Keygraph Platform

Shannon is an open-source pentester. It reads your source, maps routes and data flows, runs real attacks against a live target, and writes PDF and SARIF reports. It runs locally, in CI, or air-gapped with your own model. Shannon Open Source is a complete pentester, not a trial edition.

Keygraph Pro and Enterprise are built on an enhanced, enterprise-grade version of the Shannon engine. They run continuously across hundreds of repositories and add what a security team needs around it: audit-depth static analysis on a parsed code graph, business-logic testing, SCA and secrets scanning, one deduplicated record per vulnerability across scans and scanners, fix pull requests, fix verification, and SSO, RBAC, and audit logs. They are for security teams that own vulnerability management across many engineering teams and need one place to triage, assign, fix, and verify.

Both editions are BYOK. Keygraph never receives your source and never proxies model traffic, open source or commercial. Shannon Open Source runs from your machine or CI runner. The Keygraph platform deploys inside your cloud or data center, including fully air-gapped.

For a side-by-side table, see Editions.

How it fits your pipeline

1. Scans run on pull requests, releases, and a schedule against repositories in GitHub, GitLab, Azure DevOps, or Bitbucket.
2. Pipelines gate on exploited severity. A code-analysis hypothesis never fails a build.
3. Findings from every scanner and every run land as one record per vulnerability per repository, with an owner and an SLA. The same finding across ten runs is one record, not ten alerts.
4. From a finding, Keygraph opens a fix pull request into your normal review flow, for a developer to review and apply.
5. Verification confirms the fix against the changed code and the original exploit. No full rescan is required.

What is different technically

Static analysis on a code property graph

Shannon Open Source’s code analysis is sized to finish inside a CI run: agents read the repository, map the attack surface, and hand candidates to the pentester. The Keygraph platform is built for depth instead. It first parses each repository into a persistent code property graph, then runs an analysis harness adapted to query the graph rather than read files. The harness decomposes the application into risk, taint-flow, framework, and specialist tasks, and supports audit workflows that run longer than typical CI job windows.

On the graph, it performs:

• Interprocedural taint tracking across functions, files, fields, containers, and framework request lifecycles.
• Source, sink, and sanitizer modeling that records where validation, encoding, or authorization changes a path.
• Cross-repository modeling of services, entry points, and trust boundaries.
• Semantic deduplication of variants of the same defect, and exploit-chain analysis for combinations with higher impact than any single issue.
• Multiple review passes per candidate, checking each claim against the graph and the available deployment and configuration context. Candidates that cannot be substantiated are not reported.

Business-logic invariants

Shannon Open Source focuses on injection, XSS, SSRF, and broken authentication and authorization. The Keygraph platform adds testing for bugs that do not fit a vulnerability class: it derives invariants the application is supposed to hold (tenant isolation, workflow ordering, approval limits, balance conservation, state transitions) and tests them against the running application.

Proof by exploitation

The pentesting engine is an enhanced, enterprise-grade version of the Shannon engine, built on the same methodology and the same rule: a pentest finding requires a working exploit. No exploit, no finding. Pro and Enterprise store the exploit and replay it later to verify the fix.

SCA prioritizes vulnerable dependencies that application code actually reaches. Secrets scanning covers current source and repository history.

Findings

Shannon Open Source hands you a report per scan. The Keygraph platform deduplicates across runs and across scanners, deterministically and semantically, into one record per vulnerability per repository. Each record carries evidence, source location, severity, scan history, status, owner, resolution, and last-verified state.

Workflows cover assignment, triage, false-positive and risk-acceptance decisions, and SLA policies with escalation and aging. Dashboards report open risk, coverage, new versus resolved, SLA compliance, and MTTR, exportable as evidence for customers and auditors.

Findings still require human review. The platform’s extra review passes reduce weakly supported findings, but they do not eliminate them.

Fix and verify

From a finding, Keygraph opens a pull request with a proposed fix scoped to that finding. A developer reviews and applies it through your normal review flow. Keygraph never commits to a protected branch.

Verification re-analyzes the changed code and, for pentest findings, replays the original exploit against the patched target. The verdict comes from deterministic checks plus a review pass, without rerunning the full scan.

Deployment and access control

The Keygraph platform deploys entirely inside your AWS, GCP, Azure, or on-premises environment, including networks with no internet egress. There is no Keygraph-operated control plane. Customer-hosted services and stored platform data remain inside your environment for the life of the deployment.

Model access is BYOK and bring-your-own-model. Route workloads to Anthropic, OpenAI, xAI, or Bedrock, a private cloud endpoint, your own gateway such as LiteLLM with your routing and policy applied, or local models on vLLM or Ollama. Model requests go directly to the endpoint you configure. A local model supports a fully disconnected deployment.

Access control: SAML/OIDC SSO, SCIM, roles with repository-scoped visibility (RBAC, plus attribute and relationship rules where needed), a full audit log, and scoped API keys.

Keygraph maintains a SOC 2 Type II audit. The report is available to customers under NDA.

Talk to Keygraph

Visit keygraph.io, book a demo, or email shannon@keygraph.io.