22nd of 2 in Security
shannon
Autonomous pentester that exploits web apps and APIs using source code analysis
Documentation ↗
(opens in a new tab)Website ↗
(opens in a new tab)Repository on GitHub ↗
(opens in a new tab)
- Stars
- 48.9k
- License
- AGPL-3.0
- Last commit
- Oct 2026
- Last release
- Oct 2026
- Language
- TypeScript
33,629 on 25 Mar 202648,884 on 14 Oct 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
Shannon reads a web application's source, maps attack paths, then uses browser automation and command-line tools to run real exploits against the running app and its APIs. Only findings with a working proof of concept reach the PDF, Markdown, JSON or SARIF 2.1.0 report. It runs from an npx launcher with an ephemeral Docker worker, and also ships a GitHub Action and a GitLab CI component.
Who it is for: Developers and security teams pentesting apps they own, locally or in CI
Strengths
- Reports only exploits with a reproducible proof of concept, which cuts speculative scanner noise
- Outputs PDF, Markdown, JSON and SARIF 2.1.0; GitHub Action and GitLab CI can gate on exploited findings
- Bring your own key: Anthropic, OpenAI, xAI, Bedrock, gateways, or local Ollama, vLLM and LM Studio
- Supports authenticated scans (login flows, TOTP) and resumable workspaces
Weaknesses
- Needs source code of the target; black-box testing is only in paid Pro and Enterprise
- Actively executes exploits, so it must not be pointed at production systems
- Anthropic and OpenAI cyber safeguards can interrupt scans unless you complete their verification
- Claude Code subscriptions unsupported after version 1.9.0; model API costs are yours
What it needs
- no GPU
- Docker + Compose
- Needs Docker, Node.js 18+, AI provider API key or subscription
- Models: Anthropic, OpenAI, xAI, AWS Bedrock, Ollama
Head to head
Also in Security
See all 2| Rank | Project | Score |
|---|---|---|
| 1 | StrixAutonomous AI pentesting agents that validate vulnerabilities with working exploits | 74 out of 100 |