KeygraphHQ/shannon

Worth a look if you maintain a web app with APIs and want code-informed exploit evidence rather than a scanner's list of maybes. Run it against a disposable staging environment and budget time for reviewing what it reports.

The problem

You want to know whether a release actually exposes an exploitable flaw before it ships, but the options at hand are slow. A scanner tells you a pattern exists; a human pentest gives you proof, but you have to book it and wait. Shannon changes the middle step: it reads the application's source code to pick likely attack paths, then drives a browser and command-line tools against the running application and its APIs to see whether those paths actually work. The output is meant to contain only findings with a working proof-of-concept, following its "No exploit, no report" rule.

What's different

The distinguishing idea is that source analysis guides exploitation, rather than either technique standing alone. That pairing is why the tool can spend its effort on paths a black-box scanner would not guess from the outside, and why its reports are framed as demonstrated exploits rather than suspected weaknesses. The README also points to the team's own write-up of a comparison against Aikido and XBOW, using the public Doyensec study of Photoview 2.4.0 as the shared target; treat that as vendor-adjacent evidence with stated methodology and limitations, not an independent verdict.

The trade-off is that it is not a passive tool. Its agents can create users, submit forms, change application state and trigger outbound requests, so the README explicitly asks for sandboxed, staging or local environments with disposable data. It also deliberately stays narrow: exhaustive agentic SAST, broader scanner coverage, centralized governance and full vulnerability lifecycle management are pushed to commercial editions. And the findings still need a person to read them, because the README says LLM-generated details can be weakly supported or wrong.

Who should try it

A good fit is a small product or platform team that already runs staging infrastructure and wants a repeatable exploit check inside development or CI/CD, especially for a web app whose APIs matter as much as its pages. A team with a legally cleared target and the habit of triaging reports will get the most from the code-plus-exploit approach.

A poor fit is anyone hoping to point it at production or a third-party site, or anyone who needs a fully passive audit that leaves state untouched. Teams wanting one dashboard for all scanner coverage and long-term vulnerability tracking will find that scope outside the open-source agent, and people unwilling to pay LLM API costs per run should look elsewhere. Running it on unfamiliar or adversarial codebases is explicitly discouraged because reading source can expose the tool to prompt injection.

Requirements and limitations

Expect a full run to take roughly one to one and a half hours and to incur model API costs that vary with pricing and application complexity. You supply your own LLM credentials; Anthropic, OpenAI, xAI and AWS Bedrock are built in, and other providers can be routed through a proxy or gateway, or described in a custom model configuration file when the catalogue does not carry them. A model that does not follow tool-use constraints reliably will weaken results.

The licence is AGPL-3.0, with commercial and enterprise terms available for private redistribution, managed-service use and support. The project is not accepting external code contributions, so bug reports and feature requests are the practical ways to influence it. Because exploitation changes state, ongoing care means keeping a dedicated test environment and a review process rather than treating any run as harmless.

HotRepo's take

HotRepo recorded 42,540 stars on 2026-05-17 and 49,899 on 2026-10-28, but only three daily-board observations exist between those dates, so persistence cannot be judged from that sample. Hacker News discussion is thin: a February 2026 thread reached 4 points with no comments, and a second thread drew a 2026-02-07 commenter's concern about misuse, without a project response in the supplied data. Before relying on it, check which findings its own comparison doc counts as confirmed exploits rather than attempted ones.

Project source and documentation