{ "manifest_version": "1", "slug": "shannon", "title": "Shannon", "headline": "Run the Shannon AI pentester on a disposable VM", "description": "Run Shannon, Keygraph's open-source AI pentester, on a throwaway exe.dev VM: the model from the LLM integration, the target an app you own, and nothing on your laptop.", "category": "security", "tags": [ "shannon", "ai pentester", "penetration testing", "keygraph", "appsec", "owasp juice shop", "sarif", "security testing", "white-box pentest" ], "url": "https://exe.dev/deploy/shannon", "markdown_url": "https://exe.dev/deploy/shannon.md", "upstream": { "website": "https://keygraph.io", "source": "https://github.com/KeygraphHQ/shannon", "docs": "https://github.com/KeygraphHQ/shannon/tree/main/docs", "license": "AGPL-3.0" }, "example_vm_name": "my-shannon", "time": "15 minutes, then 1-2 hours per scan", "stack": [ { "name": "Shannon CLI", "detail": "@keygraph/shannon 3.x on Node.js 24", "data": "~/.shannon/config.toml" }, { "name": "Temporal", "detail": "temporalio/temporal in Docker, started by Shannon", "port": 8233, "data": "Docker volume infra_temporal-data" }, { "name": "Shannon worker", "detail": "keygraph/shannon in Docker, one container per scan", "data": "~/.shannon/workspaces" }, { "name": "OWASP Juice Shop", "detail": "bkimminich/juice-shop, a deliberately vulnerable practice target", "port": 3000, "data": "~/juice-shop (its source, for Shannon to read)" } ], "access": [ { "url": "ssh my-shannon.exe.xyz", "who": "private", "what": "start scans, follow them, read reports" }, { "url": "https://my-shannon.exe.xyz:3000/", "who": "private", "what": "the practice target, Juice Shop, in your browser" }, { "url": "http://localhost:8233/ through an SSH tunnel", "who": "private", "what": "Temporal's web UI, for a scan's progress in detail" } ], "delivers": [ "Shannon 3.x installed, with its worker image pulled and Docker started on every boot", "Shannon using exe.dev's LLM integration, with no model key on the VM", "OWASP Juice Shop running on the VM as a practice target, restarted with the VM, with its source in `~/juice-shop`", "A scan config, `~/scans/juice-shop.yaml`, whose rules of engagement keep Shannon on that target", "A login check against Juice Shop that passes, and no scan started" ], "deployable": true, "deploy": { "new_vm_url": "https://exe.dev/new?prompt=Set%20up%20Shannon%20on%20this%20VM%20by%20following%20the%20exe.dev%20recipe%20at%20https%3A%2F%2Fexe.dev%2Fdeploy%2Fshannon.md%20from%20top%20to%20bottom.%0A%0AThe%20recipe%27s%20example%20VM%20name%20is%20my-shannon.%20This%20VM%27s%20name%20is%20the%20output%20of%20%60hostname%60%3A%20use%20it%20wherever%20the%20recipe%20writes%20my-shannon.%20Skip%20the%20step%20that%20creates%20the%20VM%3B%20you%20are%20on%20it.%0A%0AYou%20are%20done%20when%20all%20of%20these%20are%20true.%20Check%20each%20one%20yourself%3A%0A-%20Shannon%203.x%20installed%2C%20with%20its%20worker%20image%20pulled%20and%20Docker%20started%20on%20every%20boot%0A-%20Shannon%20using%20exe.dev%27s%20LLM%20integration%2C%20with%20no%20model%20key%20on%20the%20VM%0A-%20OWASP%20Juice%20Shop%20running%20on%20the%20VM%20as%20a%20practice%20target%2C%20restarted%20with%20the%20VM%2C%20with%20its%20source%20in%20%60~%2Fjuice-shop%60%0A-%20A%20scan%20config%2C%20%60~%2Fscans%2Fjuice-shop.yaml%60%2C%20whose%20rules%20of%20engagement%20keep%20Shannon%20on%20that%20target%0A-%20A%20login%20check%20against%20Juice%20Shop%20that%20passes%2C%20and%20no%20scan%20started%0A%0ARun%20only%20the%20commands%20in%20%22Install%20by%20hand%22%2C%20from%20%22Install%20Shannon%22%20on.%0ANever%20start%20a%20pentest%20yourself%3A%20the%20only%20%60shannon%20start%60%20you%20run%20is%20the%0Aone%20with%20%60--validate-auth%60%20in%20%22Check%20the%20setup%22.%20Never%20point%20Shannon%20at%0Aanything%20but%20%60http%3A%2F%2Fhost.docker.internal%3A3000%60.%20If%20the%20login%20check%0Afails%2C%20show%20the%20owner%20the%20last%20lines%20of%20its%20output%20and%20stop.%20Finish%20by%0Atelling%20the%20owner%20to%20read%20%22Before%20you%20scan%22%20and%20then%20follow%20%22Run%20your%0Afirst%20scan%22.%0A%0AFinish%20with%20the%20URLs%20I%20should%20open.%0A", "terminal": "curl -fsSL https://exe.dev/deploy/shannon/prompt.txt | ssh exe.dev new --prompt=/dev/stdin", "prompt": "Set up Shannon on this VM by following the exe.dev recipe at https://exe.dev/deploy/shannon.md from top to bottom.\n\nThe recipe's example VM name is my-shannon. This VM's name is the output of `hostname`: use it wherever the recipe writes my-shannon. Skip the step that creates the VM; you are on it.\n\nYou are done when all of these are true. Check each one yourself:\n- Shannon 3.x installed, with its worker image pulled and Docker started on every boot\n- Shannon using exe.dev's LLM integration, with no model key on the VM\n- OWASP Juice Shop running on the VM as a practice target, restarted with the VM, with its source in `~/juice-shop`\n- A scan config, `~/scans/juice-shop.yaml`, whose rules of engagement keep Shannon on that target\n- A login check against Juice Shop that passes, and no scan started\n\nRun only the commands in \"Install by hand\", from \"Install Shannon\" on.\nNever start a pentest yourself: the only `shannon start` you run is the\none with `--validate-auth` in \"Check the setup\". Never point Shannon at\nanything but `http://host.docker.internal:3000`. If the login check\nfails, show the owner the last lines of its output and stop. Finish by\ntelling the owner to read \"Before you scan\" and then follow \"Run your\nfirst scan\".\n\nFinish with the URLs I should open.\n", "prompt_url": "https://exe.dev/deploy/shannon/prompt.txt" }, "updated": "2026-11-02", "verified": "2026-11-02", "related": [ "docker-compose", "dev-test-prod", "python-sandboxes", "exe-mcp", "agent-secrets", "n8n-2" ], "alternatives": [ "XBOW", "Aikido" ] }