FAQ
Can I self-host Shannon?
Section titled “Can I self-host Shannon?”Yes. Shannon Open Source runs inside your infrastructure in an ephemeral worker container. It mounts the repository read-only and writes results to a local workspace.
Keygraph never receives your source code and never proxies your model traffic. Your model requests go straight to the provider or endpoint you configure, and they carry source and application context with them. Point Shannon at a locally hosted endpoint and that traffic stays inside your environment too.
Does Shannon support bring your own key (BYOK)?
Section titled “Does Shannon support bring your own key (BYOK)?”Yes, always. You provide the LLM credentials Shannon uses to run a pentest, in every deployment, open source and commercial. Keygraph never proxies your model traffic.
Does Shannon output SARIF?
Section titled “Does Shannon output SARIF?”Yes. Shannon emits SARIF 2.1.0, the OASIS standard format for static analysis results, alongside structured JSON. Any SARIF consumer reads it: code scanning services, vulnerability management platforms, security dashboards, and CI/CD pipelines.
It is written by default on exploit-mode scans. To opt out, set report.sarif to "false" in your configuration file. See SARIF output.
Which AI providers does Shannon support?
Section titled “Which AI providers does Shannon support?”Anthropic, OpenAI, xAI, and AWS Bedrock are built in and configured directly by provider ID. Beyond those, Shannon runs on any provider in the Pi harness catalogue, named the same <provider>:<model-id> way.
Any provider can be pointed at a proxy or LLM gateway through a custom base URL, which overrides only the endpoint and keeps that provider’s API dialect. A model the catalogue does not carry, such as one a router or gateway serves under its own ID, or a self-hosted model, is described in a custom model configuration file and passed with --models-config. Shannon uses a single model setting throughout a pentest.
Can I run Shannon on a local or self-hosted model?
Section titled “Can I run Shannon on a local or self-hosted model?”Yes. Shannon works with local models served through Ollama, vLLM, or LM Studio, which expose an OpenAI-compatible endpoint, as well as routers such as OpenRouter and LLM gateways such as LiteLLM. Most self-hosted models are not in the harness catalogue, so describe them in a custom model configuration file passed with --models-config.
Capability varies. A model that does not follow Shannon’s instructions or tool-use constraints reliably will produce weaker pentests than a frontier model, so take this path only if you know how your chosen model behaves. See Local and self-hosted models.
Does Shannon actually exploit vulnerabilities, or just scan?
Section titled “Does Shannon actually exploit vulnerabilities, or just scan?”Shannon executes real exploits. It reports a finding only when it has produced a working proof-of-concept, and discards hypotheses it cannot prove. It is a pentester, not a passive scanner, so run it only against systems you are authorized to test, and never against production. See Safety & Limitations.
How long does a scan take?
Section titled “How long does a scan take?”A full run typically takes a few hours, and longer on large repositories, slower models, or with security code analysis enabled. Check progress with status, or tail the log with logs. See Monitor progress.
Can I resume a scan that was interrupted?
Section titled “Can I resume a scan that was interrupted?”Yes. Re-run start with the same URL and the same -w workspace name, and Shannon skips the agents that already completed. Use scans to find the name of an auto-named workspace. See Workspaces & Resuming.