Prosper Otemuyiwa

Shannon performs autonomous white-box penetration tests on web apps and APIs. It analyzes source code, identifies attack vectors such as XSS, SQLi, SSRF, and authentication flaws, then executes real exploits to prove vulnerabilities are exploitable.

Shannon targets application security engineers, penetration testers, and developers who need to validate vulnerabilities in their own web applications and APIs. It suits teams running security audits against local or staging environments before production deployment.

Invoke it with a target URL and repository, e.g. 'shannon http://localhost:3000 myapp' or 'shannon --workspace=audit1 http://staging.example.com myrepo'. Docker and Git binaries must be installed, and the ANTHROPIC_API_KEY environment variable must be set.

Shannon is open source under the AGPL-3.0 license, published by KeygraphHQ on GitHub. It is free to use and modify, but derivative networked services must also comply with AGPL-3.0 source disclosure requirements.

Shannon requires Docker and Git binaries plus the ANTHROPIC_API_KEY environment variable. Optional variables include CLAUDE_CODE_OAUTH_TOKEN, CLAUDE_CODE_USE_BEDROCK, CLAUDE_CODE_USE_VERTEX, and AWS credentials (AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) for Bedrock-backed runs.