Argus

In Greek mythology, Argus Panoptes was the hundred-eyed giant — an all-seeing guardian who never slept.

One open-source scanner. Many eyes. SAST, SCA, secrets, IaC, Terraform, Ansible — CLI, MCP, and GitHub SARIF.

Argus orchestrates 20+ industry-standard tools (Semgrep, Trivy, Gitleaks, tfsec, Checkov, OWASP ZAP, and more) behind a single command and an MCP server for any MCP-compatible IDE or AI client. Runs locally. No Argus subscription. MIT licensed.

Install: pip install argus-scan · npm install -D argus-codescan · Docker · Launch kit

---

Why Argus?

Good for: solo devs, OSS maintainers, teams wanting DevSecOps without a proprietary scanner SaaS.

Not a replacement for: managed AppSec platforms with centralized policy, SOC, or compliance sign-off — Argus is a local orchestrator you own.

---

Two ways to use Argus

1 — Standalone CLI (no AI needed)

argus scan sast /my/project
argus scan terraform /my/infra
argus scan all /my/project --fail-on high
argus scan code /my/project --format sarif -o argus.sarif
argus scan ml /my/ml-app
argus scan malware /my/project
argus review .                      # local code review — git-changed files only
argus review . --staged             # only staged files
argus review . --base main          # vs main (+ local dirty files)
argus compare baseline.json current.json --fail-on-new
argus tools

Works for anyone. Just install Argus and the open-source scanner tools.

2 — MCP server (AI-assisted, optional)

argus mcp    # starts the MCP server

Connect Cursor, VS Code, Claude Desktop, JetBrains, Windsurf, or any MCP-compatible IDE and drive scans through natural language. The AI subscription is for the AI client — Argus itself is always free.

---

What Argus Scans

MCP Tools (for AI clients)

MCP clients can also read the finding schema, scan categories and example workflows through the documentation resources.

Scans are read-only. Fixes run only when you ask — via apply_fix, VS Code Quick Fix, or your AI editing code from fix_guidance.

---

Fix on request

Argus never modifies your code during a scan. After results come back:

# CLI and MCP scans — detect only
argus scan all /path/to/project

# MCP: user asks AI to fix a specific finding
# → apply_fix { target, file, tool, apply: true }

Details: API Reference — apply_fix

---

SARIF, policy & baseline diff

Ship security findings to GitHub Code Scanning, enforce repo policy, and fail CI only on new findings.

SARIF export (GitHub Security tab)

# Export SARIF for GitHub Code Scanning
argus scan code . --format sarif -o argus.sarif --fail-on high

# MCP: scan_sast / scan_all with format: "sarif"

Upload in GitHub Actions (see .github/workflows/argus-sarif.yml). Pull requests scan only the files changed in the diff, and fall back to a full scan when more than 50 files changed:

argus ci pr-paths --base "$BASE_SHA" --limit 50 -o scan-paths.txt
argus scan sast . --paths-file scan-paths.txt --format sarif -o sast.sarif
argus scan secrets . --paths-file scan-paths.txt --format sarif -o secrets.sarif

- run: pip install argus-scan && argus scan code . --format sarif -o argus.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: argus.sarif
    category: argus

.argus.yml policy file

Copy .argus.yml.example to .argus.yml in your repo root:

fail_on: high
exclude_paths:
  - "tests/fixtures/**"
semgrep:
  config: p/owasp-top-ten
suppressions:
  - rule_id: bandit.B101
    path: "tests/**"
    reason: "asserts in tests"
    expires: "2026-12-31"

Argus auto-discovers .argus.yml when scanning. Override with --policy path/to/.argus.yml.

