Scan infrastructure code. Find everything.
Argus scans cloud infrastructure configurations, detects secrets, and checks dependencies for known vulnerabilities — all from a single command. Built in-house, zero vendor lock-in.
One command. Three scanners.
IaC misconfigurations, hardcoded secrets, and vulnerable dependencies — all in one scan.
━━━ Argus v0.2.0 ━━━
Discovered 61 files across 11 parsers
Built resource graph: 63 vertices, 7 edges
Evaluating 79 policies (73 flat + 6 graph)...
SCA: 89,369 CVEs loaded
IaC: 34 findings
Secrets: 27 findings
SCA: 10 findings
Graph: 11 findings
─────────────────
Total: 82 findings
Severity breakdown:
CRITICAL: 8
HIGH: 41
MEDIUM: 24
LOW: 9
40/40 tests passing. TypeScript clean.
Supported frameworks
Verify changes across all major cloud providers and package ecosystems.
Built in-house. No vendor lock-in.
Graph-Based Engine
Builds a resource dependency graph across all IaC files. Detects cross-resource issues — like S3 buckets without public access blocks — that flat scanners miss.
Secret Detection
16 regex + entropy patterns catch AWS keys, GitHub tokens, private keys, JWT tokens, Slack webhooks, and more — across any file type.
SCA with 89K+ CVEs
Scans 8 package ecosystems (npm, pip, Maven, Go, Cargo, Gem, PHP, NuGet). 89K+ CVEs refreshed every 15 minutes. Client-side or server-side.
79 Built-in Policies
IaC misconfigurations, secret exposure, vulnerable dependencies, graph-based relationships — all covered with severity + compliance mappings.
API + Dashboard
REST API for CI/CD integration. Web dashboard with scorecards, compliance tracking, trend analysis. Both modes coexist.
Argus Eye
Scheduled CVE ingestion daemon. Pulls from multiple feeds, normalizes, deduplicates, enriches — always current.
Dual-mode scanning
Scan locally for air-gapped environments. Or use the API server for lightweight, fast scans.
Client-Side
- Full offline capability
- All 89K CVEs loaded locally
- No data leaves your machine
- Air-gapped compatible
Server-Side
- Lightweight client (kilobytes)
- Server holds the 671MB CVE database
- Centralized policy updates
- Fast API responses
CLI at your fingertips
argus scan ./infraFull scan — IaC + secrets + SCAargus scan ./ --framework scaDependency vulnerability scan onlyargus scan ./ --framework secretsSecret detection onlyargus scan ./ --severity HIGHReport HIGH and above onlyargus scan ./ --skip-check AG_AWS_001Skip a specific checkargus scan ./ --output jsonMachine-readable JSON outputargus scan ./ --soft-failAlways return exit code 0 (CI friendly)argus-eye --feed /path/to/feedRebuild CVE database from feedargus-eyed start -bStart Argus Eye daemon (15min refresh)Ready to scan your infrastructure?
Open source. Built in-house. One command to find everything.