---
title: "Deploy Shannon [Oct '26]"
description: "AI pentester: real exploits, PDF & SARIF reports. BYOK. [Oct '26]"
category: "AI/ML"
url: https://railway.com/deploy/shannon-oct-26
---

# Deploy Shannon [Oct '26]

AI pentester: real exploits, PDF & SARIF reports. BYOK. [Oct '26]

**[Deploy Shannon [Oct '26] on Railway](https://railway.com/template/shannon-oct-26)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/shannon-oct-26/manifest.json

- **Creator:** wotonews
- **Category:** AI/ML

## Template content

### temporal

- **Image:** wotonews/shannon-temporal:v1.7.0-2

### shannon

- **Image:** wotonews/shannon:v3.5.0-2

## Documentation

# Deploy and Host Shannon with Railway

🟢 **Actively maintained** — last updated Oct '26.

This template deploys the [Shannon](https://github.com/KeygraphHQ/shannon) AI pentest engine — the open-source agent that reads your source code, maps attack surfaces, and executes **real exploits** to prove vulnerabilities before they reach production. It brings its own Temporal orchestration server; you bring your own AI provider key (BYOK).

> [!WARNING]
> Shannon actively executes exploits. Run it **only against applications you own or have explicit written authorization to test**. Never point it at production systems or third-party assets.

## About Hosting Shannon

The template creates two services:

- **temporal** — the workflow engine Shannon's agents run on (Temporal dev server with its sqlite database on a persistent volume, reachable only inside your project's private network).
- **shannon** — the pentest worker (official `keygraph/shannon` image: Node 22, Chromium/Playwright, git, Typst PDF compiler). It deploys **idle by default** with a stable, green deployment. When you configure a scan, it clones your target repository, runs exactly one scan process end-to-end, and writes reports to the persistent `/app/sessions` volume.

Shannon is provider-agnostic BYOK: Anthropic, OpenAI, xAI, AWS Bedrock, OpenAI-compatible gateways, or local models — your key, your provider, direct traffic (Keygraph never proxies model calls).

## Why Deploy Shannon on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically scale it.

By deploying Shannon on Railway, you get a private, always-ready pentest engine: no local Docker, scans run in your own Railway project, reports stay on your volumes, and the engine scales vertically with your codebase size.

## Common Use Cases

- **Pre-release pentests** against your staging deployment, straight from the repository that builds it.
- **Continuous security assessment** in CI fashion: rerun a scan whenever the target or code changes.
- **Authorized bug-bounty recon** on assets you own or are contracted to test.
- **Security research** with a full toolchain (Chromium, git, Typst) preinstalled and reproducible.

## Dependencies for Shannon Hosting

- An **AI provider API key** (BYOK) — Anthropic, OpenAI, xAI, Bedrock, or any compatible gateway.

### Deployment Dependencies

- Worker image `keygraph/shannon:3.5.0` (official, AGPL-3.0) + thin Railway scan-runner wrapper
- Temporal server image `temporalio/temporal:1.7.0` (dev-server mode, as upstream's docker-compose uses)
- Volumes: `temporal /home/temporal` (workflow state) and `shannon /app/data` (single volume — Railway mounts one per service; `/app/sessions` reports and `/app/workspaces` resumable scan state symlink into it)

## Running a Scan

1. Set the service variables on **shannon** (then it redeploys and runs one scan):
   - `SHANNON_AI_API_KEY` — your provider key (replace the placeholder first)
   - `SHANNON_TARGET_URL` — the live target, e.g. `https://staging.your-app.com`
   - `SHANNON_REPO_URL` — the target's source, e.g. `https://github.com/you/your-repo`
   - `SHANNON_REPO_TOKEN` *(optional)* — access token for private repositories
   - `SHANNON_CONFIG_URL` *(optional)* — Shannon configuration file (authenticated scans, rules of engagement)
   - `SHANNON_AI_MODEL` *(optional)* — override the default `anthropic:claude-sonnet-4-6`
2. Watch progress: `railway logs --service shannon`.
3. Collect reports (PDF, Markdown, JSON, SARIF) from the `/app/sessions` volume — `railway ssh --service shannon` to browse, or download via the dashboard volume view.

One-shot scans without redeploying: `railway ssh --service shannon` and run
`node apps/worker/dist/temporal/worker.js  /app/repos/target --task-queue shannon`.

## Operations

- **Costs**: you pay Railway for the running engine plus your provider for model usage. Idle mode does no model calls.
- **Resuming**: interrupted scans resume from `/app/workspaces` (`--workspace` flag).
- **Upgrades**: worker versions track upstream `keygraph/shannon` releases; the template pins an exact tag.


## Similar templates

- [Chat Chat](https://railway.com/deploy/-WWW5r) — Chat Chat, your own unified chat and search to AI platform.
- [Weaviate](https://railway.com/deploy/weaviate-1) — Vector database with hybrid search and an API key-protected API
- [Möbius v0.1 Personal AI OS](https://railway.com/deploy/mobius-v01-personal-ai-os) — Self-hosted AI agent that builds and runs apps for you, with memory.

Open this page in a browser: https://railway.com/deploy/shannon-oct-26