compare
Xalgorix vs Shannon
Shannon and Xalgorix share a principle: only report what you can actually exploit. They differ in where they start. Shannon is a white-box pentester that reads your source code to plan attacks; Xalgorix tests the running application from the outside, the way an external attacker would.
Published by Xalgorix. Verified on 19 October 2026 against the Shannon README, keygraph.io/pricing, and Xalgorix pricing. Spotted something out of date? Tell us.
At a glance
| Xalgorix | Shannon | |
|---|---|---|
| Testing approach | Black-box: point it at a URL you're authorized to test; no source code needed | White-box: Keygraph calls the open-source edition an agentic whitebox pentester, run against an app whose source code you have |
| Reporting rule | Reported only after a working exploit, then re-tested by an independent verifier | “No exploit, no report” |
| Production use | Built for staging and production: non-destructive proof payloads, rate limits and a kill switch | Its README says: “Do not run Shannon against production systems.” |
| Open-source license | Apache-2.0 | AGPL-3.0 |
| GitHub stars (19 Oct 2026) | ~1.2k | ~49k |
| Models when self-hosted | Your own provider key, or local models via Ollama | Your own key (Anthropic, OpenAI, xAI, Bedrock and others), or local models via Ollama, vLLM or LM Studio |
| Hosted option | Xalgorix Cloud: 10 credits for $10 that never expire; plans from $49/mo | Keygraph Pro: $50 per developer per month; Enterprise (self-hosted or air-gapped) priced on request |
| Free option | Free GitHub App security reviews on pull requests, no account needed | Community Program: Pro at $0 for US 501(c)(3) nonprofits and pre-Series-A startups with up to 20 active developers |
| CI/CD | REST API and signed webhooks; free GitHub App for pull requests | Official GitHub Action and GitLab CI/CD component |
| Report formats | PDF and HTML reports, plus shareable links | PDF, Markdown, JSON and SARIF 2.1.0 |
Choose Xalgorix when
- You don't have, or can't share, the source code: third-party apps you're authorized to test, client engagements, or bug bounty scopes that allow automated testing.
- You need to test the deployed system: production configuration, edge and WAF behaviour, and which subdomains are actually live.
- You want a permissive license (Apache-2.0) for modifying or embedding the engine.
- You'd rather pay per scan than per developer.
Choose Shannon when
- You own the code and want source-aware attack planning.
- You need SARIF output for your code-scanning tools.
- You run GitLab CI and want a native component.
- You qualify for Keygraph's Community Program.
Using both: Source-aware testing and outside-in testing catch different classes of mistakes. A common pattern is white-box testing in CI on every merge, plus scheduled black-box scans of the deployed environment.
Questions
- Is black-box testing less thorough than white-box?
- They answer different questions. White-box testing can reason about code paths an outside attacker never sees; black-box testing sees what is actually deployed, including configuration and infrastructure that no single repository describes.
- Can I run Xalgorix against production?
- Xalgorix is designed for it: proof payloads are non-destructive, scans are rate-limited, and every running scan has a kill switch. Start on staging if you can, and only scan systems you own or have written permission to test.
See the evidence on your own app
10 credits for $10, no subscription, and credits never expire. Or run the open-source engine yourself.