keygraphhq/shannon is an AI penetration testing tool (AI pentester) targeting web applications and APIs. It analyzes source code to find attack paths and executes real exploits to prove vulnerabilities before they reach production. It is written in TypeScript and licensed under AGPL-3.0, and the latest release is v3.4.0. However, the changelog for this release is not currently in the record, so what changed cannot be confirmed.
This tool automates the specialized security work of application security analysis and validation. The README introduces Shannon as an autonomous AI pentester developed by Keygraph. It explains that Shannon analyzes source code to find attack paths and executes real exploits, then reports only the vulnerabilities for which a working proof-of-concept has been confirmed. An exploit is code that uses the vulnerability as-is to show that the problem actually occurs, and a proof-of-concept is a minimal example that can reproduce that behavior. The repository contains an open-source Shannon agent that runs locally from the command line. It has 49171 stars, and the repository was created on September 27, 2025.
The evidence ends there. There are no performance figures such as detection rate or false positive rate, and no comparison material against other tools, so it is hard to judge how much of an advantage it actually has. Its score is also only 6.2 out of 10 in the Momentum category, with no values for the novelty, technical, and quality categories. The claim that it reports only working proof-of-concepts is also a claim from the README. Because it assumes access to source code and requires compliance with the AGPL-3.0 license, the conditions have to be weighed before adoption.