KeygraphHQ

    KeygraphHQ/shannon

    #65 this week

    Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

    security
    ai-penetration-testing
    ai-security
    api-security
    appsec
    ci-cd
    TypeScript
    AGPL-3.0
    51.2K stars
    6.0K forks
    51.2K GitHub watchers
    Updated Nov 5, 2026
    View on GitHub

    Build with Backblaze B2

    SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.

    Explore Backblaze Labs

    Loading star history...

    Where it stands

    Rank, growth pace and release cadence relative to everything GStars tracks.

    Ranks #2 among Security repositories ranked this week, and #3 over the last 30 days; #65 of 182 repositories with measured growth this week (top 36%).

    This week's +1,057 stars is ahead of its 30-day pace of about +576 per week.

    5 releases in the last 90 days, the latest 8 days ago, with 7 contributors on GitHub.

    Peaked at #1 in the weekly ranking the week of Feb 8, its best in the past year.

    Use Cases & Benefits

    • Delivers autonomous AI-driven penetration testing for web applications and APIs by analyzing source code and executing real exploits to prove vulnerabilities.
    • Provides proof-of-exploit reports with reproducible attack vectors, eliminating false positives and enabling confident, continuous security validation.
    • Use for automated security testing integrated into CI/CD pipelines to catch vulnerabilities before production deployment.
    • Ideal for security teams needing comprehensive OWASP vulnerability coverage including injection, XSS, SSRF, and broken authentication.
    • Use for ethical hackers and researchers to perform deep, white-box pentesting with minimal manual intervention on sandboxed environments.

    Should you depend on it?

    License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.

    License

    AGPL 3.0

    Network copyleft: like the GPL, and also triggered by offering the software over a network.

    Community files

    • README: present

    Watch-outs

    • AGPL-style copyleft also applies when the software is offered over a network.

    General guidance from repository metadata, not legal advice. How we score

    From the README

    Shannon’s job is simple: break your web app before anyone else does.

    The Red Team to your vibe-coding Blue team.

    Every Claude (coder) deserves their Shannon.

    Shannon is an AI pentester that delivers actual exploits, not just alerts.

    Shannon's goal is to break your web app before someone else does. It autonomously hunts for attack vectors in your code, then uses its built-in browser to execute real exploits, such as injection attacks, and auth bypass, to prove the vulnerability is actually exploitable.

    What Problem Does Shannon Solve?

    Thanks to tools like Claude Code and Cursor, your team ships code non-stop. But your penetration test? That happens once a year. This creates a massive security gap. For the other 364 days, you could be unknowingly shipping vulnerabilities to production.

    Shannon closes this gap by acting as your on-demand whitebox pentester. It doesn't just find potential issues. It executes real exploits, providing concrete proof of vulnerabilities. This lets you ship with confidence, knowing every build can be secured.

    Real Results: Shannon discovered 20+ critical vulnerabilities in OWASP Juice Shop, including complete auth bypass and database exfiltration. See full report →

    Excerpt from the KeygraphHQ/shannon README on GitHub (AGPL-3.0 license). © its authors.Read the full README on GitHub

    Daily snapshots

    Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots

    Aug 14: +24Aug 17: +29Aug 18: +10Sep 3: +85Sep 4: +19Oct 30: +257Oct 31: +191Nov 4: +93Nov 5: +121

    +4,659 stars over 89 days across 18 snapshot days; best day +257 on Oct 30.

    Forks

    6.0K+586

    Open issues

    32+1

    Compared with peers in Security

    Fastest-growing repositories GStars tracks in this cohort for the week of Nov 1, by 7-day star growth

    KeygraphHQ/shannon compared with Security repositories by stars, 7-day star growth, health score and last release
    RepositoryStars+7dHealthLast release
    cloudflare/security-audit-skill61.7K+8.8K17—
    KeygraphHQ/shannon51.2K+1.1K328 days ago
    vxcontrol/pentagi33.5K+7123831 days ago
    Asymptote-Labs/agent-beacon3.3K+36040today
    caddyserver/caddy78.8K+267601 day ago
    gitleaks/gitleaks30.7K+21247230 days ago
    Category median33.5K+36040—

    Discover Repositories

    Search across tracked repositories by name or description