Open source · MIT

20+ security scanners.
One command.

Semgrep, Trivy, OWASP ZAP, Bandit, Gitleaks, tfsec, and more, unified behind a single CLI and MCP server. SAST, DAST, SCA, secrets, IaC, Terraform, Ansible, database, and ML/LLM. SARIF export and GitHub Code Scanning built in. No AI subscription required.

View on GitHub
argus scan all /my/projectscanning
$ argus scan all /my/project --fail-on high
✓ SAST semgrep, bandit 0 findings
⚠ SCA trivy, pip-audit 3 medium
✗ Secrets gitleaks 1 leaked key (AWS rotation guide attached)
✓ ML scan_ml 0 unsafe model loads
✓ IaC checkov, tfsec 0 findings
✓ Ansible ansible-lint, kics 0 findings
22 tools · 4 findings · SARIF ready · 9.1s
$

Security pipelines that fit every workflow

arguslive scan

Security overview

22 tools · last run 9.1s ago · SARIF ready

main branch
4findings
1critical
0new vs baseline
SeverityRuleLocationTool
highsql-injectionapi/users.py:42semgrep
mediumoutdated-depspackage-lock.jsontrivy
criticalaws-key-leak.env.example:3gitleaks
lowmissing-cspnext.config.tseslint

Argus unifies local CLI scans, CI pipelines, and MCP-driven audits in one open-source platform. Export SARIF, gate merges on severity, and diff against baselines without a vendor lock-in.

Features

  • SARIF export + GitHub Code Scanning
  • Baseline diff with argus compare
  • Policy as code (.argus.yml)
  • MCP for any IDE or agent
  • Severity gates in CI
  • Wiz + enterprise ingest

Two ways to use Argus

01 · STANDALONE

CLI, no AI needed

Works for anyone. Install Argus and the open-source scanner tools, then run scans directly from your terminal.

$ argus scan sast /my/project
$ argus scan terraform /my/infra
$ argus scan all /my/project --fail-on high

02 · MCP SERVER

AI-assisted, optional

Connect any MCP-compatible client and drive scans through natural language with Cursor, Claude Desktop, VS Code, or your own agent.

$ argus mcp
# starts the MCP server

What Argus scans

Ten categories, twenty-plus battle-tested tools underneath.

SAST
Semgrep · Bandit · ESLint-security · flake8-bandit
DAST
OWASP ZAP · Nikto
SCA
Trivy · Safety · pip-audit · npm audit
Secrets
Gitleaks · detect-secrets · TruffleHog · provider-specific remediation
IaC
Checkov · Trivy config · Terrascan · KICS · smarter Ansible detection
Terraform
tfsec · tflint · terraform validate · KICS · Checkov
Ansible
ansible-lint · KICS · Checkov · auto-detected in IaC scans
Container
Trivy image scan · pinned KICS in Docker builds
Database
17 static rules: SQL injection, weak auth, exposed credentials
ML / LLM
18 rules: torch.load, trust_remote_code, prompt injection, LLM API keys

What's new

Latest capabilities in the open-source scanner, CI-ready out of the box.

CI

SARIF export + GitHub Code Scanning

Export findings as SARIF and upload to GitHub Security via a ready-made workflow. Findings show in the Security tab and PR checks.

Policy

.argus.yml policy file

Version-controlled scan policy: fail_on thresholds, path excludes, suppressions, and baseline files, shared across CLI, CI, and MCP.

Baseline

Baseline diff with argus compare

Save a baseline snapshot and diff new scans with argus compare or the MCP compare_scans tool. Only net-new findings fail CI.

Secrets

Secret remediation guidance

Actionable rotation steps for AWS, GitHub, Stripe, generic API keys, and other leaked credential types.

ML

AI/ML security scanning

argus scan ml and MCP scan_ml cover unsafe model loading, trust_remote_code, LLM API keys, and prompt-injection patterns. Included in scan all.

Integrations

Wiz integration guide

CI ingest template and docs for sending Argus findings into Wiz, alongside database rules and smarter Ansible detection in IaC scans.

Install

Pick the package that matches your project.

React / Next.js / Node
No Python required
npm install -D argus-codescan
npx argus-codescan scan all .
Java, PHP, Flutter, Terraform, Ansible
Lightweight, pip-based
pip install argus-languages
argus-languages scan /path/to/project
Full suite (MCP, DAST, IaC tools)
Everything, including AI integration
pip install argus-scan
argus scan all /path/to/project
Zero-install
uvx argus-scan
npx argus-codescan
Go (single binary)
go install github.com/argus-code-scanning/argus-codescan-mcp/
packages/go/
cmd/argus@latest
Docker (all scanners bundled)
docker pull ghcr.io/argus-code-scanning/argus-codescan-mcp:
latest

Quick start

React / Next.js
npm install -D argus-codescan
npm run security:all
Flutter / Java / PHP / Terraform
pip install argus-languages
argus-languages scan /path/to/project
Full CLI (all scan types)
pip install "argus-scan[all-tools]"
argus tools
argus scan all /path/to/project --fail-on high
MCP (any compatible client)
{ "mcpServers": {
  "argus": { "command": "argus", "args": ["mcp"] }
}}

Do I need a token or subscription?

No. Every scanner Argus uses is open-source and runs locally.

LayerCostRequires
Argus CLI
Free
Python 3.10+
Semgrep, Trivy, Bandit…
Free
Local install
Argus MCP server
Free
Python 3.10+
VS Code Quick Fix & apply_fix
Free
VS Code extension or MCP, no AI subscription
AI client (optional)
Subscription
Only if you want AI-driven scanning via MCP

AI assistants are optional. VS Code Quick Fix works without an AI subscription.

  • Show fix guidanceView remediation steps for a finding via the VS Code Quick Fix lightbulb.
  • Apply automated fixRun a local ESLint or Semgrep patch after you confirm, in VS Code or through MCP apply_fix.
  • Guidance-only findingsSecrets, dependencies, IaC, and DAST findings show remediation guidance only, no auto-patch.