Keygraph has released Shannon 3.0, the third major version of its open-source AI pentester for web applications and APIs. Shannon is a CLI agent that reads an application's source code, works out where it is likely to break, then attacks the running app with real exploits. Anything it cannot demonstrate against the live target gets discarded, a rule the project states as no exploit, no report. It is out now under AGPL-3.0, run locally through npx or from source.
The headline change is a multi-stage security code analysis pipeline, adapted from the open-source Mantis security review skills. It runs alongside the recon and vulnerability agents, first building its own picture of the application: components, interfaces, dependencies, data flows, trust boundaries, and high-value assets. Agents then follow attacker-controlled data from entry point to sensitive operation, and the candidates they produce are deduplicated, challenged by a review agent, checked for production viability, and confirmed against their code paths before entering the exploitation queue. The pass is opt-in through a config flag, and a code analysis hypothesis never becomes a finding on its own.
Keygraph published its own comparison. Doyensec, in an Aikido-sponsored study, had run Aikido and XBOW against two self-hosted apps. Keygraph ran Shannon 3.0 against one of them, Photoview 2.4.0, on a matching deployment with three models, and scored the results itself. DeepSeek v4 Flash reported 18 findings for $6.10, Grok 4.6 reported 10 for $35.07, and Opus 5 reported 24 for $115 with one false positive. All three runs flagged the critical pre-auth SQL injection Photoview has since patched, and the Opus run caught six of the seven issues fixed in that round. Doyensec listed 32 validated findings for Aikido and 7 for XBOW, at $4,000 per scan each.
Version 3.0 also rebuilds the CLI so scan status, phase progress, and per-agent logs read in the terminal, and checkpoints progress into named workspaces so interrupted runs resume where they stopped. An official GitHub Action and a GitLab CI/CD component run the same scan inside a pipeline, keep reports and logs as artifacts, and can fail a build on proven vulnerabilities above a chosen severity. Reports come out as PDF and Markdown with evidence attached, plus SARIF 2.1.0 for GitHub code scanning. Shannon runs self-hosted on operator-supplied models, across Anthropic, OpenAI, xAI, Bedrock, and local runtimes.
Check out the official repo
Learn more Keygraph is the San Francisco company behind Shannon, founded in 2024 by Varun Sivamani, previously engineering lead for HRIS and payroll at Lattice, and backed by Pear VC and Authentic Ventures. The project passed 47,000 GitHub stars before this release and is named after Claude Shannon. Keygraph also sells a commercial platform that runs an extended build of the same agent continuously. Shannon Open Source is pitched as a complete pentester in its own lane, aimed at developers and small teams testing staging environments they own.