Argus — open-source security scanner (SAST, secrets, malware heuristics, SARIF, MCP). YAML rules welcome — good first issues.
概览
In Greek mythology, Argus Panoptes was the hundred-eyed giant — an all-seeing guardian who never slept. Argus orchestrates (Semgrep, Trivy, Gitleaks, tfsec, Checkov, OWASP ZAP, and more) behind a single command and an for any MCP-compatible IDE or AI client. Runs locally. MIT licensed. pip install argus-scan · npm install -D argus-codescan · Docker · Launch kit solo devs, OSS maintainers, teams wanting DevSecOps without a proprietary scanner SaaS. managed AppSec platforms with centralized policy, SOC, or compliance sign-off — Argus is a you own. Works for anyone. Just install Argus and the open-source scanner tools. Connect Cursor, VS Code, Claude Desktop, JetBrains, Windsurf, or any MCP-compatible IDE and drive scans through natural language. The AI subscription is for the AI client — Argus itself is always free. MCP clients can also read the finding schema, scan categories and example workflows through the documentation resources.
README
以下为原文 README 节选，完整内容请查看原文。
Argus
In Greek mythology, Argus Panoptes was the hundred-eyed giant — an all-seeing guardian who never slept.
One open-source scanner. Many eyes. SAST, SCA, secrets, IaC, Terraform, Ansible — CLI, MCP, and GitHub SARIF.
Argus orchestrates 20+ industry-standard tools (Semgrep, Trivy, Gitleaks, tfsec, Checkov, OWASP ZAP, and more) behind a single command and an MCP server for any MCP-compatible IDE or AI client. Runs locally. No Argus subscription. MIT licensed.
Install: pip install argus-scan · npm install -D argus-codescan · Docker · Launch kit
Why Argus?
| Run scanners yourself | Argus | |
|---|---|---|
| Setup | Install & configure each tool separately | One CLI / MCP config |
| Output | Different JSON/text per tool | Unified report + SARIF |
| CI | Wire scripts yourself | --format sarif, .argus.yml, baseline diff |
| AI (MCP IDE) | Manual copy-paste | MCP tools: scan_all, compare_scans, apply_fix |
| Cost | Free (DIY labor) | Free (MIT) — AI client optional |
| Fixes | You decide | Scan never auto-fixes; fix only when you ask |
Good for: solo devs, OSS maintainers, teams wanting DevSecOps without a proprietary scanner SaaS.
Not a replacement for: managed AppSec platforms with centralized policy, SOC, or compliance sign-off — Argus is a local orchestrator you own.
Two ways to use Argus
1 — Standalone CLI (no AI needed)
argus scan sast /my/project
argus scan terraform /my/infra
argus scan all /my/project --fail-on high
argus scan code /my/project --format sarif -o argus.sarif
argus scan ml /my/ml-app
argus scan malware /my/project
argus review . # local code review — git-changed files only
argus review . --staged # only staged files
argus review . --base main # vs main (+ local dirty files)
argus compare baseline.json current.json --fail-on-new
argus tools
Works for anyone. Just install Argus and the open-source scanner tools.
2 — MCP server (AI-assisted, optional)
argus mcp # starts the MCP server
安装
uvx argus-scan mcp配置
{
"mcpServers": {
"argus": {
"command": "argus",
"args": ["mcp"],
"env": {
"ARGUS_API_URL": "http://localhost:4000/v1",
"ARGUS_API_KEY": "arg_live_PASTE_YOUR_KEY"
}
}
}
}