Shannon 2.0 is officially here

[keygraphVarun]

Shannon 2.0 is officially here

Today we are officially launching Shannon 2.0.

We quietly released the first 2.0 build on GitHub two weeks ago, and have spent the time since testing it with early users, fixing issues, and incorporating feedback. Those fixes shipped as 2.1.0, which is what you get today.

Over the last six months, Shannon has grown to more than 46K GitHub stars and been put through hundreds of thousands of pentest runs. What came back from the community taught us that building an agent capable of finding and exploiting vulnerabilities is only part of the challenge. The harder part is making that agent stable, consistent, and reliable from the beginning of a pentest through the final report.

So we rebuilt almost the entire project from the ground up. This changes how Shannon's agents run, not what Shannon does.

Important

Existing Shannon users should rerun the setup wizard before their first Shannon 2.0 scan.

Shannon 2.0 introduces a new model configuration format, and the previous small, medium, and large model variables are no longer used. There are also two removals to be aware of. See Migrating from Shannon 1.x.

A new open-source foundation

The original version of Shannon was built on the Claude Agent SDK. Shannon 2.0 replaces that execution foundation with the Pi harness, a fully open-source agent runtime and execution architecture.

This gives Shannon a stronger foundation for running complete pentests consistently, and removes its dependency on a closed-source agent SDK. Shannon 2.0 is more stable and consistent across a full pentest as a result.

For most users the workflow is unchanged:

• The pentesting pipeline and its phases are the same: source-aware reconnaissance, application and API analysis, vulnerability analysis, live exploitation, evidence collection, and reporting.
• Shannon still performs real exploitation, and still reports only findings with a working proof of concept.
• Reports and workspaces stay in the same format.
• The existing setup and start commands work as before.
  The only things to check are the breaking changes below. They won't affect most setups.

Native support for multiple AI providers

The number one request from the community was native support for models outside Anthropic. Shannon 2.0 delivers it, while continuing to support Anthropic models natively.

Built-in providers

Configured directly by provider ID:

• Anthropic
• OpenAI
• xAI
• AWS Bedrock

Custom endpoints

Beyond the built-in providers, Shannon works with any endpoint that implements one of two API formats: Anthropic's Messages API or OpenAI's Chat Completions API. Point Shannon at that endpoint with a custom base URL.

In practice that covers most of what people ask for:

• Local and self-hosted models served through Ollama, vLLM, or LM Studio, all of which expose an OpenAI-compatible endpoint
• Model routers such as OpenRouter, which is OpenAI-compatible
• LLM gateways and proxies such as LiteLLM, which can expose either format
• Providers Shannon has no built-in support for, as long as they offer a compatible endpoint
  The rule is the format, not the vendor. If it speaks the Messages API or the Chat Completions API, Shannon can run on it.

Configuring the model

One selected model runs the entire scan, including pre-reconnaissance, reconnaissance, vulnerability analysis, exploitation, and reporting. The model is configured using a single provider and model identifier:

export SHANNON_AI_MODEL=<provider>:<model-id>

Built to run in a pipeline

• Fully headless execution for CI/CD
• Environment variable and configuration file support
• Predictable exit codes with clear success or failure states
• JSON and SARIF output

Reporting improvements

• Evidence-backed findings
• More consistent severity classifications and validation requirements

Install

npx @keygraph/shannon@latest setup
 
npx @keygraph/shannon@latest start \
  -u https://your-app.com \
  -r /path/to/your/repo

Current release: 2.1.0. See all releases if you pin versions in CI.

Migrating from Shannon 1.x

1. Rerun the setup wizard

The wizard configures your provider and model in the new format:

npx @keygraph/shannon@latest setup

2. Replace the three-tier model variables

Shannon 1.x split work across small, medium, and large model tiers. Shannon 2.0 uses one model for the entire pentest, so these variables are no longer read:

ANTHROPIC_SMALL_MODEL
ANTHROPIC_MEDIUM_MODEL
ANTHROPIC_LARGE_MODEL

Remove them from your .env, shell profile, or CI configuration and set a single SHANNON_AI_MODEL value instead. Full details: Migrating from the three-tier configuration.

3. Google Vertex AI support has been removed

The Pi harness does not support Anthropic models through Vertex AI. If you were routing through Vertex, move to Anthropic, AWS Bedrock, or an Anthropic-compatible custom endpoint, then run the setup wizard to configure it.

These variables are no longer supported:

CLAUDE_CODE_USE_VERTEX
ANTHROPIC_VERTEX_PROJECT
CLOUD_ML_REGION
GOOGLE_APPLICATION_CREDENTIALS

4. The manual maximum-output setting has been removed

CLAUDE_CODE_MAX_OUTPUT_TOKENS

Pi manages model output limits directly, so this variable can be removed from your environment.

Thanks

A lot of this release came directly from what people in this community asked for. Thank you to everyone who tested Shannon, shared feedback/bug reports, or simply pushed the project further than we ever expected.

If you try Shannon 2.0, we'd love to hear how it goes, particularly anything you notice around agent behavior, runtime, cost, authentication, or tool execution. Bug reports are welcome in GitHub Issues, and everything else in the comments below.