shannon

No entries match these filters. Clear filters

1. v3.5.0 Oct 27, 2026 · issue 122

   Shannon v3.5.0 adds an experimental --exp-php2shell upgrade-verification probe to the CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.5.0 https://github.com/KeygraphHQ/shannon.git
   # already have the repo? check out this version:
   $ git checkout v3.5.0

   └──▷ TRY IT
   Run the experimental PHP-to-shell upgrade-verification probe against a target during a pentest to validate shell-upload exploit paths before they reach production.
   copy

   $ npx @keygraph/shannon@latest --exp-php2shell

2. v3.4.0 Oct 6, 2026 · issue 096

   Shannon v3.4.0 adds an exploit-readiness probe and --validate-auth preflight mode, plus hyperlinked finding IDs in PDF reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.4.0 https://github.com/KeygraphHQ/shannon.git
   # already have the repo? check out this version:
   $ git checkout v3.4.0

   └──▷ TRY IT
   Validate auth credentials and confirm exploit-readiness before committing to a full pentest run.
   copy

   $ npx @keygraph/shannon@latest preflight --validate-auth

   • Adds --validate-auth mode to the preflight command to verify authentication configuration before a pentest run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds an exploit-readiness probe to the preflight subsystem to confirm the environment is ready to execute exploits.
   • Links finding IDs in the PDF report to their corresponding detail sections for faster navigation.
   • Adds --validate-auth mode to the preflight command to verify authentication configuration before a pentest run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds an exploit-readiness probe to the preflight subsystem to confirm the environment is ready to execute exploits.

   1 more in Everything

3. docs update Oct 4, 2026 · issue 094

   Shannon adds opt-in security code analysis and SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output with OWASP Top Ten 2025OWASP Top Ten 2025A ranked list of the ten most critical web application risk categories, maintained by the Open Worldwide Application Security Project, used by cyber tools to prioritize vulnerability detection and remediation guidance. tagging⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Enable code analysis in an exploitative scan to surface repository-level vulnerabilities that the exploitation agent then has to prove.
   yaml copy

   enabled: true

   • Adds opt-in security code analysis via an enabled key in its config block, feeding pre-pentest repository findings into the exploitation phase where an agent must still demonstrate each candidate before it is reported.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds SARIF output, mapping findings to rules shannon/injection, shannon/xss, shannon/auth, shannon/authz, shannon/ssrf, and shannon/miscellaneous, tagged with their OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top Ten 2025 category, with severity mapped to SARIF levels: critical/high → error, medium → warning, all else → note.

   2 details in Everything

4. docs update Oct 4, 2026 · issue 094

   Shannon 3.1 adds live model-catalogue refresh, preflight validation, custom model config, and compat flags for reasoning models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Route a model the catalogue does not carry (e.g. a gateway-assigned ID) through OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code. by describing it in a custom model config file.
   yaml copy

   provider: z-ai
   baseUrl: https://openrouter.ai/api/v1
   models:
     glm-5:
       name: Z.ai: GLM 5.3
       reasoning: true
       contextWindow: 131072

   Disable unsupported roles for a reasoning-capable model that rejects the developer role and reasoning-effort parameter.
   ~/.shannon/config.toml copy

   providers:
     openai:
       compat:
         supportsDeveloperRole: false
         supportsReasoningEffort: false

   Select an AWS Bedrock model for a scan using the new provider-scoped syntax.
   copy

   $ SHANNON_AI_MODEL=amazon-bedrock:anthropic.claude-opus-4-5 shannon scan <target>

   • Adds compat.supportsDeveloperRole and compat.supportsReasoningEffort flags (settable at provider or model level) to suppress roles that reasoning-capable models reject.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds custom model configuration file support so models not in the catalogue (e.g. router or gateway IDs) can be described and then referenced like any built-in model; the file is schema-checked before the scan starts and a fault names the offending field.
   • Adds SHANNON_USE_PI_AUTH=1 environment variable to read credentials from Pi instead of a local environment variable.
   • Adds "api": "openai-completions" field in custom model configuration to route Chat Completions-only endpoints that cannot speak OpenAI Responses.
   • Adds SHANNON_AI_MODEL=amazon-bedrock:<model-id> to select AWS Bedrock models, replacing the old CLAUDE_CODE_USE_BEDROCK=1 plus three separate Bedrock model ID variables.

