01
Recon
Enumerate the surface.
Nmap, Subfinder, WhatWeb, and Schemathesis map hosts, endpoints, and the stack.
Shannon, the open-source whitebox AI pentester by Keygraph
The open-source whitebox AI pentester.
Shannon is an open-source whitebox pentester for web applications and APIs. It reads your source code, traces candidate attack vectors, and executes working exploits against the running app to prove vulnerabilities before they reach production.
Run your first pentest.
Docker, Node 18+, and an Anthropic API key. No signup, no account. Shannon runs locally on your machine.
# 1. Configure credentials (interactive wizard, one-time setup) $ npx @keygraph/shannon setup # Or export env vars directly $ export ANTHROPIC_API_KEY=your-api-key # 2. Run a pentest $ npx @keygraph/shannon start -u https://your-app.com -r /path/to/your-repo
Prerequisites: Docker · Node.js 18+ · Anthropic API key (or Bedrock / Vertex AI)
What Shannon finds.
OWASP-class vulnerabilities identified, validated with working exploits, and recorded with reproducible PoCs. Not theoretical warnings.
Injection
SQLi, NoSQLi, command, template
Traces input from sources to dangerous sinks and fires real payloads.
XSS
Reflected, stored, DOM-based
Finds sanitization gaps and validates with real browser payloads.
SSRF
Cloud metadata, internal services
Targets internal endpoints, cloud metadata APIs, and private services.
Auth / Authz
Broken auth, IDOR, privilege escalation
Tests auth bypass, session handling, and object-level authorization.
Sample Report
20+ vulnerabilities identified in OWASP Juice Shop
Authentication bypass, database exfiltration, and broken access controls, each validated with a working proof-of-concept exploit you can reproduce.
See the full report →How Shannon works.
Four stages, from recon to report, mirroring how a human pentest runs.
02
Analyze
Read the source.
Traces candidate attack vectors across five vulnerability domains.
03
Exploit
Fire real attacks.
Parallel agents execute working proof-of-concept exploits against the running application via browser and CLI.
04
Report
Ship the findings.
Only validated, exploitable vulnerabilities are recorded, with reproducible PoCs and affected source paths. No Exploit, No Report.
Full architecture: Code Property Graph, multi-agent orchestration, static-dynamic correlation. See the Whitebox Pentester page →
Clone Shannon. One command to your first findings.
Shannon is free to self-host and runs locally.