Baseline diff (PR-only new findings)

# Save baseline from main
argus scan all . --format json -o baseline.json

# On PR — compare against baseline
argus scan all . --baseline baseline.json --format json -o current.json
argus compare baseline.json current.json --fail-on-new

# Or set in .argus.yml:
# baseline: .argus/baseline.json
# fail_on_new_only: true

Secret remediation guidance

Secret findings include step-by-step rotate/revoke guidance (AWS, GitHub tokens, private keys, Stripe, etc.):

argus scan secrets . --format json   # fix_guidance on each finding
# MCP apply_fix for secrets returns remediation steps (no auto-fix)

Database security rules

Built-in static rules for SQL injection, connection strings, migration GRANTs, ORM raw queries:

argus scan code .    # includes database.yaml rules via argus-languages

Full docs: docs/features-roadmap.md · API reference

---

Cloud dashboard upload (optional)

Send scan results to the Argus cloud dashboard when ARGUS_API_KEY is set. Local scans still work without any key.

export ARGUS_API_URL=http://localhost:4000/v1   # default
export ARGUS_API_KEY=arg_live_PASTE_YOUR_KEY

argus scan all /path/to/project                 # uploads automatically
argus scan sast . --upload --fail-on high       # force upload
argus scan secrets . --no-upload                # skip upload

MCP — add env to your IDE’s MCP config (e.g. Cursor ~/.cursor/mcp.json, VS Code MCP settings, Claude Desktop config):

{
  "mcpServers": {
    "argus": {
      "command": "argus",
      "args": ["mcp"],
      "env": {
        "ARGUS_API_URL": "http://localhost:4000/v1",
        "ARGUS_API_KEY": "arg_live_PASTE_YOUR_KEY"
      }
    }
  }
}

Print the same template: argus mcp --config

After each MCP scan or CLI scan, results upload to {ARGUS_API_URL}/scans with repo/branch/commit from git. Full setup: docs/AGENT-UPLOAD.md

---

Install

Pick the package that matches your project:

React / Node (npm) — no Python required

npm install -D argus-codescan

npx argus-codescan scan sca .       # dependencies (npm audit)
npx argus-codescan scan sast .      # source code (JS/TS)
npx argus-codescan scan secrets .   # API keys, tokens
npx argus-codescan scan all .       # everything

# CSV report written automatically (or set path with --output)
npx argus-codescan scan all . --output ./reports/security.csv

Add to package.json:

{
  "scripts": {
    "security:scan": "argus-codescan scan sca . --output ./reports/deps.csv",
    "security:code": "argus-codescan scan sast . --output ./reports/code.csv",
    "security:secrets": "argus-codescan scan secrets . --output ./reports/secrets.csv",
    "security:all": "argus-codescan scan all . --output ./reports/full.csv"
  }
}

Java, PHP, Flutter, IaC (pip — lightweight)

pip install argus-languages

# Any supported language / IaC in one command
argus-languages scan /path/to/project

# Examples
argus-languages scan ./my-java-app
argus-languages scan ./terraform
argus-languages scan ./flutter-app

Full Argus CLI + MCP (pip)

pip install argus-scan
# With all Python-native scanners:
pip install "argus-scan[all-tools]"

argus scan code /path/to/project    # built-in multi-language (uses argus-languages)
argus scan sast /path/to/project    # + Semgrep, Bandit, ESLint if installed
argus scan terraform /path/to/infra
argus scan ansible /path/to/playbooks
argus scan all /path/to/project --fail-on high
argus scan all /path/to/project --upload          # cloud dashboard (needs ARGUS_API_KEY)
argus scan all . --format sarif -o argus.sarif    # GitHub Code Scanning export
argus compare baseline.json current.json          # diff two scan JSON files
argus tools                         # show installed scanners
argus mcp                           # start MCP server for any MCP-compatible IDE
argus mcp --config                  # print MCP config with cloud env vars

Zero-install

uvx argus-scan       # full Python CLI via uv
npx argus-codescan   # Node/React via npm

Go (single binary)

go install github.com/argus-code-scanning/argus-codescan-mcp/packages/go/cmd/argus@latest

Shell script

curl -sSfL https://raw.githubusercontent.com/argus-code-scanning/argus-codescan-mcp/main/packages/shell/install.sh | sh

Docker (all scanners bundled)

docker pull ghcr.io/okirigabriel/argus-codescan-mcp:latest

# MCP server (add to ~/.cursor/mcp.json — see packages/docker/README.md)
docker run --rm -i -v "$(pwd):/workspace" ghcr.io/okirigabriel/argus-codescan-mcp

# One-shot CLI scan
docker run --rm -v "$(pwd):/workspace" ghcr.io/okirigabriel/argus-codescan-mcp \
  scan all /workspace

Full Docker guide: packages/docker/README.md

VS Code Extension

Install Argus Security Scanner from the VS Code Marketplace.