   +4 more show less

   • Adds live network refresh of the model catalogue at scan start so newly released models resolve without upgrading Shannon, with automatic fallback to the built-in catalogue on timeout.
   • Adds preflight validation that checks provider and model ID against the catalogue, parses and schema-checks any custom model configuration file, verifies credential presence, and probes credential validity with one minimal request before any agent runs.
   • Adds optional base URL per provider to route through a proxy or LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway.
   • Moves model selection to core.model in ~/.shannon/config.toml, with per-provider sections replacing the old [models] section and bedrock.use key.
   • Adds compat.supportsDeveloperRole and compat.supportsReasoningEffort flags (settable at provider or model level) to suppress roles that reasoning-capable models reject.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds custom model configuration file support so models not in the catalogue (e.g. router or gateway IDs) can be described and then referenced like any built-in model; the file is schema-checked before the scan starts and a fault names the offending field.
   • Adds SHANNON_USE_PI_AUTH=1 environment variable to read credentials from Pi instead of a local environment variable.
   • Adds "api": "openai-completions" field in custom model configuration to route Chat Completions-only endpoints that cannot speak OpenAI Responses.
   • Adds live network refresh of the model catalogue at scan start so newly released models resolve without upgrading Shannon, with automatic fallback to the built-in catalogue on timeout.

   +2 more show less

   • Adds preflight validation that checks provider and model ID against the catalogue, parses and schema-checks any custom model configuration file, verifies credential presence, and probes credential validity with one minimal request before any agent runs.
   • Adds optional base URL per provider to route through a proxy or LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !SHANNON_AI_OPENAI_FORMAT is removed in 3.1; a Chat Completions-only endpoint now requires a custom model configuration with "api": "openai-completions".
   • !A custom base URL no longer exempts the model ID from catalogue validation; the model ID must resolve in the catalogue or be described with a custom model configuration file.
   • !The CLAUDE_CODE_USE_BEDROCK=1 approach (plus three Bedrock model ID environment variables) is replaced by SHANNON_AI_MODEL=amazon-bedrock:<model-id>.
   • !Google Vertex AI is no longer supported; users must switch to Anthropic, AWS Bedrock, or an Anthropic-compatible base URL.
   • !In ~/.shannon/config.toml, the [models] section and bedrock.use key are removed; each provider now has its own section and the model lives at core.model — re-run the init command to regenerate the file.
5. docs update Oct 4, 2026 · issue 094

   Shannon CLI gains logs command to tail per-agent output, --list-agents flag, and structured --json snapshot mode⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Identify which agents are available in a workspace before tailing logs, useful when you don't know the agent names upfront.
   copy

   $ npx shannon logs my-workspace --list-agents

   Tail a specific agent's log in real time to debug a slow or failing recon stage without noise from other agents.
   copy

   $ npx shannon logs my-workspace --agent recon

   Capture a single machine-readable snapshot of workspace status for ingestion into a CI pipeline or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
   copy

   $ npx shannon logs my-workspace --json

   • Adds logs [<workspace>] --agent <name> command to tail a single agent's own log stream in real time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds logs [<workspace>] --list-agents flag to enumerate all available agent names before tailing.
   • Adds --json flag to produce a single machine-readable snapshot instead of live streaming output.
   • Adds help [<command>] command (also available as -h / --help on every command) to show usage or a specific command's help page.
   • Every scan now writes a combined canonical log at .shannon/workflow.log and per-agent projection files under .shannon/agents/, one file per pipeline agent and per security code analysis stage.

   5 details in Everything

6. docs update Oct 4, 2026 · issue 094

   Shannon CLI gains interactive launcher, --follow log streaming, phase-by-phase progress checks, and automatic scan resumption via -w.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Stream a scan's log live in the same terminal so you don't need a second window to monitor progress.
   copy

   $ shannon scan --follow -w my-workspace

   Resume a stopped or interrupted scan without losing prior progress by reusing the same workspace name.
   copy

   $ shannon scan -w my-workspace

   Check live phase-by-phase progress or tail the log of the currently running scan from a second terminal.
   copy

   $ shannon scans

   • Adds an interactive launcher that walks through setup and a first pentest without manual flag assembly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --follow flag to stream the scan log in the same terminal until the scan finishes.
   • Adds live phase-by-phase progress, log tailing, and scan listing from a second terminal using the scans subcommand.
   • Supports automatic scan resumption by re-running with the same -w workspace name after a stop or interruption.
   • Supports CI/CD integrations to run Shannon on pull requests, releases, or a schedule.

