How us/shannon-on-claude-code works
Shannon is an AI-agent penetration-testing pipeline for a target URL, optionally paired with source code. In Claude Code, the /pentest skill coordinates reconnaissance, optional white-box SAST and login validation, six parallel vulnerability analyses, reconciliation, conditional exploitation, and reporting. Agents save validated deliverables through the MCP helper; scans can resume using URL-bound metadata. The README also documents OpenCode support and optional scanning/browser tools. Workflow links follow the README’s phase descriptions; unsampled agent implementations limit claims about their internal calls.
Main entry points: SKILL.md Pentest skill · pre-recon.md Pre-recon · recon.md Recon · validate-auth.md Auth validation
Components 29
Entry and control
- Claude Code
- OpenCode
- Pentest skill
.claude/skills/pentest/SKILL.md - OpenCode command
.opencode/commands/pentest.md
Assessment phases
- Pre-recon
.claude/agents/pre-recon.md - SAST-lite
.claude/agents/sast.md - Recon
.claude/agents/recon.md - Auth validation
.claude/agents/validate-auth.md
Findings and validation
- Injection analysis
.claude/agents/vuln-injection.md - XSS analysis
.claude/agents/vuln-xss.md - Auth analysis
.claude/agents/vuln-auth.md - Authz analysis
.claude/agents/vuln-authz.md - SSRF analysis
.claude/agents/vuln-ssrf.md - Misc analysis
.claude/agents/vuln-misc.md - Queue reconcile
.claude/agents/reconcile.md - Injection exploit
.claude/agents/exploit-injection.md - XSS exploit
.claude/agents/exploit-xss.md - Auth exploit
.claude/agents/exploit-auth.md - Authz exploit
.claude/agents/exploit-authz.md - SSRF exploit
.claude/agents/exploit-ssrf.md - Misc exploit
.claude/agents/exploit-misc.md
Evidence and reporting
- Report writer
.claude/agents/report.md - Deliverable MCP
native/mcp-stdio-wrapper.mjs - Scan deliverables
- Audit logger
.claude/hooks/audit-logger.sh
Tools and integrations
- Target application
- Optional scanners
- Playwright browser
Other components
- Pentester
Connections 48
- Pentester → Claude Code: starts scan
- Pentester → OpenCode: starts scan
- Claude Code → Pentest skill: loads skill
- OpenCode → OpenCode command: runs command
- OpenCode command → Pentest skill: loads skill
- Pentest skill → Pre-recon: dispatches
- Pentest skill → SAST-lite: dispatches
- Pentest skill → Recon: dispatches
- Pentest skill → Auth validation: conditionally dispatches
- Pentest skill → Injection analysis: dispatches
- Pentest skill → XSS analysis: dispatches
- Pentest skill → Auth analysis: dispatches
- Pentest skill → Authz analysis: dispatches
- Pentest skill → SSRF analysis: dispatches
- Pentest skill → Misc analysis: dispatches
- Pentest skill → Queue reconcile: dispatches
- Pentest skill → Injection exploit: conditionally dispatches
- Pentest skill → XSS exploit: conditionally dispatches
- Pentest skill → Auth exploit: conditionally dispatches
- Pentest skill → Authz exploit: conditionally dispatches
- Pentest skill → SSRF exploit: conditionally dispatches
- Pentest skill → Misc exploit: conditionally dispatches
- Pentest skill → Report writer: dispatches
- Pre-recon → Target application: assesses
- Recon → Target application: maps surface
- Auth validation → Target application: checks credentials
- Injection analysis → Target application: tests
- XSS analysis → Target application: tests
- Auth analysis → Target application: tests
- Authz analysis → Target application: tests
- SSRF analysis → Target application: tests
- Misc analysis → Target application: tests
- SAST-lite → Scan deliverables: saves findings
- Pre-recon → Scan deliverables: saves findings
- Recon → Scan deliverables: saves findings
- Auth validation → Scan deliverables: saves results
- Injection analysis → Scan deliverables: saves analysis and queue
- XSS analysis → Scan deliverables: saves analysis and queue
- Auth analysis → Scan deliverables: saves analysis and queue
- Authz analysis → Scan deliverables: saves analysis and queue
- SSRF analysis → Scan deliverables: saves analysis and queue
- Misc analysis → Scan deliverables: saves analysis and queue
- Queue reconcile → Scan deliverables: saves merged queue
- Injection exploit → Scan deliverables: saves evidence
- XSS exploit → Scan deliverables: saves evidence
- Auth exploit → Scan deliverables: saves evidence
- Authz exploit → Scan deliverables: saves evidence
- SSRF exploit → Scan deliverables: saves evidence