Shor

What it is

Shor (by Keygraph, Inc.) is a source-available autonomous web pentesting platform. The catalog summary covers the agent pipeline, tool arsenal, and prove-it verification — but omits three things an engineer deciding whether to adopt it needs: the license terms, an opt-in cross-scan memory subsystem, and the specifics of its false-positive machinery.

Licensing (the adoption gate)

Shor is licensed under PolyForm Noncommercial License 1.0.0 — explicitly NOT an OSI open-source license. You may use, modify, fork, and share it for any noncommercial purpose if you keep the copyright/Required Notice lines and credit "Based on Shor by Keygraph, Inc." You may not sell it, bundle it into a paid product, or run it as a paid/hosted service without a separate commercial license. Contributions require signing a Contributor License Agreement. If you intended to offer scanning as a service or embed it in a commercial product, this is a hard stop absent a commercial deal.

Retrieval-memory layer (not in the summary)

Shor ships a two-tier memory system that is feature-flagged and off by default:

• A per-project tier remembers prior findings for a target so repeat scans build on earlier work.
• A shared, cross-tenant knowledge tier pre-seeded with distilled MITRE CAPEC and recent web-security write-ups.

Design constraints worth noting: memory feeds agents ideas to try, not verdicts to trust — the prove-it oracle stays the sole arbiter. Third-party research is treated as untrusted input to guard against retrieval poisoning, and promotion of a finding into the shared cross-tenant tier is gated behind consent plus mandatory secret/PII scrubbing. If you enable the shared tier, you are opting into cross-tenant data flow with those guards as your only protection.

False-positive machinery, in detail

Beyond the PoC replay the summary mentions, the end-stage refinement gate scores findings on independent evidence axes (code path confirmed, premise valid, in scope, location verified) that can only lower an over-confident label. Duplicates collapse to one canonical record; out-of-scope or "god-mode" artifacts are demoted, not deleted — everything demoted lands in a review appendix, so nothing is silently dropped.

Outputs and containment specifics

Outputs include SARIF export and fingerprinted findings tracked as new/recurring/resolved across a project's scan history, plus opaque read-only share links and (white-box) per-finding "fix prompts" citing exact file and line. Containment adds detail the summary skips: per-tenant egress firewalling, default-deny scope, per-scan isolated environments with scoped identity/secrets, and cancelling a scan as the kill switch.

Lineage

Shor's discovery+verification pipeline is ported from Anthropic's defending-code reference harness, with agent orchestration following Anthropic's Building Effective Agents (orchestrator-workers, evaluator-optimizer). It cites XBOW, PentestGPT, Shannon, Strix, and HexStrike AI as prior art — useful if you're comparing agentic pentest tools.