   +1 more show less

   • Reconciles security code analysis candidates with the pentest's own findings before exploitation when security code analysis is enabled.

   6 details in Everything

7. docs update Oct 4, 2026 · issue 094

   Shannon: open-source AI pentester for web apps and APIs, with CI/CD integrations, authenticated testing, and BYOKBYOKBring Your Own Key — a cloud deployment model where the customer supplies and controls the encryption keys rather than the provider, so sensitive data stays under the customer's cryptographic authority. AI provider support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Run your first pentest instantly against a locally running web app without installing anything.
   copy

   $ npx @keygraph/shannon start

   Bring your own Anthropic key and model to control AI costs and model selection.
   copy

   $ SHANNON_AI_MODEL=claude-3-7-sonnet-20250219 ANTHROPIC_API_KEY=sk-ant-... npx @keygraph/shannon start

   • Adds SHANNON_AI_MODEL environment variable to select the AI backend, supporting Anthropic, OpenAI, xAI, AWS Bedrock, gateways, and local models (BYOK).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Provides CLI commands start, scans, logs, and status for running and monitoring pentests.
   • Supports authenticated testing by describing a login flow so Shannon can test behind authentication.
   • Supports workspaces and resuming an interrupted scan without repeating completed work.
   • Publishes docs as machine-readable llms.txtllms.txtA proposed convention for a plain-text file placed at a website's root to give LLMs a concise, structured summary of the site's content, helping AI agents navigate it more reliably than parsing raw HTML., llms-full.txt, and llms-small.txt for AI agent consumption.

   +4 more show less

   • Launches Shannon, an open-source AI pentester for web applications and APIs (AGPL-3.0) that reads source code, runs real exploits against a live app, and reports only proven findings.
   • Runs pentests via npx @keygraph/shannon or a build from source.
   • Provides official GitHub Action and GitLab CI/CD component for pull-request, release, and scheduled pentests.
   • Supports Windows, Linux, and macOS targets, including reaching local targets over the network.

   9 details in Everything

8. docs update Sep 26, 2026 · issue 086

   Shannon gains documented config file support with authenticated testing, scope rules, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output, and agentic SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. via -c flag⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Run an authenticated scan of a Next.js app with agentic SAST enabled, scoped to API endpoints only, and export a SARIF report for ingestion into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or code-scanning tool.
   copy

   $ npx @keygraph/shannon@latest start -u https://example.com -r /path/to/repo -c ./my-app-config.yaml

   Configure authenticated form login with TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip., restrict scope to /api, and emit a SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. log alongside the PDF report.
   ./my-app-config.yaml copy

   description: "Next.js e-commerce app on PostgreSQL."
   agentic_sast:
     enabled: "true"
   authentication:
     login_type: form
     login_url: "https://your-app.com/login"
     credentials:
       username: "test@example.com"
       password: "yourpassword"
       totp_secret: "LB2E2RX7XFHSTGCK"
     login_flow:
       - "Type $username into the email field"
       - "Type $password into the password field"
       - "Click the 'Sign In' button"
     success_condition:
       type: url_contains
       value: "/dashboard"
   rules:
     avoid:
       - description: "AI should avoid testing logout functionality"
         type: url_path
         value: "/logout"
     focus:
       - description: "AI should emphasize testing API endpoints"
         type: url_path
         value: "/api"
   report:
     min_severity: low
     min_confidence: low
     sarif: "true"

   Override saved credentials for a single CI session without editing ~/.shannon/config.toml or .env.
   copy

   $ export ANTHROPIC_API_KEY=sk-ant-... 
   npx @keygraph/shannon@latest start -u https://staging.example.com -r /path/to/repo -c ./my-app-config.yaml

   • Adds -c flag to shannon start / npx @keygraph/shannon@latest start to load a YAML configuration file, enabling authenticated testing, scope guidance, rules of engagement, SAST, and report filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds agentic_sast.enabled config key to opt in to agentic static analysis, which reads the repository for vulnerabilities before the pentest and feeds findings into the exploitation phase.
   • Adds authentication block in config (with login_type, login_url, credentials, totp_secret, login_flow, and success_condition) to drive form-based and TOTP authenticated scans.
   • Adds rules block with avoid and focus sub-keys supporting rule types url_path, subdomain, domain, method, header, parameter, and code_path (repo-relative globs) to guide scan scope.
   • Adds report block with min_severity, min_confidence, guidance, and sarif keys; sarif: "false" opts out of the SARIF 2.1.0 log (report.sarif) written by default on exploit runs.

