Skip to main content
Shannon is an open-source tool from KeygraphHQ for defensive security testing. This guide points it at Wally’s security programme model.
Use Shannon only against systems you own or have written permission to test. The acceptable use policy applies to every request, and access to the programme model can be narrowed, suspended or revoked.

​
1. Request access

The programme model needs approval. Open the Model access page in the console and send a request. A person at RunAnywhere reviews it. Once you are approved, the console shows the model id to use below.

​
2. Sign in or create a Cloud key

To run Shannon through the Wally CLI, sign in once with wally account login. To run Shannon by hand, or to use the CLI without a saved sign-in, create a Cloud key on the console’s Cloud keys page. The plaintext shows once, so store it in a protected env file that only you can read, and keep it out of source control.

​
3. Run Shannon

Shannon v3.4.0 needs Docker running and Node 18 or later. Replace the placeholders with your programme model id from the console, the URL of the app you are authorised to test, and the path to its source.

​
With the Wally CLI

The Wally CLI writes the provider configuration and starts a scan. Pass the programme model with -m; without it, the CLI uses your account’s default model:
To use a Cloud key instead of your sign-in, export it first:

​
By hand

Create a Pi models.json with a runanywhere provider:
Put the model and key in a protected env file, for example shannon.env:
Load it into your shell and start the scan:
Do not use the openai: prefix. It uses the Responses API, which Wally does not serve. Use the runanywhere: prefix shown above, which uses chat completions.

​
Data and billing

Programme requests run with zero data retention for prompt and completion bodies, like every Wally request. Usage is billed against prepaid credits as described in the terms.