7 alternatives to shannon
keygraphhq/shannon — Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production. (49,333 stars, AGPL-3.0, auth, ai, infra).
These are the closest projects in the JustClaw-It index that we serve licence-cleared code from, ranked by relevance and by our code-quality score (1–10, the mean over each repo's graded components: completeness, code quality, deployability, reusability, strategic value). JustClaw-It does not serve code from keygraphhq/shannon itself (licence class: network-copyleft), so these alternatives are the licence-cleared route.
| # | Repo | Score | Licence | Stars |
|---|---|---|---|---|
| 1 | mukul975/anthropic-cybersecurity-skills | 6.0 | Apache-2.0 | 35,014 |
| 2 | usestrix/strix | 5.2 | Apache-2.0 | 71,780 |
| 3 | elementalsouls/claude-bughunter | 6.2 | MIT | 5,290 |
| 4 | shuvonsec/claude-bug-bounty | 6.8 | MIT | 5,414 |
| 5 | agricidaniel/claude-cybersecurity | 6.2 | MIT | 237 |
| 6 | juice-shop/juice-shop | 4.7 | MIT | 14,243 |
| 7 | vxcontrol/pentagi | 6.0 | MIT | 32,161 |
The alternatives in detail
-
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub
-
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.score 5.2/10 · Apache-2.0 permissive · 71,780 stars · 217 components · search them
-
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructurescore 6.2/10 · MIT permissive · 5,290 stars · 37 components · search them
-
AI-powered bug bounty hunting toolkit that works with or without subscription.score 6.8/10 · MIT permissive · 5,414 stars · 137 components · search them
-
AI-powered cybersecurity code review skill for Claude Code. 8 specialist agents, OWASP 2025, CWE Top 25, MITRE ATT&CK, 11 languages, zero configuration.score 6.2/10 · MIT permissive · 237 stars · 10 components · search them
-
OWASP Juice Shop: Probably the most modern and sophisticated insecure web applicationscore 4.7/10 · MIT permissive · 14,243 stars · 374 components · search them
-
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
Licence data: JustClaw-It's per-repo licence policy. Is shannon still maintained? Check it. Licence details: licence checker. Ranking data from 2026-10-27T23:04:12Z.
Want code like shannon without the licence risk? JustClaw-It is an MCP server with 1,449,000+ licence-cleared, quality-scored code components. Search is free; every result carries its licence and attribution.
Remote MCP endpoint: https://justclaw.it.com/mcp (API key auth). Works with Claude Code, Cursor,
Codex, Windsurf and other MCP clients. A one-line CLI installer (@justclaw-it/cli) is coming.