> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runanywhere.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Use Shannon with Wally

> Run the open-source Shannon security tool against your own authorised targets with a Wally Cloud key

[Shannon](https://github.com/KeygraphHQ/shannon) is an open-source tool from KeygraphHQ for
defensive security testing. This guide points it at Wally's security programme model.

> [!WARNING]
>
> Use Shannon only against systems you own or have written permission to test. The [acceptable use
> policy](https://runanywhere.ai/legal/acceptable-use) applies to every request, and access to the
> programme model can be narrowed, suspended or revoked.

## 1. Request access

The programme model needs approval. Open the Model access page in the
[console](https://console.runanywhere.ai) and send a request. A person at RunAnywhere reviews it.
Once you are approved, the console shows the model id to use below.

## 2. Sign in or create a Cloud key

To run Shannon through the Wally CLI, sign in once with `wally account login`. To run Shannon by
hand, or to use the CLI without a saved sign-in, create a Cloud key on the console's Cloud keys
page. The plaintext shows once, so store it in a protected env file that only you can read, and
keep it out of source control.

## 3. Run Shannon

Shannon `v3.4.0` needs Docker running and Node 18 or later. Replace the placeholders with your
programme model id from the console, the URL of the app you are authorised to test, and the path
to its source.

### With the Wally CLI

The Wally CLI writes the provider configuration and starts a scan. Pass the programme model with
`-m`; without it, the CLI uses your account's default model:

```bash theme={"theme":"css-variables"}
wally shannon -m <model id from the console> -- -u <your app url> -r <path to its source>
```

To use a Cloud key instead of your sign-in, export it first:

```bash theme={"theme":"css-variables"}
set -a; . ./wally.env; set +a   # wally.env contains WALLY_CLOUD_KEY=<your Cloud key>
wally shannon -m <model id from the console> -- -u <your app url> -r <path to its source>
```

### By hand

Create a Pi `models.json` with a `runanywhere` provider:

```json theme={"theme":"css-variables"}
{
  "providers": {
    "runanywhere": {
      "api": "openai-completions",
      "baseUrl": "https://inference.runanywhere.ai/v1",
      "authHeader": true,
      "models": [{ "id": "<model id from the console>" }]
    }
  }
}
```

Put the model and key in a protected env file, for example `shannon.env`:

```bash theme={"theme":"css-variables"}
SHANNON_AI_MODEL=runanywhere:<model id from the console>
SHANNON_AI_API_KEY=<your Cloud key>
SHANNON_AI_BASE_URL=https://inference.runanywhere.ai/v1
```

Load it into your shell and start the scan:

```bash theme={"theme":"css-variables"}
set -a; . ./shannon.env; set +a
npx --yes @keygraph/shannon@3.4.0 start -u <your app url> -r <path to its source> --models-config ./models.json
```

> [!WARNING]
>
> Do not use the `openai:` prefix. It uses the Responses API, which Wally does not serve. Use the
> `runanywhere:` prefix shown above, which uses chat completions.

## Data and billing

Programme requests run with zero data retention for prompt and completion bodies, like every Wally request. Usage is
billed against prepaid credits as described in the [terms](https://runanywhere.ai/legal/terms).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.