How to use Argus

Install & use

pip install argus-panoptes

argus demo                                # zero-setup showcase — see it work in 30s
argus setup                               # first-time wizard (detects GPU, picks an LLM)
argus scan <repo-url|path>                # Phase 1 — static analysis
argus scan <path> --deep                  # + full LLM free-form review of high-risk files
argus scan <path> --taint                 # + LLM taint-tracing: only complete source-to-sink flows
argus attack --url http://localhost:3000  # Phase 2 — attack a running app
argus audit <repo-url>                    # Phase 1 + Phase 2
argus fix <path>                          # generate patches for fixable findings (dry-run)
argus fix <path> --apply                  # write the patches to disk
argus fix <path> --apply --pr             # + commit to a branch, push, and open a GitHub PR
argus report --format html                # export the last scan (html|json|markdown|sarif|sbom|vex|jira|pdf)
argus history                             # risk-score trend across past scans
argus compare                             # what's new/fixed since the last scan
argus suppress "<finding title>"          # mark a finding ignored — stops it recurring
argus surface                             # endpoints remembered across attack runs
argus status                              # resolved LLM provider, detected GPU, configured defaults

No LLM configured? Argus still runs the full deterministic scan — built-in rules, dependency audit, secret detection. Pick a local model via Ollama (private, offline) or bring your own Groq/Gemini/Claude/OpenRouter key. argus setup detects your GPU and recommends a model that fits your VRAM.

Run in Docker

Bundles Semgrep and the dependency auditors, so the container gets Argus's fullest static analysis without installing anything locally.

docker build -t argus .
docker run --rm -v "$PWD:/src" argus scan /src --no-llm

Put it in CI

Add Argus to any repo and publish findings to GitHub's Security tab:

- uses: Sarthak-47/ARGUS@main
  id: argus
  with:
    target: "."
    fail-on: "critical"      # fail the build on critical findings
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: ${{ steps.argus.outputs.sarif-file }}

For finer control than one severity threshold, drop a .argus-policy.toml at the repo root (or pass --policy <file>) to fail/warn/ignore per category, detector, or confirmed status. --diff-base main reports only findings in files a PR changed, so a pre-existing backlog doesn't fail the build — or snapshot that backlog once with --write-baseline and scan against it forever after with --baseline. Add pr-comments: "true" to the Action and Argus posts each new finding as an inline PR review comment too (idempotent — safe to leave on unconditionally).

Attack behind a login

Most real apps hide their interesting surface behind auth. Give Argus a session and the whole swarm — including ReconBot's crawl — acts as the logged-in user:

argus attack --url http://localhost:3000 --auth .argus-auth.toml

A .argus-auth.toml supports a bearer token, arbitrary headers, session cookies, HTTP basic, a CSRF-aware form login, and OAuth2 client-credentials. Add a second identity with --auth-b <file> and Argus tests broken object/function-level authorization (BOLA/BFLA) — only the "protected-from-anonymous yet reachable-cross-user" pattern is flagged, so public endpoints never false-positive.

Modern APIs are spec-defined, not link-crawlable — hand Argus the spec directly:

argus attack --url http://localhost:3000 --api-spec openapi.yaml

Accepts OpenAPI 3.x, Swagger 2.0, Postman v2, and a GraphQL introspection dump — file or URL. No flag? ReconBot auto-discovers a spec on its own at the usual paths.

Run it from your editor (MCP server)

pip install 'argus-panoptes[mcp]'
argus mcp-server

Exposes argus_scan, argus_attack, and argus_fix as MCP tools, so Copilot, Cursor, or Claude Code can run a real scan/attack/fix directly — point your MCP client's config at the argus mcp-server command (stdio transport).

Catch it before it commits

The cheapest way to use Argus: block a hardcoded secret or an obvious vulnerable pattern before it ever lands in git history. Add to .pre-commit-config.yaml:

repos:
  - repo: https://github.com/Sarthak-47/ARGUS
    rev: v1.2.12
    hooks:
      - id: argus            # blocks on HIGH+ findings (use argus-strict for MEDIUM+)

Then pre-commit install. Deterministic passes only (secrets + built-in rules) — no LLM, no network — fast enough for every commit. Standalone: argus precommit scans your currently-staged files.

Auto-fix pull requests

argus fix --apply writes safe, reverified patches to disk — re-scans afterward to confirm each patch actually closed the finding. Add --pr and it commits them to a new branch, pushes it, and opens a real GitHub pull request with each finding's explanation in the description.

Send findings to DefectDojo, Jira, or export VEX

DefectDojo: no new format needed — argus scan --format sarif is DefectDojo-compatible as-is via its built-in SARIF import type.

Jira: argus report --format jira writes a ready-to-import CSV — one issue per finding, priority mapped from severity. No Jira API or credentials needed.

VEX: argus report --format vex writes a CycloneDX 1.5 VEX document — a per-CVE exploitability statement for every dependency finding, driven by the same reachability analysis that already downgrades unimported packages.