Editions
Shannon is the open-source pentester you run yourself. Keygraph Pro and Keygraph Enterprise are powered by an enhanced, enterprise-grade version of the Shannon engine, running continuously across many teams and repositories.
Shannon Open Source
Section titled “Shannon Open Source”Shannon Open Source is a complete autonomous pentester, not a trial edition. It is well suited to individual developers and small teams running focused security tests locally or in CI/CD. It reads your source, maps routes and data flows, runs real attacks against a live target, and writes PDF, Markdown, JSON, and SARIF reports. It runs locally, in CI, or air-gapped with your own model.
Keygraph platform
Section titled “Keygraph platform”The Keygraph platform is for organizations that need a shared platform for continuous pentesting and AppSec across many teams, repositories, and environments. It centralizes deeper analysis, vulnerability management, remediation, verification, governance, and reporting so teams do not have to assemble and maintain those workflows themselves.
Both editions are BYOK. Keygraph never receives your source and never proxies model traffic, open source or commercial.
Side-by-side comparison
Section titled “Side-by-side comparison”| Shannon Open Source | Keygraph platform | |
|---|---|---|
| Best for | Developers and teams running repository-level pentests locally or in CI | Security organizations running continuous AppSec across many teams and repositories |
| Code analysis | Agent pass over architecture, entry points, and data flows to seed the pentest, plus optional multi-stage security code analysis, sized to finish inside a CI run | Persistent code property graph plus a long-running analysis harness with interprocedural taint, sanitizer modeling, cross-repo context, exploit chains, and multi-pass review |
| Pentesting | On-demand, source-aware white-box pentesting with optional authenticated testing, focused on injection, XSS, SSRF, broken authentication, and broken authorization, with proof by exploitation | The enterprise-grade Shannon engine, run continuously, with grey-box and black-box targets and business-logic invariant testing |
| SCA and secrets | Not included | SCA with reachability and secrets scanning, including repository history |
| Findings | Per-run PDF, Markdown, JSON, and SARIF 2.1.0, with SARIF upload to GitHub code scanning | One record per vulnerability per repository across scans and scanners, plus ownership, SLAs, dashboards, and audit evidence |
| Fixes and verification | Fix manually from the report, then re-run the scan to verify | Fix pull requests for a developer to review and apply, verified by re-analysis and exploit replay without a full rescan |
| CI/CD and source control | GitHub Action and GitLab CI/CD component for pull-request, release, and scheduled runs, with gates on status: exploited | GitHub, GitLab, Azure DevOps, and Bitbucket with organization-wide policy and centrally managed integrations |
| Deployment and models | Runs locally or on a CI runner with BYOK to any Anthropic- or OpenAI-compatible endpoint or local model | Deployed in your AWS, GCP, Azure, or on-premises environment, including fully air-gapped. Model requests go directly to the provider, private endpoint, gateway, or local model you configure |
| Governance, license, support | AGPL-3.0, community support | SSO, SCIM, RBAC, and audit logs, plus a commercial license, enterprise support, and SOC 2 Type II |
Learn more
Section titled “Learn more”Read the Keygraph platform overview, visit the Keygraph website, book a demo, or contact shannon@keygraph.io.