Sourcery MCP
Let your coding agent request Sourcery reviews and fix the comments and security findings itself
Shannon
Autonomous AI pentester that only reports bugs it can exploit
About
Shannon is an AGPL-3.0 project by Keygraph with close to 50,000 stars on GitHub. The open source Lite edition is free; Keygraph sells Pro and Enterprise editions for continuous pentesting.
## What it does Shannon runs a multi-agent pentest: it analyzes your source, finds likely injection, auth, SSRF and XSS paths, then tries to exploit each one against a running copy of your app. Only findings with a working exploit end up in the report, with steps to reproduce. It can run in GitHub Actions and export SARIF. Only run it against apps you own or are allowed to test. It sends real attacks. ## Install You need Docker, Node 18+ and a model key (Anthropic, OpenAI, xAI or Bedrock). `npx @keygraph/shannon@latest`
Features
- Source code aware attack planning
- Real exploits against the live app
- Reports only proven vulnerabilities
- GitHub Actions and SARIF output
- Works with Anthropic, OpenAI, xAI or Bedrock keys
- Runs in Docker
Install
Related skills
All skillsRelated articles
All articlesGrok Bot vs Claude Code and Codex: What Each One Is For
How Grok Bot, a persistent personal agent, differs from coding agents like Claude Code and Codex, and when it makes sense to use each one or both together.
7 Tools to Cut Your Coding Agent's Token Bill (2026)
Seven tools that cut Claude Code, Codex and Cursor token usage by compressing shell output, searching code and fetching current docs, with honest caveats.
How to Give Your AI Agent Email, Memory and a Sandbox
Six building blocks that turn a chat model into an agent that can work on its own: an inbox, memory, a safe place to run code, app access, background jobs and tracing.
