{"id":51778273,"url":"https://github.com/us/shannon-on-claude-code","last_synced_at":"2026-07-20T08:30:58.753Z","repository":{"id":357799272,"uuid":"1173376510","full_name":"us/shannon-on-claude-code","owner":"us","description":"Shannon's 5-phase pentest pipeline running natively in Claude Code —  no Docker, no Temporal, just /pentest https://github.com/KeygraphHQ/shannon","archived":false,"fork":false,"pushed_at":"2026-05-14T09:19:47.000Z","size":133,"stargazers_count":7,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-14T11:31:57.860Z","etag":null,"topics":["agpl-3","ai-agents","claude","claude-code","cybersecurity","mcp","multi-agent","penetration-testing","pentest","security"],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/us.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-05T09:50:36.000Z","updated_at":"2026-05-14T09:19:51.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/us/shannon-on-claude-code","commit_stats":null,"previous_names":["us/shannon-on-claude-code"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/us/shannon-on-claude-code","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/us%2Fshannon-on-claude-code","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/us%2Fshannon-on-claude-code/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/us%2Fshannon-on-claude-code/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/us%2Fshannon-on-claude-code/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/us","download_url":"https://codeload.github.com/us/shannon-on-claude-code/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/us%2Fshannon-on-claude-code/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35681006,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"ssl_error","status_checked_at":"2026-07-20T02:08:09.736Z","response_time":111,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agpl-3","ai-agents","claude","claude-code","cybersecurity","mcp","multi-agent","penetration-testing","pentest","security"],"created_at":"2026-07-20T08:30:58.146Z","updated_at":"2026-07-20T08:30:58.748Z","avatar_url":"https://github.com/us.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Shannon — Claude Code Native\n\u003c!-- Copyright (C) 2025 Keygraph, Inc. (original Shannon) --\u003e\n\u003c!-- This project is a derivative of Shannon (https://github.com/KeygraphHQ/shannon) --\u003e\n\u003c!-- Licensed under GNU Affero General Public License v3.0 --\u003e\n\nShannon's 5-phase penetration testing pipeline running natively in Claude Code.\nNo Temporal, no Docker, no worker processes. Just open `claude` and run `/pentest \u003curl\u003e`.\n\n## Quick Start\n\n```bash\ncd /Users/us/coding/shannon-on-claude-code   # or wherever you cloned this repo\nclaude\n/pentest https://target.com\n```\n\nWith source code (white-box):\n```bash\n# Clone or symlink the target repo here\ngit clone https://github.com/org/repo.git .\n# or\nln -s /path/to/repo/* .\n\nclaude\n/pentest https://target.com\n```\n\n---\n\n## Requirements\n\n### Required\n\n| Tool | Install | Purpose |\n|------|---------|---------|\n| `claude` (Claude Code) | [claude.ai/code](https://claude.ai/code) | Run the pipeline |\n| `node` ≥ 18 | `apt install nodejs` | MCP server |\n| `npm` | `apt install npm` | MCP dependencies |\n| `curl` | Usually pre-installed | HTTP testing |\n\n### MCP Dependencies (already installed)\n\n```bash\n# native/node_modules/ is already present, no need to reinstall\n# To update:\ncd native \u0026\u0026 npm install\n```\n\n### Optional (used if available)\n\n| Tool | Install | Purpose |\n|------|---------|---------|\n| `nmap` | `apt install nmap` | Port scanning |\n| `subfinder` | [github.com/projectdiscovery/subfinder](https://github.com/projectdiscovery/subfinder/releases) | Subdomain discovery |\n| `whatweb` | `apt install whatweb` | Technology fingerprinting |\n| `sqlmap` | `apt install sqlmap` | SQL injection automation |\n| `oathtool` | `apt install oathtool` | TOTP code generation (for MFA) |\n| Playwright | `npx playwright install chromium` | Browser automation (MCP installs automatically) |\n\n\u003e If optional tools are missing, the pipeline continues and skips those steps.\n\n---\n\n## Pipeline — 5 Phases\n\n```\nPhase 1: Pre-Recon   → code_analysis_deliverable.md\n           ↓\nPhase 2: Recon       → recon_deliverable.md\n           ↓\nPhase 3: Vuln (×5 parallel)\n  ├─ injection  → injection_analysis_deliverable.md + injection_exploitation_queue.json\n  ├─ xss        → xss_analysis_deliverable.md + xss_exploitation_queue.json\n  ├─ auth       → auth_analysis_deliverable.md + auth_exploitation_queue.json\n  ├─ authz      → authz_analysis_deliverable.md + authz_exploitation_queue.json\n  └─ ssrf       → ssrf_analysis_deliverable.md + ssrf_exploitation_queue.json\n           ↓\nPhase 4: Exploit (conditional, ×5 parallel)\n  └─ Only runs for non-empty queues with externally exploitable findings\n           ↓\nPhase 5: Report      → comprehensive_security_assessment_report.md\n```\n\n**Model assignments:**\n- Pre-recon: `claude-opus-4` (deep code analysis)\n- Vuln/Exploit: `claude-sonnet-4` (5 parallel agents)\n- Report: `claude-haiku-4` (executive summary writing)\n\n---\n\n## Modes\n\n### Black-Box (URL only)\nNo source code, just a URL. Uses:\n- nmap, subfinder, whatweb (external scanning)\n- Playwright browser (frontend exploration, JS analysis)\n- curl (API endpoint testing)\n\n### White-Box (URL + Source Code)\nProject files present in this directory. Additionally:\n- Source code analysis (taint analysis, code review)\n- Route/controller mapping\n- Auth/authz guard analysis\n\n---\n\n## Output Files\n\nAll files are saved under `deliverables/`:\n\n```\ndeliverables/\n├── code_analysis_deliverable.md          # Pre-recon findings\n├── recon_deliverable.md                  # Attack surface map\n├── *_analysis_deliverable.md × 5        # Vulnerability analysis reports\n├── *_exploitation_queue.json × 5        # Exploit target lists\n├── *_exploitation_evidence.md × 5       # Exploitation evidence\n└── comprehensive_security_assessment_report.md  # Final report\n```\n\nAudit log:\n```\naudit-logs/session.jsonl                  # Record of every tool call\n```\n\n---\n\n## MCP Tools\n\n### shannon-tools (`native/mcp-stdio-wrapper.mjs`)\n\n| Tool | Description |\n|------|-------------|\n| `save_deliverable` | Saves a deliverable file to `deliverables/` with validation |\n| `generate_totp` | Generates a TOTP code from a Base32 secret (for MFA-protected sites) |\n\nThe `SHANNON_TARGET_DIR` env var sets the target directory (default: `.`).\n\n### playwright\nHeadless Chromium browser for browser interactions, form filling, and JS execution.\n\n---\n\n## Configuration\n\n### Sites Requiring Login\n\nPass login details directly to the `/pentest` skill:\n\n```\n/pentest https://target.com\nLogin URL: https://target.com/login\nUsername: testuser@example.com\nPassword: testpass123\nLogin type: form\n```\n\nWith MFA/TOTP:\n```\nTOTP Secret: JBSWY3DPEHPK3PXP\n```\n\n### Scope Restrictions\n\n```\n/pentest https://target.com\nRules to Avoid: /admin, /billing, payment endpoints\nFocus: authentication, authorization\n```\n\n---\n\n## File Structure\n\n```\nshannon-on-claude-code/\n├── README.md\n├── .mcp.json                        # Playwright + Shannon MCP configuration\n├── .claude/\n│   ├── settings.json                # Tool permissions + audit hook\n│   ├── agents/                      # 13 agent definitions\n│   │   ├── pre-recon.md    (opus)\n│   │   ├── recon.md        (sonnet)\n│   │   ├── vuln-auth.md    (sonnet)\n│   │   ├── vuln-authz.md   (sonnet)\n│   │   ├── vuln-injection.md (sonnet)\n│   │   ├── vuln-xss.md     (sonnet)\n│   │   ├── vuln-ssrf.md    (sonnet)\n│   │   ├── exploit-auth.md (sonnet)\n│   │   ├── exploit-authz.md (sonnet)\n│   │   ├── exploit-injection.md (sonnet)\n│   │   ├── exploit-xss.md  (sonnet)\n│   │   ├── exploit-ssrf.md (sonnet)\n│   │   └── report.md       (haiku)\n│   ├── skills/\n│   │   └── pentest/SKILL.md         # /pentest orchestrator skill\n│   └── hooks/\n│       └── audit-logger.sh          # Tool call audit logging\n└── native/\n    ├── mcp-stdio-wrapper.mjs        # MCP server (save_deliverable, generate_totp)\n    ├── package.json\n    └── node_modules/\n```\n\n---\n\n## Differences from Shannon (Original)\n\n| Feature | Shannon (Temporal) | Claude Code Native |\n|---------|-------------------|-------------------|\n| Orchestration | Temporal workflow | Skill prompt |\n| Parallel agents | `Promise.allSettled` | Agent tool parallel calls |\n| Crash recovery | Temporal durable execution | None |\n| Resume/workspace | Git checkpoint + session | None |\n| Retry | Temporal retry policy (3x) | None |\n| Playwright | 5 isolated instances | Single shared instance |\n| Setup | Docker + npm build | npm install only |\n\n---\n\n## Troubleshooting\n\n**`claude` command not found:**\n```bash\nwhich claude || echo \"Claude Code is not installed\"\n```\n\n**MCP server won't start:**\n```bash\ncd native \u0026\u0026 node mcp-stdio-wrapper.mjs\n# If errors: npm install\n```\n\n**Playwright not working:**\n```bash\nnpx playwright install chromium\n```\n\n**Pipeline stopped mid-run:**\n```bash\n# Clean up and restart\nrm -rf deliverables workspace audit-logs\nclaude\n/pentest https://target.com\n```\n\n**nmap/subfinder not found:**\nThe pipeline still runs — those scans are simply skipped. All external tools are optional.\n\n---\n\n## License\n\nThis project is a derivative of [Shannon](https://github.com/KeygraphHQ/shannon) and is licensed under the **GNU Affero General Public License v3.0** — see [LICENSE](./LICENSE) for the full text.\n\n**Original copyright:** Copyright (C) 2025 Keygraph, Inc.\n\n**Modifications made in this derivative:**\n- Removed Temporal workflow orchestration layer\n- Removed Docker and worker process infrastructure\n- Adapted all 13 agent prompts to Claude Code native agent format (`.claude/agents/`)\n- Added `/pentest` skill orchestrator replacing `pentestPipelineWorkflow`\n- Replaced in-process MCP server with stdio-compatible wrapper (`native/mcp-stdio-wrapper.mjs`)\n- Added black-box mode detection for URL-only operation without source code\n\n## Acknowledgements\n\nAll penetration testing methodology, prompt engineering, vulnerability analysis frameworks, and agent definitions originate from [Shannon](https://github.com/KeygraphHQ/shannon) by Keygraph, Inc.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fus%2Fshannon-on-claude-code","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fus%2Fshannon-on-claude-code","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fus%2Fshannon-on-claude-code/lists"}