KeygraphHQ/shannon ? reverse-engineered prompt

Build me an autonomous AI pentesting tool for web applications. The core problem is that manual pentests happen maybe once a year, but our team ships code daily, creating a huge security gap. This tool should close that gap.

It needs to be a command-line utility, probably built with TypeScript, that performs white-box security testing. It should start by analyzing our app's source code to identify potential attack vectors. Then, it should use browser automation and other tools to execute real exploits against the running application to confirm vulnerabilities like injection attacks, XSS, SSRF, and authentication bypasses.

A critical feature is that the final report must contain only proven, exploitable findings with a copy-and-paste proof-of-concept—no theoretical vulnerabilities. The tool should be smart enough to handle logging into a web app, including 2FA, to test authenticated routes. You can integrate other common security tools like Nmap for reconnaissance as needed.