Shannon

Best for: development teams who want automated security testing against their own web applications before shipping to production.

Shannon, from Keygraph, is an autonomous white-box AI pentester for web applications and APIs. It analyses your source code, identifies attack paths, and then executes real exploits to prove a vulnerability is genuinely reachable rather than theoretical. This repository is the full open-source agent, run locally from the command line; version 2.0 runs on the Pi harness.

What makes it useful: proof over speculation. Most scanners produce long lists of possible issues that someone must then triage by hand. By executing exploits, Shannon distinguishes real, reachable vulnerabilities from noise — which is exactly the triage burden that causes security findings to be ignored. Source-code access also means it reasons about attack paths a black-box scanner cannot see.

Where it falls short: only ever run this against systems you own or are explicitly authorised to test — executing real exploits against anything else is illegal. It complements rather than replaces human security review, and AGPL v3 has real implications for commercial use.

Details: TypeScript, AGPL 3.0. Ships llms.txt for agents.