Getting Started

Argus brings together 20+ industry-standard scanning tools — Semgrep, Trivy, OWASP ZAP, Bandit, Gitleaks, tfsec, ansible-lint, KICS, Checkov, TruffleHog, and more — behind a single CLI and MCP server. Run SAST, DAST, SCA, secret scanning, IaC, Terraform, Ansible, database, and ML/LLM security audits with one command. Export SARIF for GitHub Code Scanning, manage policy in .argus.yml, and diff baselines in CI.

Two ways to use Argus

Install

Pick the package that matches your project.

npm install -D argus-codescan
npx argus-codescan scan all .

pip install argus-languages
argus-languages scan /path/to/project

pip install "argus-scan[all-tools]"
argus scan all /path/to/project --fail-on high
argus mcp

uvx argus-scan
npx argus-codescan
go install github.com/argus-code-scanning/argus-codescan-mcp/packages/go/cmd/argus@latest
docker pull ghcr.io/argus-code-scanning/argus-codescan-mcp:latest

The npm package exposes only the argus-codescan binary — no argus name collision with the Python CLI.

CLI Usage

argus scan code /path/to/project      # multi-language, built-in
argus scan sast /path/to/project      # + Semgrep, Bandit, ESLint
argus scan ml /path/to/project        # AI/ML & LLM security rules
argus scan terraform /path/to/infra
argus scan ansible /path/to/playbooks
argus scan all /path/to/project --fail-on high
argus scan all . --format sarif --output report.sarif
argus compare baseline.json latest.json
argus tools                           # show installed scanners
argus mcp                             # start MCP server

MCP clients (IDE-agnostic)

Argus MCP uses stdio JSON-RPC — not tied to a single IDE. Add the same server block to any compatible client:

{
  "mcpServers": {
    "argus": {
      "command": "argus",
      "args": ["mcp"]
    }
  }
}

SARIF export & GitHub Code Scanning

Export findings as SARIF and upload them to GitHub's Security tab. A ready-made workflow lives in .github/workflows/argus-code-scanning.yml.

# Export SARIF locally
argus scan all . --format sarif --output argus-results.sarif

# GitHub Actions — upload to Code Scanning
# See .github/workflows/argus-code-scanning.yml in the repo
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: argus-results.sarif

.argus.yml policy file

Commit scan policy alongside your code — shared by CLI, CI, and MCP:

• fail_on — severity threshold for non-zero exit codes
• exclude — glob patterns to skip
• suppressions — accepted risks with reason and optional expiry
• baseline — path to a baseline snapshot for compare workflows

# .argus.yml — version-controlled scan policy
fail_on: high

exclude:
  - "**/test/**"
  - "**/vendor/**"

suppressions:
  - rule_id: semgrep.generic.secrets
    path: fixtures/demo.env
    reason: intentional test fixture

baseline: .argus/baseline.json

Baseline diff

Triage once, then fail CI only on net-new findings with argus compare or MCP compare_scans:

# Save a baseline after triage
argus scan all . --output .argus/baseline.json

# Fail CI only on net-new findings
argus scan all . --output latest.json
argus compare .argus/baseline.json latest.json --fail-on new

# MCP equivalent
compare_scans({ "baseline": ".argus/baseline.json", "current": "latest.json" })

Wiz integration

Send Argus findings to Wiz from CI using the ingest template in docs/wiz-integration.md.

# CI ingest — post Argus JSON/SARIF to Wiz
# Full guide: docs/wiz-integration.md in the repo

export WIZ_API_CLIENT_ID=...
export WIZ_API_CLIENT_SECRET=...

argus scan all . --format json --output argus-report.json
# Use the repo's wiz-ingest template to push findings

Fix guidance & automated patches

AI assistants (Cursor, Claude, VS Code Copilot, etc.) are optional. VS Code Quick Fix works without an AI subscription.

Secret remediation guidance

When Argus finds a leaked credential, it returns provider-specific rotation steps — not just a generic "remove the secret" message:

Database security rules

17 static rules for database-related vulnerabilities — included in scan all:

• SQL injection patterns in ORM and raw queries
• Hardcoded database credentials and connection strings
• Weak or missing TLS for database connections
• Overly permissive database user grants
• Exposed admin panels and debug endpoints
• 17 bundled static rules — run via scan all or dedicated database checks

ML / LLM security rules

Run dedicated ML scans with argus scan ml or MCP scan_ml. Eighteen bundled rules run automatically in scan all:

• Unsafe torch.load and pickle deserialization
• trust_remote_code enabled on Hugging Face models
• Hardcoded OpenAI, Anthropic, and other LLM API keys
• Prompt injection sinks in LLM application code
• Missing input sanitization for RAG and agent pipelines
• 18 bundled ML/LLM rules — included automatically in scan all

MCP Tools

Available tools once connected via MCP:

What Argus Scans

Repository Structure

argus-codescan-mcp/
├── packages/
│   ├── python/          pip install argus-scan
│   ├── languages/       pip install argus-languages
│   ├── npm/             npx argus-codescan (argus-codescan bin only)
│   ├── go/              go install .../argus@latest
│   ├── shell/           curl | sh installer
│   └── docker/          ghcr.io/argus-code-scanning/argus-codescan-mcp (pinned KICS)
├── extensions/vscode/   Argus Security Scanner (MCP Content-Length)
├── docs/
│   ├── wiz-integration.md
│   └── launch-kit/      Show HN, awesome-mcp, release notes
└── .github/
    └── workflows/       argus-code-scanning.yml (SARIF upload)

Contributing

All contributions welcome — new scanners, new language clients, bug fixes, docs. See CONTRIBUTING.md and the launch kit (Show HN, awesome-mcp, release notes), or visit the contribute page.