Secure your app for free with Shannon and your AI subscription

Your Grok or ChatGPT subscription can also run security tests against your app. Shannon, Keygraph's open-source AI pentester, uses that model access to read your code, attack a test deployment, and report what it can exploit.

Shannon is free. With a supported subscription, model calls count against your plan's included usage. You can run a scan without buying a pentesting license or setting up a separately billed model API key. Your subscription limits and the cost of running your test environment still apply.

Start with a feature you're about to ship: a login flow, a file upload, or a change to who can read a record.

Give the model a way to test your app

Shannon reads the source to find routes, inputs, and access checks. Then its agents test the running app. A suspected issue becomes a pentest finding when an exploit works.

The open-source pentester covers injection, cross-site scripting, server-side request forgery, and broken authentication and authorization. You get a report with evidence to inspect and reproduce. See Shannon's coverage.

If your app has a login, give Shannon one disposable test account and the sample records it needs to test the features available to that account.

Connect the subscription you already have

Shannon supports Grok subscriptions and ChatGPT Plus or Pro through Pi, the agent software that handles its model connection. The commands here use Shannon 3.5.0. Subscription setup.

Install Pi, run pi, type /login, pick your provider, and sign in with your subscription. Pi saves your login in ~/.pi/agent/auth.json. With SHANNON_USE_PI_AUTH=1, Shannon reuses that login to access your subscription. For ChatGPT, choose Sign in with an account → OpenAI Codex, called OpenAI Codex (legacy) in some older Pi versions. These Shannon 3.5.0 instructions use the openai-codex provider, not the separate openai provider offered by "Sign in with ChatGPT".

For Grok 4.7, enable that login and select the model in your terminal:

export SHANNON_USE_PI_AUTH=1
export SHANNON_AI_MODEL=xai:grok-4.7

For ChatGPT, use this model selection instead:

export SHANNON_USE_PI_AUTH=1
export SHANNON_AI_MODEL=openai-codex:gpt-6-sol

Run the commands below from the same terminal where you exported these variables.

ChatGPT users also need the cyber access required by the selected model. Start with the Daybreak application. Enterprise users can follow OpenAI's workspace setup.

Choose an app to test

Pick a web app or API that you own or are authorized to test, running in staging, a sandbox, or your local development environment. You can use an existing environment. Have the source repository for the deployed version available so Shannon can analyze the code while testing the running application.

You’ll need Docker running and Node.js 22.19 or later installed. Make sure the target URL is reachable from Shannon’s Docker container. For local apps, see the platforms and networking guide.

If your app requires authentication, follow the configuration guide to provide the test account credentials, login steps, and a successful-login check. Use a high-privilege test account, such as an administrator, so Shannon can reach more features and API endpoints. An account with limited permissions restricts the parts of the application it can test.

Use a disposable test account and data, and add sample records for the features or permissions you want tested. Shannon executes real exploits, so test only systems you own or have explicit authorization to assess. Do not run it against production.

Keep the login configuration outside Git. Treat Pi’s auth.json, scan logs, and reports as sensitive, and redact credentials and private findings before sharing them.

Check access, then start the scan

Repository and configuration paths can be absolute or relative to your current directory.

Run the model and login checks with your target URL and paths from the terminal where you selected the subscription:

npx @keygraph/shannon@3.5.0 start -u "https://staging.example.com" -r "./my-app" --validate-model --follow
npx @keygraph/shannon@3.5.0 start -u "https://staging.example.com" -r "./my-app" -c "./shannon.yaml" --validate-auth --follow

These checks make model requests. They let you catch an access or login problem before the full scan. The login check signs in to the real test app and stops before the pentest. Confirm authentication validation succeeded before continuing; it does not prove the account has the intended role or that authorization checks ran. Validation details.

Then run the scan:

npx @keygraph/shannon@3.5.0 start \
  -u "https://staging.example.com" \
  -r "./my-app" \
  -c "./shannon.yaml" \
  --follow

Open Security-Assessment-Report.md or Security-Assessment-Report.pdf in the report location shown by Shannon. Workspace behavior.

Turn the findings into fixes

Read the exploit evidence before changing code. Reproduce the issue on the test deployment, make a focused fix, and test it again. A coding agent can help with the patch when you give it the failing request and expected behavior.

Use the final report to review the findings and exploit evidence. If you want more detail about what happened during the scan, read .shannon/workflow.log inside the scan’s workspace. Output locations.

When your team needs continuous checks

Shannon gives developers a way to run a pentest and work from its report. As that work spreads across repositories, the Keygraph platform adds shared finding history, owners, fix pull requests, and fix verification. It also adds dependency and secrets scanning.

For the full model, login, and scope configuration, see Shannon’s provider guide and configuration guide.