Open-source agent
SwarmAttacker vs Shannon
An AGPL-3.0 autonomous pentester from Keygraph that reads your application source, maps attack paths and reports only vulnerabilities it can prove with a working exploit.
- Vendor
- Keygraph
- Licence
- AGPL-3.0 open source, proprietary Keygraph platform
- Pricing
- Free CLI (bring your own key); Keygraph Pro from $50 per developer per month.
- Checked
- September 2, 2026
| Capability |  SwarmAttacker8 of 8 | Shannon4 of 8 |
|---|---|---|
| Free | Yes. | |
| Runs on a ChatGPT subscription | Yes. | |
| Custom prompts & skills | Partial. | |
| Safety-refusal handling | Not found. | |
| Parallel multi-agent swarm | Yes. | |
| MIT-licensed open source | Not found. | |
| Black-box from a URL | Not found. | |
| Model-agnostic | Yes. |
- yes
- not found or only partly
Hover a mark for the evidence. A cross means the capability was not found, or only partly found, on Shannon's public pages or repository on September 2, 2026, not that it is technically impossible.
Profile
What is Shannon?
Shannon is an open-source, AGPL-3.0 autonomous pentester from Keygraph, a San Francisco startup backed by Pear VC and Authentic Ventures. It is white-box by design: the command-line tool mounts the target's source code read-only and requires a repository path, then runs a five-phase pipeline (pre-recon, recon, five parallel vulnerability-analysis agents, five parallel exploitation agents, reporting) inside an ephemeral Docker container, reporting only findings backed by a working exploit. Version 3.0, released on 2 September 2026, added agentic static analysis and a GitHub Action, and the repository has around 47,000 stars.
It is bring-your-own-key across Anthropic, which is the default, OpenAI, xAI and any compatible endpoint including local models, and since August 2026 it can reuse a ChatGPT Plus or Pro subscription through the Pi harness login. Customisation is limited to a YAML config templated into fixed built-in prompts, and the project does not accept external contributions.
Model safety refusals are not detected or recovered: the error classifier discards provider text, and the docs tell testers to clear Anthropic's and OpenAI's cyber-safeguard programmes before their first run. The commercial Keygraph platform starts at $50 per developer per month; black-box testing is a paid cloud add-on.
In SwarmAttacker's favour
Where it stands out.
- 01Black-box from a URL. SwarmAttacker needs no source code; Shannon's open-source tool requires the target repository, and black-box testing is a paid Keygraph add-on.
- 02MIT versus AGPL: SwarmAttacker imposes no copyleft, where Shannon's AGPL licence reaches networked use and the richer product is proprietary.
- 03Refusals are handled rather than pushed onto the operator. Shannon discards provider refusal text and tells you to get vendor cyber-clearance first.
- 04User-injectable attack skills, where Shannon exposes only config text and does not accept outside contributions.
In Shannon's favour
Where it is stronger.
- 01Source-aware testing finds logic and code-path bugs a black-box crawl can miss, and reports only exploit-backed findings.
- 02A far larger project: around 47,000 stars, near-weekly releases and venture funding.
- 03Polished output and workflow: SARIF, PDF reports, a GitHub Action and a resumable Temporal pipeline.
- 04Also runs on a ChatGPT subscription, and on more providers including xAI and Bedrock, with published multi-model cost benchmarks.
Verdict
Which one should you pick?
Pick Shannon if you can give a tool your source code and want exploit-proven findings wired into CI, and AGPL plus a paid platform suits you. Pick SwarmAttacker if you need a black-box agent that works from a URL alone, under a permissive MIT licence, with refusals handled for you.
Sources
What this page was checked against.
All checked on September 2, 2026.
Turn a URL into a security report.
Open source, MIT licensed, and it runs on the ChatGPT plan you already pay for. Install it and point it at a target you own.
brew install joloooo/swarm/swarm