 18+**: required for the recommended `npx` workflow.
|
|
- **AI provider credentials**: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, and any other provider in the harness catalogue — each of which you can point at a proxy or LLM gateway through a custom base URL. You bring your own key, and Keygraph never proxies your model traffic. Shannon is provider-agnostic.
|
|
- **Cyber safeguards cleared with your provider**: Anthropic and OpenAI apply real-time safeguards to cyber-security workloads, which can interrupt a scan mid-run. Complete their guidance for legitimate security testers before your first run.
|
|
|
|
### Run Shannon
|
|
|
|
> **Warning:** Shannon actively executes exploits. Run it only against applications and environments you own or have explicit written authorization to test. Do not run Shannon against production systems.
|
|
|
|
```bash
|
|
# Configure credentials with the interactive wizard.
|
|
npx @keygraph/shannon setup
|
|
|
|
# Run a pentest against a source-available target.
|
|
npx @keygraph/shannon start -u https://your-app.com -r /path/to/your-repo
|
|
```
|
|
|
|
Shannon pulls the worker image from Docker Hub, starts the required local infrastructure, mounts the target repository read-only inside an ephemeral worker container, and writes results to a local workspace.
|
|
|
|
## Editions
|
|
|
|
**Shannon** is this package: the open-source pentester you run yourself, on demand, and complete in that lane. **Keygraph Pro** and **Keygraph Enterprise** are the commercial editions. They run an enhanced build of Shannon continuously and close the full AppSec lifecycle around it: code analysis, finding management, automated remediation, verification, and enterprise deployment. The **Community Program** offers Pro at no cost to organizations that qualify. See [keygraph.io/pricing](https://keygraph.io/pricing).
|
|
|
|
## Documentation
|
|
|
|
**Full README, guides, and usage documentation:** [github.com/KeygraphHQ/shannon](https://github.com/KeygraphHQ/shannon#readme)
|
|
|
|
## License
|
|
|
|
Shannon is licensed under the [GNU Affero General Public License v3.0](https://github.com/KeygraphHQ/shannon/blob/main/LICENSE).
|
|
|
|
Commercial and enterprise licensing is available for organizations that need different license terms, commercial support, private redistribution, managed-service use, or broader deployment options, including Keygraph Pro and Enterprise.
|
|
|
|
For commercial licensing, contact [shannon@keygraph.io](mailto:shannon@keygraph.io).
|
|
|
|
<p align="center">
|
|
<b>Built by <a href="https://keygraph.io">Keygraph</a></b>
|
|
</p>
|