· 6 min read
If you evaluated Shannon for autonomous AI penetration testing and thought "this is good, but I cannot send my source code, traffic or credentials to a cloud model", this is for you. An honest comparison, credit included.
Credit where it is due
Shannon is a genuinely capable open source project (AGPL), focused on white-box source-aware web and API testing. It reads your source code and calls a cloud model, and reports a white-box benchmark on its own validation set. If a cloud model is acceptable in your context, it does the job well. Teams look for an alternative for three reasons: data must stay in-house, they need to cover more than web apps, and they want to read and modify the methodology.
Darkmoon, in one line
Darkmoon is a GPL-3.0 autonomous AI pentester that chains recon, exploitation and reporting over an MCP server, proves every finding with a working exploit, and covers web, API, Active Directory and Kubernetes. Unlike Shannon, it can run entirely on a local LLM (Ollama or llama.cpp), and its local Privacy Gateway tokenizes sensitive values so your data never reaches a third party. Full disclosure: this is our project.
The differences that actually decide it
- Where the model runs. Shannon calls a cloud LLM. Darkmoon can run 100% locally, so it is safe to point at production or a client environment.
- Scope. White-box source-aware web and api testing vs Darkmoon's web + API + Active Directory + Kubernetes.
- Proof over claims. Darkmoon reports a black-box result on a public lab: 57 real vulnerabilities on OWASP Juice Shop in 28 minutes, on a local LLM. Reproduce it yourself: the open AI-pentester benchmark.
- License and auditability. GPL-3.0, self hosted via docker-compose, read and modify the source.
Try it
github.com/ASCIT31/Dark-Moon, clone, run ./install.sh, point it at a target you are authorized to test. If it saves you a manual pentest, a star helps other defenders find it.