george-keygraphandClaude Opus 5.5
9f04aee2c3
Tag every keygraph.io link in the README, the npm README, and the PDF report template with the Keygraph UTM vocabulary so Plausible can attribute site traffic by placement. - README.md: 7 links, utm_source=github, utm_medium=referral - apps/cli/README.md: 3 links, utm_source=npm (shows on npm after the next publish) - report.typ: keygraph-url, utm_source=shannon, utm_medium=product (header wordmark and cover "Tester" line in every PDF report) All use utm_campaign=shannon_oss_2026q4; utm_content names the placement. llms.txt, llms-full.txt and docs/ are left untagged on purpose: they are read by AI engines, and tagged URLs there would be repeated in AI answers and misattributed. Keep llms-full.txt untagged when regenerating it from the README. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Shannon is an autonomous, AI pentester for web applications and APIs.
It analyzes your source code, identifies attack paths, and executes real exploits to prove vulnerabilities before they reach production.
This package is Shannon: the full open-source agent, run locally from your command line.
Quick Start
Prerequisites
- Docker: required for the worker container.
- Node.js 18+: required for the recommended
npxworkflow. - AI provider credentials: Shannon runs on Anthropic, OpenAI, xAI, AWS Bedrock, and any other provider in the harness catalogue — each of which you can point at a proxy or LLM gateway through a custom base URL. You bring your own key, and Keygraph never proxies your model traffic. Shannon is provider-agnostic.
- Cyber safeguards cleared with your provider: Anthropic and OpenAI apply real-time safeguards to cyber-security workloads, which can interrupt a scan mid-run. Complete their guidance for legitimate security testers before your first run.
Run Shannon
Warning: Shannon actively executes exploits. Run it only against applications and environments you own or have explicit written authorization to test. Do not run Shannon against production systems.
# Configure credentials with the interactive wizard.
npx @keygraph/shannon setup
# Run a pentest against a source-available target.
npx @keygraph/shannon start -u https://your-app.com -r /path/to/your-repo
Shannon pulls the worker image from Docker Hub, starts the required local infrastructure, mounts the target repository read-only inside an ephemeral worker container, and writes results to a local workspace.
Editions
Shannon is this package: the open-source pentester you run yourself, on demand, and complete in that lane. Keygraph Pro and Keygraph Enterprise are the commercial editions. They run an enhanced build of Shannon continuously and close the full AppSec lifecycle around it: code analysis, finding management, automated remediation, verification, and enterprise deployment. The Community Program offers Pro at no cost to organizations that qualify. See keygraph.io/pricing.
Documentation
Full README, guides, and usage documentation: github.com/KeygraphHQ/shannon
License
Shannon is licensed under the GNU Affero General Public License v3.0.
Commercial and enterprise licensing is available for organizations that need different license terms, commercial support, private redistribution, managed-service use, or broader deployment options, including Keygraph Pro and Enterprise.
For commercial licensing, contact shannon@keygraph.io.
Built by Keygraph