   +1 more show less

   • Supports SHANNON_USE_PI_AUTH=1 environment variable to run Shannon on a ChatGPT Plus/Pro (Codex) or xAI (Grok) subscription.

   6 details in Everything

9. docs update Sep 26, 2026 · issue 086

   Shannon CLI documented with full command reference, output layout, and CI integration via --follow flag⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Block a CI job until a pentest finishes and propagate the scan's exit code — no manual polling needed.
   copy

   $ ./shannon start -u https://staging.example.com -r /path/to/repo -w ci-run --follow

   Tail only the output of a specific agent while a scan is running, useful when triaging a slow or noisy component.
   copy

   $ ./shannon logs ci-run --agent <name>

   Run a scan with a custom config and write the deliverables to a dedicated report folder for archiving.
   copy

   $ ./shannon start -u https://example.com -r ./my-app -c ./shannon-config.yaml -o ./reports/q1-audit -w q1-audit

   • Adds shannon start -u <url> -r <repo> as the primary pentest invocation, accepting an absolute or relative repository path mounted read-only in the worker container.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds -c <path> flag to shannon start to supply a YAML configuration file at scan time.
   • Adds -o <path> flag to shannon start to copy deliverables to a custom output directory after the run completes.
   • Adds -w <name> flag to shannon start to assign a named workspace, enabling multiple concurrent scans to be distinguished.
   • Adds --follow flag to shannon start to stream the log until the scan finishes and then exit with the scan's outcome, enabling CI pipeline integration.

   +9 more show less

   • Adds shannon logs [<workspace>] command to tail combined scan output, with --agent <name> to tail a single agent and --list-agents to enumerate available agents.
   • Adds shannon status [<workspace>] command for scan status, with --json flag for machine-readable output.
   • Adds shannon scans command to list all running and completed scans.
   • Adds shannon stop [<workspace>] command to stop a single scan, with --yes to skip confirmation and --all to stop every running scan.
   • Adds shannon reset command to stop all scans and permanently remove all Temporal data.
   • Adds shannon version command to print the installed Shannon version.
   • Adds shannon build --no-cache command (source-build mode) to rebuild the worker image without cache.
   • Produces final reports in both PDF (Security-Assessment-Report.pdf) and Markdown (Security-Assessment-Report.md) at the workspace root, with internals nested under .shannon/ including per-agent logs under .shannon/agents/, rendered prompts under .shannon/prompts/, screenshots and scripts under .shannon/scratchpad/, resume state in .shannon/session.json, and a combined log at .shannon/workflow.log.
   • Supports ANTHROPIC_API_KEY environment variable (and other AI provider credentials via .env or shell export) to select the AI backend used during pentesting.

   14 details in Everything

10. docs update Sep 26, 2026 · issue 086

    Shannon gains multi-provider AI support: set SHANNON_AI_MODEL to pick Anthropic, OpenAI, xAI, Bedrock, or any local model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Route all model traffic through an internal LiteLLM gateway while keeping existing provider credentials — avoids direct egress to cloud AI endpoints.
    copy

    $ export SHANNON_AI_API_KEY=your-gateway-key
    export SHANNON_AI_MODEL=anthropic:claude-sonnet-4-6
    export SHANNON_AI_BASE_URL=https://llm-gateway.example.com
    npx @keygraph/shannon@latest start -u https://your-app.com -r /path/to/your-repo

    • Sets the AI provider and model for an entire scan with SHANNON_AI_MODEL=<provider>:<model-id>; defaults to anthropic:claude-sonnet-4-6.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Routes model traffic through a proxy or LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway by setting SHANNON_AI_BASE_URL alongside SHANNON_AI_MODEL, leaving credential selection and API dialect unchanged.
    • Reaches local OpenAI-compatible servers (Ollama, vLLM, LM Studio) by describing them in a models.json file and passing it with --models-config at scan time.
    • Supports AWS Bedrock via AWS_BEARER_TOKEN_BEDROCK and AWS_REGION; bearer-token auth only — IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles and instance profiles are not supported.
    • Accepts any provider in the Pi harness catalogue by naming it in SHANNON_AI_MODEL and supplying its key in SHANNON_AI_API_KEY.

