Code analysis pass lands in Shannon 3.0 pentester

Keygraph has released Shannon 3.0, the third major version of its open-source AI pentester for web applications and APIs, adding a source-code analysis stage and publishing a self-scored comparison in which a DeepSeek v4 Flash run reported 18 findings on Photoview 2.4.0 for $6.10. The release is out under AGPL-3.0 and runs locally through npx or from source, as reported by Testingcatalog.

At a glance

• Shannon is a CLI agent that reads source code, attacks the running app with real exploits, and discards anything it cannot demonstrate live under the project's no exploit, no report rule.
• In Keygraph's own scoring, a Grok 4.6 run reported 10 findings for $35.07 and an Opus 5 run 24 for $115 with one false positive; Doyensec listed 32 validated findings for Aikido.
• An official GitHub Action and a GitLab CI/CD component run the same scan inside a pipeline, keep reports and logs as artifacts, and can fail a build on proven vulnerabilities above a chosen severity.

The comparison is Keygraph's own: it picked the target, the deployment and the scoring, so the numbers read as a vendor claim rather than an independent result. What they do put on the table is cost. Doyensec's study priced Aikido and XBOW scans at $4,000 each, while the three Shannon runs on Photoview 2.4.0 came in between $6.10 and $115, a spread that likely matters most to the developers and small teams the open-source build targets.

The new analysis pass is adapted from the open-source Mantis security review skills

Shannon reads an application's source code, works out where it is likely to break, then attacks the running app with real exploits, and anything it cannot demonstrate against the live target is discarded. The multi-stage pass runs alongside the recon and vulnerability agents, first building its own picture of the application: components, interfaces, dependencies, data flows, trust boundaries and high-value assets.

Agents then follow attacker-controlled data from entry point to sensitive operation, and the candidates they produce are deduplicated, challenged by a review agent, checked for production viability and confirmed against their code paths before entering the exploitation queue. The pass is opt-in through a config flag, and a code analysis hypothesis never becomes a finding on its own.

Three Shannon runs on Photoview 2.4.0 cost between $6.10 and $115

Keygraph published its own comparison. Doyensec, in an Aikido-sponsored study, had run Aikido and XBOW against two self-hosted applications; Keygraph took one of them, Photoview 2.4.0, set up a matching deployment, ran Shannon 3.0 with three models and scored the results itself.

DeepSeek v4 Flash reported 18 findings for $6.10, Grok 4.6 reported 10 for $35.07, and Opus 5 reported 24 for $115 with one false positive. Doyensec listed 32 validated findings for Aikido and 7 for XBOW, at $4,000 per scan each.

All three Shannon runs flagged the critical pre-auth SQL injection that Photoview has since patched, and the Opus 5 run caught six of the seven issues fixed in that round. Shannon runs self-hosted on operator-supplied models, across Anthropic, OpenAI, xAI, Bedrock and local runtimes.

Reports come out as PDF, Markdown and SARIF 2.1.0

Version 3.0 rebuilds the CLI so scan status, phase progress and per-agent logs read in the terminal, and checkpoints progress into named workspaces so an interrupted run resumes where it stopped. Reports come out as PDF and Markdown with evidence attached, plus SARIF 2.1.0 for GitHub code scanning.

Keygraph is the San Francisco company behind Shannon, founded in 2024 by Varun Sivamani, previously engineering lead for HRIS and payroll at Lattice, and backed by Pear VC and Authentic Ventures. The project passed 47,000 GitHub stars before this release and is named after Claude Shannon.

Keygraph also sells a commercial platform that runs an extended build of the same agent continuously, while Shannon Open Source is pitched as a complete pentester in its own lane, aimed at developers and small teams testing staging environments they own.

The second Doyensec target

Doyensec's study covered two self-hosted applications, and Keygraph has published Shannon 3.0 numbers for one of them, Photoview 2.4.0. Teams that want the code analysis stage have to switch it on through the config flag, and the GitHub Action and GitLab component fail a build only above the severity threshold an operator chooses.