A practical setup guide for Shannon, the open-source white-hat AI pentester from Keygraph. Point it at your staging URL and your repo. It reads your code, runs real exploits, and writes the report. AGPL licensed, about $50 per run on Claude Sonnet, 90 minutes per full scan.
The Problem Nobody Talks About
Most builders shipping with Claude Code never run security testing. The reasons are obvious. Annual pentests cost $5K to $50K, take 2 to 6 weeks, and don't fit a daily-ship cadence. By the time you book one, the codebase has changed three times.
So you ship without testing. Then you find the SQL injection in production from a customer report. Or the broken auth from a security researcher's email. Or the SSRF from a postmortem after an incident.
Shannon collapses the cycle. $50 per scan, 90 minutes per run, code-aware, runs on every push to staging if you want it. The annual pentest becomes a daily habit.
Why This Changes Everything
Real exploits, not theoretical scans.The "no exploit, no report" policy means every finding has a working proof of concept. Zero false positives. If it's in the report, it's exploitable.
Code-aware. Shannon reads your source code as part of the test. It uses the code to plan smarter attacks instead of just probing the surface like a black-box scanner.
Autonomous. Handles 2FA logins, navigation, exploitation, and reporting. No manual intervention. Once you start the scan, it runs to completion.
Built on the Claude Agent SDK. Powered by Anthropic Claude. Not a wrapper around an old vulnerability scanner. A true AI agent making decisions about where to attack and how.
Step 1: Install Prerequisites
Three things on your machine first:
- Docker (Shannon runs scanners in containers)
- Node.js 18+
- pnpm (only if you're building from source, npx-based install skips this)
Plus one of:
- Anthropic API key, or
- AWS Bedrock credentials, or
- Google Vertex AI credentials
You also need a staging or sandbox URL to test against. Never production. Never apps you don't own.
Step 2: Run Your First Scan (npx, recommended)
The fastest path is via npx. Two commands.
Setup:
npx @keygraph/shannon setupThis pulls the Docker images, sets up the scanning environment, and validates your API credentials.
Run a scan:
npx @keygraph/shannon start -u https://your-app.com -r /path/to/repoReplace the URL with your staging app. Replace the path with your local clone of the repo. Shannon takes it from here.