    +2 more show less

    • Supports native provider credential variables ANTHROPIC_API_KEY, OPENAI_API_KEY, and XAI_API_KEY as overrides for SHANNON_AI_API_KEY when the matching provider is selected.
    • Adds an interactive npx @keygraph/shannon@latest setup wizard for configuring providers, including Anthropic, OpenAI, xAI, AWS Bedrock, custom base URL, and other providers.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The ANTHROPIC_SMALL_MODEL, ANTHROPIC_MEDIUM_MODEL, and ANTHROPIC_LARGE_MODEL variables no longer do anything; replace them with SHANNON_AI_MODEL=anthropic:<model-id>.
11. docs update Sep 26, 2026 · issue 086

    shannon: Adds start -u <URL> -r <path> to run a pentest against a target application, with -c/--config for a configuration YAML, -o/--output for a custom deliverables directory, -w/--workspace for named workspaces that auto-resume, --follow to stream the scan log and exit on scan outcome (CI-friendly), --pipeline-testing for fast minimal-prompt test runs, and --keep-container to preserve the worker container for post-run log inspection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Run a pentest in CI, streaming the log and exiting with the scan outcome so a failed pentest fails the pipeline.
    copy

    $ npx @keygraph/shannon@latest start -u https://example.com -r /path/to/repo --follow

    Resume a named workspace pentest with a custom config file and copy deliverables to a specific output directory after the run.
    copy

    $ npx @keygraph/shannon@latest start -u https://example.com -r /path/to/repo -c /path/to/my-config.yaml -w q1-audit -o ./my-reports

    Check progress of a named scan in a script-friendly format, then tail its live log for human review.
    copy

    $ npx @keygraph/shannon scans --json
    npx @keygraph/shannon status q1-audit --json
    npx @keygraph/shannon logs q1-audit

    • Adds logs [<workspace>] to tail a scan's live log, defaulting to the running scan or most recent workspace.
    • Adds setup interactive wizard to configure AI provider credentials in npx mode.
    • Adds --models-config <path> flag on start to supply a models.json Pi model config for models not in the harness catalogue.

    3 details in Everything

12. docs update Sep 26, 2026 · issue 086

    shannon: Adds npx @keygraph/shannon@latest start -u <url> -r <repo-path> (or ./shannon start -u -r) to launch a fully autonomous pentest — pre-recon through exploitation — against a source-available target, mounting the repo read-only inside an ephemeral Docker worker container.

    └──▷ TRY IT
    Run a full autonomous pentest against a source-available web app, giving Shannon the live URL and the local repo path so it can correlate code with runtime behaviour.
    copy

    $ npx @keygraph/shannon@latest start -u https://your-app.com -r /path/to/your-repo

    Monitor a running scan in real time from a second terminal while the pentest is in progress.
    copy

    $ npx @keygraph/shannon logs <workspace> && npx @keygraph/shannon status

    • Adds npx @keygraph/shannon logs <workspace> and npx @keygraph/shannon status (or ./shannon logs / ./shannon status) to stream logs and check scan progress from a second terminal.
    • Writes final pentest results as Security-Assessment-Report.pdf and Security-Assessment-Report.md under ~/.shannon/workspaces/{hostname}_{sessionId}/ (npx) or ./workspaces/ (source build).
    • Exploit-mode runs also emit report.sarif (SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema.) alongside structured JSON for ingestion by GitHub code scanning or any SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. consumer.
    • Supports AI providers Anthropic, OpenAI, xAI, and AWS Bedrock (plus any provider in the Pi harness catalogue) and accepts a custom base URL to point at a proxy or LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway.
    • Exposes the Temporal Web UI at http://localhost:8233 for detailed per-step workflow monitoring during a run.

    5 details in Everything

13. docs update Sep 26, 2026 · issue 086

    Shannon 3.0 launches as an autonomous AI pentester with SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output, native CI/CD, PDF reports, and multi-provider LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Run a pentest against a staging app with its source repo so Shannon can correlate code analysis with live exploitation.
    copy

    $ npx @keygraph/shannon@latest start \
      -u https://staging.example.com \
      -r /path/to/your/repo

