KeygraphHQ/shannon
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
Ranks #2 among Security repositories ranked this week, and #3 over the last 30 days; #65 of 182 repositories with measured growth this week (top 36%).
This week's +1,057 stars is ahead of its 30-day pace of about +576 per week.
5 releases in the last 90 days, the latest 8 days ago, with 7 contributors on GitHub.
Peaked at #1 in the weekly ranking the week of Feb 8, its best in the past year.
Use Cases & Benefits
- Delivers autonomous AI-driven penetration testing for web applications and APIs by analyzing source code and executing real exploits to prove vulnerabilities.
- Provides proof-of-exploit reports with reproducible attack vectors, eliminating false positives and enabling confident, continuous security validation.
- Use for automated security testing integrated into CI/CD pipelines to catch vulnerabilities before production deployment.
- Ideal for security teams needing comprehensive OWASP vulnerability coverage including injection, XSS, SSRF, and broken authentication.
- Use for ethical hackers and researchers to perform deep, white-box pentesting with minimal manual intervention on sandboxed environments.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
AGPL 3.0
Network copyleft: like the GPL, and also triggered by offering the software over a network.
Community files
- README: present
Watch-outs
- AGPL-style copyleft also applies when the software is offered over a network.
General guidance from repository metadata, not legal advice. How we score
From the README
Shannon’s job is simple: break your web app before anyone else does.
The Red Team to your vibe-coding Blue team.
Every Claude (coder) deserves their Shannon.
Shannon is an AI pentester that delivers actual exploits, not just alerts.
Shannon's goal is to break your web app before someone else does. It autonomously hunts for attack vectors in your code, then uses its built-in browser to execute real exploits, such as injection attacks, and auth bypass, to prove the vulnerability is actually exploitable.
What Problem Does Shannon Solve?
Thanks to tools like Claude Code and Cursor, your team ships code non-stop. But your penetration test? That happens once a year. This creates a massive security gap. For the other 364 days, you could be unknowingly shipping vulnerabilities to production.
Shannon closes this gap by acting as your on-demand whitebox pentester. It doesn't just find potential issues. It executes real exploits, providing concrete proof of vulnerabilities. This lets you ship with confidence, knowing every build can be secured.
Real Results: Shannon discovered 20+ critical vulnerabilities in OWASP Juice Shop, including complete auth bypass and database exfiltration. See full report →
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
+4,659 stars over 89 days across 18 snapshot days; best day +257 on Oct 30.
Forks
6.0K+586
Open issues
32+1
Compared with peers in Security
Fastest-growing repositories GStars tracks in this cohort for the week of Nov 1, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| cloudflare/security-audit-skill | 61.7K | +8.8K | 17 | — |
| KeygraphHQ/shannon | 51.2K | +1.1K | 32 | 8 days ago |
| vxcontrol/pentagi | 33.5K | +712 | 38 | 31 days ago |
| Asymptote-Labs/agent-beacon | 3.3K | +360 | 40 | today |
| caddyserver/caddy | 78.8K | +267 | 60 | 1 day ago |
| gitleaks/gitleaks | 30.7K | +212 | 47 | 230 days ago |
| Category median | 33.5K | +360 | 40 | — |
Discover Repositories
Search across tracked repositories by name or description