We don't report what might be vulnerable. We prove what is.

Keygraph makes Shannon, the open-source AI pentester, and the Keygraph platform, continuous agentic pentesting for the enterprise.

     

Shannon is an autonomous AI pentester for web applications and APIs. It reads your source code, maps the attack paths, and runs real exploits against your running app. Only vulnerabilities with a working proof of concept make the report. No exploit, no report.

npx @keygraph/shannon@latest

Your model, your key. Anthropic, OpenAI, xAI, AWS Bedrock, LLM gateways, or a local model through Ollama, vLLM or LM Studio. Keygraph never proxies your model traffic.

Local or in CI. Run it from your terminal, or on pull requests, releases and schedules with the GitHub Action and the GitLab CI/CD component. The build fails only on proven exploits.

Reports for people and for tools. PDF and Markdown for your team, JSON and SARIF 2.1.0 for code scanning and security dashboards.

Open source under AGPL-3.0, with commercial licensing available through shannon@keygraph.io.

Read the docs · Quick start · Shannon 3.0 benchmark

The Keygraph platform

AppSec and pentesting, on one platform. The Keygraph platform runs an enterprise-hardened build of Shannon continuously across your repositories, with the full AppSec suite around it.

Pentesting. Whitebox and blackbox pentesting plus business logic testing, with a working exploit behind every pentest finding.

Code security. Agentic SAST, SCA with reachability, and secrets scanning across repository history.

Findings to fixes. One record per vulnerability across every scan and scanner, fix pull requests, and fix verification by re-analysis and exploit replay.

Deployment. Cloud-hosted, self-hosted, or fully air-gapped. You choose the models, always with your own key.

Governance. SSO, SCIM, RBAC, audit logs, Jira sync, and SOC 2 Type II.

Schedule a technical demo → · Compare plans · Shannon and the platform, side by side

U.S. nonprofits and pre-Series-A startups can apply to the Community Program to run Keygraph Pro at no cost.

Community

Discord. Questions, setup help, and Shannon news. Join the server

Office hours. Every Thursday at 10:00 AM PT (US/EU) and 2:00 PM IST (Asia). Book a slot

Bugs and ideas. Open an issue or start a discussion.

_{Shannon runs real exploits. Use it only on applications you own or have written permission to test.}

keygraph.io · X · LinkedIn · Discord