Creators of Shannon (https://xitter.cf/t.co/k8jTv5iJs1)
Joined October 2025
- Tweets77
- Following15
- Followers422
- Likes31
Pinned Tweet
Grok is now your on-demand AI hacker.
Connect your xAI subscription to Shannon and run full pentests on your own apps.
No separate API bill.
No cyber verification required.
Every finding ships with a working proof of concept.
Open source, 49K+ stars.
@SpaceXSI
5/ Grok has become one of the easiest ways to get Shannon running quickly.
Its guardrails are generally compatible with legitimate pentesting workflows, and you can get started without going through an additional lengthy approval process.
Install Shannon.
Connect Grok.
Point it at your app.
Go.
6/ So if you already subscribe to Grok:
You may already have most of what you need for an on-demand AI pentester.
Shannon is open source:
github.com/KeygraphHQ/shanno…
Grok + Shannon is a pretty powerful combination.
A year ago today, we pushed the first commit of Shannon to a public GitHub repo and now Shannon has 48.5k stars!
Here's what the year looked like:
• 27 releases, from v1.0 in March to v3.3 last month
• 145 merged pull requests and 148 closed issues
• Shannon 2.0 (July): rebuilt from the ground up to run on the model you already use, including Anthropic, OpenAI, xAI, Bedrock, and local models
• Shannon 3.0 (September): reads your code before it attacks, maps trust boundaries and data flows, runs inside your CI/CD pipeline, and delivers PDF and SARIF reports
Thank you to everyone who tried out Shannon for themselves! Every bug report and every Discord question made the next release better. And thank you to the Keygraph team for 27 releases in six months!
Happy Birthday Shannon!
Shannon 3.0 brings automated pentesting straight into your CI/CD pipeline via our official GitHub Action and GitLab component.
How it works:
Automated Testing: Checks out your source code and attacks your running staging target.
Rich Reporting: Exports PDF, Markdown, and SARIF artifacts, feeding SARIF data directly into GitHub Code Scanning.
Strict Validation: Jobs only pass if every vulnerability class is assessed. Setting fail-on-severity blocks the build only when Shannon successfully proves an exploit.
Flexible Triggers: Out of the box, run it per PR, on release, or on a weekly schedule.
With Shannon, Keygraph is trying to shift the entire pentesting process left, turning what has traditionally been a once-a-year engagement into a routine developers can run as often as they like.
This however can only work if the runs are affordable. Ours cost $6.10 in DeepSeek v4 Flash tokens against Photoview 2.4.0, the benchmark app Doyensec used to compare two $4,000 platforms, and it flagged the exact same critical SQL injection: a pre-auth boolean oracle, CVSS 9.8, unauthenticated read of the whole database.
GitHub Action: github.com/KeygraphHQ/shanno…
Benchmark: github.com/KeygraphHQ/shanno…
Benchmark details: Photoview 2.4.0, three BYO models — DeepSeek v4 Flash, Grok 4.6, Claude Opus 5.
All three found the critical SQLi. Costs ran $6.10 to $115.
Full methodology, reports, costs, misses, and limitations:
github.com/KeygraphHQ/shanno…
Shannon remains open source, self-hosted, and model-agnostic. Run it on-prem or in your cloud, in CI, with whatever model provider you want.
Goal: make continuous pentesting a normal part of how software gets built.
Full announcement: github.com/KeygraphHQ/shanno…
8/
Upgrading from 1.x: rerun the setup wizard before your first 2.0 scan.
The three model tier variables are gone, and Google Vertex AI support has been removed. Full migration steps are in the announcement.
9/
Thank you to everyone who tested Shannon, filed issues, shared feedback, and pushed the project further than we ever expected.
Announcement: github.com/KeygraphHQ/shanno…
Repo: github.com/KeygraphHQ/shanno…
