An AI pentester that breaks your app to prove it is vulnerable

What it does

Shannon is an autonomous white-box penetration testing framework that reads your web application’s source code to identify attack vectors, then launches real exploits—injection attacks, authentication bypass, SSRF, XSS—against the live application and its APIs. It only reports findings that come with a working proof-of-concept, filtering out theoretical vulnerabilities that cannot be triggered. The tool handles the full attack lifecycle including browser automation, 2FA/TOTP and SSO login flows, and parallel exploitation across vulnerability categories.

The interesting bit

The project draws a hard line between “might be vulnerable” and “is exploitable.” By requiring a reproducible exploit for every reported issue, Shannon treats unexploitable static findings as noise rather than signal. The Lite edition in this repository performs code-review prompting to guide dynamic attacks, while the commercial Pro edition adds a full Code Property Graph engine that correlates static data-flow traces with live exploit confirmation, mapping each confirmed bug back to its exact line of source code.

Key highlights

• Autonomous end-to-end operation from reconnaissance to report generation, including handling of SSO and TOTP flows
• Real exploit execution via browser automation and CLI tools; no passive scanning
• White-box only: requires source code access to guide attack strategy
• Parallel vulnerability analysis and exploitation across attack categories
• AGPL-3.0 Lite edition; Pro adds CPG-based SAST, SCA, secrets scanning, and business-logic testing with static-dynamic correlation

Caveats

• The repository is sunsetting its “Router Mode” (claude-code-router), which may affect existing workflows
• Shannon actively executes exploits against the target application, making it unsuitable for environments where you lack explicit authorization or cannot tolerate live attack traffic
• The Lite edition’s static analysis is limited to code review prompting; the deeper CPG-based SAST, business-logic testing, and CI/CD integrations are reserved for the commercial Pro edition

Verdict

Teams that ship frequently and need concrete, reproducible vulnerability evidence rather than scanner noise should look here. If you need black-box testing, cannot provide source code, or lack a safe target environment for live exploitation, this is not your tool.