    Gate a pull-request pipeline on exploited high-severity findings and publish SARIF to GitHub code scanning.
    .github/workflows/pentest.yml copy

    name: Shannon Pentest
    on:
      pull_request:
    permissions:
      security-events: write
    jobs:
      pentest:
        runs-on: ubuntu-latest
        steps:
          - uses: actions/checkout@v4
          - name: Run Shannon
            uses: KeygraphHQ/shannon-action@v1
            with:
              url: https://staging.example.com
              api-key: ${{ secrets.SHANNON_AI_API_KEY }}
              fail-on-severity: high
              upload-sarif: true

    Configure AI provider credentials before the first scan using the interactive setup wizard.
    copy

    $ npx @keygraph/shannon@latest setup

    • Adds native GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. integration via KeygraphHQ/shannon-action@v1 with url, api-key, fail-on-severity, and upload-sarif inputs.
    • Gates CI/CD pipelines on fail-on-severity: high (or other thresholds), counting only findings with status: exploited — not code-analysis hypotheses.
    • Publishes SARIF findings to GitHub code scanning when upload-sarif: true is set in the Action.
    • Adds native GitLab CI/CD component alongside the GitHub Action.
    • Produces multi-format output: evidence-rich PDF, Markdown, JSON, and SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. — with SARIF enabled by default for exploit-mode scans.

    +7 more show less

    • Supports BYOKBYOKBring Your Own Key — a cloud deployment model where the customer supplies and controls the encryption keys rather than the provider, so sensitive data stays under the customer's cryptographic authority. across Anthropic, OpenAI, xAI, AWS Bedrock, compatible API gateways, and local models via Ollama, vLLM, or LM Studio.
    • Supports OpenAI Codex (ChatGPT Plus and Pro) and xAI subscriptions as an alternative to API credits.
    • Adds authenticated testing support for credentials, login flows, TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip., email authentication, focus areas, and rules of engagement through configuration.
    • Adds resumable workspaces that continue interrupted scans without repeating completed work.
    • Runs each scan in an ephemeral Docker container with an isolated, per-invocation workspace.
    • Covers OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against.-focused domains: Injection, XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., broken authentication, and broken authorization.
    • Combines agentic security code analysis (mapping architecture, trust boundaries, data flows) with live exploitation agents before producing any finding.

    12 details in Everything

14. v3.3.0 Sep 21, 2026 · issue 081

    Shannon v3.3.0 refreshes the AI model catalogue over the network at scan start so new models are available without a tool update.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v3.3.0

15. v3.2.0 Sep 8, 2026 · issue 069

    Shannon v3.2.0 adds custom pi model configs with registry-resolvable IDs and surfaces startup/preflight failures.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v3.2.0

    • Supports custom pi model configs with registry-resolvable model IDs and distinct model error codes.
    • Surfaces startup and preflight failures so misconfiguration errors are visible before a scan begins.
    • Supports custom pi model configs with registry-resolvable model IDs and distinct model error codes.

    1 more in Everything

16. v3.1.0 Sep 3, 2026 · issue 064

    Shannon v3.1.0 adds per-provider custom base URL support for the OpenAI Responses API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v3.1.0

17. v3.0.0 Sep 2, 2026 · release notes

    Shannon v3.0 introduces an agentic SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. mode for cyber tooling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v3.0.0

    • Adds agentic SAST capability to the scanner

    1 detail in Everything

18. v2.7.0 Aug 28, 2026 · issue 058

    Shannon v2.7.0 adds xAI (Grok) subscription auth so pentests can run on an xAI plan instead of API credits.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v2.7.0

    • Supports running pentests authenticated via an xAI (Grok) subscription, removing the need for pay-per-token API credits.

    1 detail in Everything

19. v2.6.0 Aug 27, 2026 · release notes

    v2.6.0 adds branding for npm page, CLI output, and reports in shannon

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v2.6.0

20. v2.5.0 Aug 18, 2026 · release notes

    Shannon v2.5.0 overhuals CLI commands with live scan status and adds PDF report generation via Typst.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v2.5.0

    • Overhuals CLI commands and adds live scan status display during active scans.
    • Adds PDF security report rendering powered by Typst.

