Keygraph makes Shannon, the open-source AI pentester, and the Keygraph platform, continuous agentic pentesting for the enterprise.
Shannon is an autonomous AI pentester for web applications and APIs. It reads your source code, maps the attack paths, and runs real exploits against your running app. Only vulnerabilities with a working proof of concept make the report. No exploit, no report.
npx @keygraph/shannon@latest
Your model, your key. Anthropic, OpenAI, xAI, AWS Bedrock, LLM gateways, or a local model through Ollama, vLLM or LM Studio. Keygraph never proxies your model traffic.
Local or in CI. Run it from your terminal, or on pull requests, releases and schedules with the GitHub Action and the GitLab CI/CD component. The build fails only on proven exploits.
Reports for people and for tools. PDF and Markdown for your team, JSON and SARIF 2.1.0 for code scanning and security dashboards.
Read the docs · Quick start · Shannon 3.0 benchmark
AppSec and pentesting, on one platform. The Keygraph platform runs an enterprise-hardened build of Shannon continuously across your repositories, with the full AppSec suite around it.
Pentesting. Whitebox and blackbox pentesting plus business logic testing, with a working exploit behind every pentest finding.
Code security. Agentic SAST, SCA with reachability, and secrets scanning across repository history.
Findings to fixes. One record per vulnerability across every scan and scanner, fix pull requests, and fix verification by re-analysis and exploit replay.
Deployment. Cloud-hosted, self-hosted, or fully air-gapped. You choose the models, always with your own key.
U.S. nonprofits and pre-Series-A startups can apply to the Community Program to run Keygraph Pro at no cost.
Discord. Questions, setup help, and Shannon news. Join the server
Shannon runs real exploits. Use it only on applications you own or have written permission to test.
keygraph.io · X · LinkedIn · Discord