argus-code-scanning/argus-codescan-mcp

このページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。原文を見る

10 stars 15 forks 品質 87 トレンド 38MIT

Argus — open-source security scanner (SAST, secrets, malware heuristics, SARIF, MCP). YAML rules welcome — good first issues.

概要

In Greek mythology, Argus Panoptes was the hundred-eyed giant — an all-seeing guardian who never slept. Argus orchestrates (Semgrep, Trivy, Gitleaks, tfsec, Checkov, OWASP ZAP, and more) behind a single command and an for any MCP-compatible IDE or AI client. Runs locally. MIT licensed. pip install argus-scan · npm install -D argus-codescan · Docker · Launch kit solo devs, OSS maintainers, teams wanting DevSecOps without a proprietary scanner SaaS. managed AppSec platforms with centralized policy, SOC, or compliance sign-off — Argus is a you own. Works for anyone. Just install Argus and the open-source scanner tools. Connect Cursor, VS Code, Claude Desktop, JetBrains, Windsurf, or any MCP-compatible IDE and drive scans through natural language. The AI subscription is for the AI client — Argus itself is always free. MCP clients can also read the finding schema, scan categories and example workflows through the documentation resources.

README

以下は原文 README の抜粋です。原文を見る。

Argus

In Greek mythology, Argus Panoptes was the hundred-eyed giant — an all-seeing guardian who never slept.

One open-source scanner. Many eyes. SAST, SCA, secrets, IaC, Terraform, Ansible — CLI, MCP, and GitHub SARIF.

Argus orchestrates 20+ industry-standard tools (Semgrep, Trivy, Gitleaks, tfsec, Checkov, OWASP ZAP, and more) behind a single command and an MCP server for any MCP-compatible IDE or AI client. Runs locally. No Argus subscription. MIT licensed.

Install: pip install argus-scan · npm install -D argus-codescan · Docker · Launch kit

Why Argus?

	Run scanners yourself	Argus
Setup	Install & configure each tool separately	One CLI / MCP config
Output	Different JSON/text per tool	Unified report + SARIF
CI	Wire scripts yourself	`--format sarif`, `.argus.yml`, baseline diff
AI (MCP IDE)	Manual copy-paste	MCP tools: `scan_all`, `compare_scans`, `apply_fix`
Cost	Free (DIY labor)	Free (MIT) — AI client optional
Fixes	You decide	Scan never auto-fixes; fix only when you ask

Good for: solo devs, OSS maintainers, teams wanting DevSecOps without a proprietary scanner SaaS.

Not a replacement for: managed AppSec platforms with centralized policy, SOC, or compliance sign-off — Argus is a local orchestrator you own.

Two ways to use Argus

1 — Standalone CLI (no AI needed)

argus scan sast /my/project
argus scan terraform /my/infra
argus scan all /my/project --fail-on high
argus scan code /my/project --format sarif -o argus.sarif
argus scan ml /my/ml-app
argus scan malware /my/project
argus review .                      # local code review — git-changed files only
argus review . --staged             # only staged files
argus review . --base main          # vs main (+ local dirty files)
argus compare baseline.json current.json --fail-on-new
argus tools

Works for anyone. Just install Argus and the open-source scanner tools.

2 — MCP server (AI-assisted, optional)

argus mcp    # starts the MCP server

GitHub で README 全文を見る

インストール

uvx argus-scan mcp

MCP 初心者？mcpskill.org のガイドから始めましょう →

設定

{
  "mcpServers": {
    "argus": {
      "command": "argus",
      "args": ["mcp"],
      "env": {
        "ARGUS_API_URL": "http://localhost:4000/v1",
        "ARGUS_API_KEY": "arg_live_PASTE_YOUR_KEY"
      }
    }
  }
}