    2 details in Everything

21. v2.3.0 Aug 6, 2026 · release notes

    Adds SHANNON_AI_API_KEY env var to use any AI provider instead of a hardcoded one

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v2.3.0

    └──▷ USE IT
    Run shannon with a custom API key from any supported provider.
    shell copy

    SHANNON_AI_API_KEY=your_api_key shannon scan

    • Supports any AI provider via the SHANNON_AI_API_KEY environment variable

    1 detail in Everything

22. v2.2.0 Aug 4, 2026 · release notes

    Shannon v2.2.0 adds severity recording in analysis mode.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v2.2.0

    • Records severity level during analysis

    1 detail in Everything

23. v2.1.0 Jul 30, 2026 · release notes

    shannon v2.1.0 adds multi-provider model support and native SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v2.1.0

    └──▷ USE IT
    Export scan results for integration with SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or vulnerability management platforms
    shell copy

    shannon scan --provider openai --model gpt-4 --output-format sarif report.json

    • Adds multi-provider model support for running inference across different AI providers
    • Adds --output-format sarif flag to export results in SARIF format

    2 details in Everything

24. v1.9.0 Jul 4, 2026 · release notes

    Shannon v1.9.0 restructures the run folder and improves terminal UX for CLI usage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v1.9.0

25. v1.8.0 Jun 22, 2026 · release notes

    shannon v1.8.0 adds multi-repo support to preflight by removing the .git directory check

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v1.8.0

    └──▷ TRY IT
    Run the preflight check on a folder that contains multiple repositories without Git metadata.
    copy

    $ shannon preflight /path/to/non-git-repo

    • preflight no longer requires a .git directory, enabling multi-repo targets

    1 detail in Everything

26. v1.7.0 Jun 12, 2026 · release notes

    Shannon v1.7.0 adds support for Claude Fable 5 via upgraded Agent SDK

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

27. v1.6.0 Jun 11, 2026 · release notes

    shannon v1.6.0 upgrades AI backends to Opus 4.8 and Claude Agent SDK 0.3.163

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    • Upgrades underlying AI models to use Opus 4.8

    1 detail in Everything

28. v1.5.0 Jun 5, 2026 · release notes

    Shannon v1.5.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. collector support for structuring intermediate deliverables in the worker

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

29. v1.4.0 May 28, 2026 · release notes

    shannon v1.4.0 adds /etc/hosts forwarding to worker containers and agent session sharing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • docker mode now forwards the host's /etc/hosts entries into each worker container
    • Authenticated preflight sessions are shared across multiple agents

    2 details in Everything

30. v1.3.0 May 26, 2026 · release notes

    shannon v1.3.0 adds auth-validation preflight and email_login credentials to the CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    • Adds email_login as a supported credential type for authenticating with remote targets

    1 detail in Everything

31. v1.2.0 May 6, 2026 · release notes

    Shannon v1.2.0 adds --no-scan for analysis-only mode and config-driven run scoping

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    • Introduces run.scope.include_files, run.scope.exclude_files, and report.filter.severity config keys in ~/.config/shannon/config.yaml to limit which files are scanned and which findings appear in reports.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Running shannon with sudo or as root now blocks execution.
32. v1.1.0 Apr 21, 2026 · release notes

    Shannon v1.1.0 adds library-pipeable pipeline core, provider extensions, and read-only user repos.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    • extract_pipeline_core for library consumption
    • mount user repo as read-only with writable shannon overlay
    • provider extensions support (drops claude-code-router mode)
    • use structured outputsstructured outputsForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. for vuln agent exploitation queues

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !claude-code-router mode is removed and no longer supported.
33. v1.0.0 Mar 26, 2026 · release notes

    New CLI flags (--output, --workspace), new providers (Vertex AI, OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code., DeepSeek), and pipeline controls

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/KeygraphHQ/shannon.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    └──▷ TRY IT
    Save scan results directly to a specific directory instead of the default location
    copy

    $ shannon scan target --output ./results/v1

    • Adds --output flag to specify a configurable output directory for scan results and deliverables
    • Adds --workspace flag to resume workflows from a named workspace or list available workspaces
    • Adds Google Vertex AI provider support with automatic service account authentication
    • Adds OpenRouter provider support for claude-code-router multi-model testing
    • Adds DeepSeek provider support for claude-code-router multi-model testing

    +5 more show less

    • Adds custom base URL support for Anthropic-compatible endpoints via environment variable or config
    • Adds configurable pipeline retry and concurrency settings to control worker execution
    • Adds named workspaces and workspace listing capability
    • Adds preflight validation phase that runs before scanning with structured error reporting
    • Expands injection analysis scope to include LFI, RFI, SSTISSTIServer-Side Template Injection, a vulnerability class where attacker-controlled input is evaluated by a server-side template engine, enabling remote code execution or data exfiltration., Path Traversal, and DeserializationDeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution.

    10 details in Everything