---

Quick Start

React / Next.js

npm install -D argus-codescan
npm run security:all   # after adding scripts — see Install section above

Flutter / Java / PHP / Terraform

pip install argus-languages
argus-languages scan /path/to/project

Full CLI (all scan types)

pip install "argus-scan[all-tools]"
argus tools
argus scan code /path/to/project
argus scan terraform /path/to/infra
argus scan all /path/to/project --format table
argus scan all /path/to/project --fail-on high

MCP (any MCP-compatible IDE)

Add to your MCP client config (e.g. Cursor ~/.cursor/mcp.json, VS Code MCP settings, Claude Desktop claude_desktop_config.json):

{
  "mcpServers": {
    "argus": {
      "command": "argus",
      "args": ["mcp"],
      "env": {
        "ARGUS_API_URL": "http://localhost:4000/v1",
        "ARGUS_API_KEY": "arg_live_PASTE_YOUR_KEY"
      }
    }
  }
}

Omit the env block if you only want local scans (no cloud upload). Or zero-install with uvx:

{
  "mcpServers": {
    "argus": { "command": "uvx", "args": ["argus-scan", "mcp"] }
  }
}

Then ask your AI:

Scan /path/to/myproject for security vulnerabilities
Are there any hardcoded secrets in this repo?
Fix the high-severity finding in src/api.js line 42
Run a full security audit and give me a prioritised fix list

---

Install Scanners

Run argus tools to see what’s installed. Quick install for common tools:

# macOS
brew install semgrep trivy gitleaks trufflehog tfsec tflint kics
pip install bandit safety pip-audit detect-secrets checkov ansible-lint
docker pull ghcr.io/zaproxy/zaproxy:stable   # OWASP ZAP

# Linux
pip install "argus-scan[all-tools]"
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh

Full guide: docs/tool-setup.md

---

Do I Need a Token or Subscription?

No Argus subscription for local scanning. Every scanner runs on your machine:

The AI subscription is for the AI client, not for Argus. Cloud upload uses your Argus API key (arg_live_…), not your Cursor/Claude token.

---

Repository Structure

argus-codescan-mcp/
├── packages/
│   ├── python/          pip install argus-scan
│   │   └── src/argus/
│   │       ├── cli.py             Standalone CLI
│   │       ├── server.py          MCP server
│   │       ├── cloud_upload.py    Optional dashboard upload
│   │       └── tools/             SAST, DAST, SCA, secrets, IaC, …
│   ├── languages/       pip install argus-languages  ← Java, PHP, Terraform, Ansible, all code
│   │   └── src/argus_languages/
│   │       └── bundled_rules/     YAML rules shared across Python (and future Go client)
│   ├── npm/             npx argus-codescan  (Node.js / JS-TS only)
│   ├── go/              go install .../argus@latest
│   ├── shell/           curl | sh installer
│   └── docker/          ghcr.io/okiriGabriel/argus-codescan-mcp
├── extensions/
│   └── vscode/          Argus Security Scanner VS Code extension
├── docs/
│   ├── getting-started.md
│   ├── architecture.md
│   ├── api-reference.md
│   ├── AGENT-UPLOAD.md
│   └── tool-setup.md
└── .github/
    ├── workflows/        CI for Python, npm, Go, VS Code, Docker
    └── ISSUE_TEMPLATE/

---

Documentation

---

Contributing

Everyone is welcome to contribute, whether it’s your first open-source PR or your hundredth. Start with the pinned 👋 Contributors welcome issue.

To claim an issue, comment “I’d like to work on this” with a short plan and a maintainer will assign it. Setup, code style and PR checklist: CONTRIBUTING.md.

License

MIT — see LICENSE