Description
You get one pentest a year, but code ships every day, so for the other 364 days nobody knows what slipped into production. Ordinary scanners don't help much either: they hand you a pile of "possible" findings and leave you to verify each one by hand.
Keygraph Shannon is an autonomous AI pentester. It reads your source code to find attack paths, then uses browser automation and command-line tools to actually exploit the running web app and its APIs. Only vulnerabilities with a reproducible proof of concept make it into the report. No exploit, no entry, so there are no false positives to sift through.
It runs on your own machine. One
Source code plus live exploitation: it analyzes the code to find the attack surface, then proves each finding against the running application.
No exploit, no report: every finding ships with a working PoC your developers can replay, with no "theoretically possible" filler.
Web apps and APIs: authentication, authorization, SSRF, injection and similar classes are covered, and reports come as PDF or SARIF for your code-scanning pipeline.
Fits CI/CD: run it from GitHub Actions against staging or every release, so pentesting keeps pace with how often you ship.
Any model provider: Anthropic, OpenAI, xAI, AWS Bedrock and more, with custom base URLs and gateways supported.
Authorized targets only: it is built for authorized testing, so point it only at applications you own or have written permission to test.
Keygraph Shannon is an autonomous AI pentester. It reads your source code to find attack paths, then uses browser automation and command-line tools to actually exploit the running web app and its APIs. Only vulnerabilities with a reproducible proof of concept make it into the report. No exploit, no entry, so there are no false positives to sift through.
It runs on your own machine. One
npx @keygraph/shannon@latest starts an interactive launcher that walks you through setup and the first scan, the worker runs in Docker, and you bring your own model key, so Keygraph never proxies your model traffic.Features
Source code plus live exploitation: it analyzes the code to find the attack surface, then proves each finding against the running application.
No exploit, no report: every finding ships with a working PoC your developers can replay, with no "theoretically possible" filler.
Web apps and APIs: authentication, authorization, SSRF, injection and similar classes are covered, and reports come as PDF or SARIF for your code-scanning pipeline.
Fits CI/CD: run it from GitHub Actions against staging or every release, so pentesting keeps pace with how often you ship.
Any model provider: Anthropic, OpenAI, xAI, AWS Bedrock and more, with custom base URLs and gateways supported.
Authorized targets only: it is built for authorized testing, so point it only at applications you own or have written permission to test.
