Policy-as-code for everyone

Scan infrastructure code. Find everything.

Argus scans cloud infrastructure configurations, detects secrets, and checks dependencies for known vulnerabilities — all from a single command. Built in-house, zero vendor lock-in.

One command. Three scanners.

IaC misconfigurations, hardcoded secrets, and vulnerable dependencies — all in one scan.

$ argus scan ./infrastructure

━━━ Argus v0.2.0 ━━━
Discovered 61 files across 11 parsers
Built resource graph: 63 vertices, 7 edges
Evaluating 79 policies (73 flat + 6 graph)...
SCA: 89,369 CVEs loaded

IaC: 34 findings
Secrets: 27 findings
SCA: 10 findings
Graph: 11 findings
─────────────────
Total: 82 findings

Severity breakdown:
CRITICAL: 8
HIGH: 41
MEDIUM: 24
LOW: 9

40/40 tests passing. TypeScript clean.

Supported frameworks

Verify changes across all major cloud providers and package ecosystems.

🏗️
Terraform
HCL + JSON
☁️
CloudFormation
YAML + JSON
Kubernetes
YAML manifests
Helm
Charts + templates
🐳
Dockerfile
Container images
💪
Bicep
Azure Bicep
📋
ARM Templates
Azure ARM
📦
Ansible
Playbooks
🟣
Pulumi
YAML programs
🔐
Secrets + SCA
Any code, all packages

Built in-house. No vendor lock-in.

Graph-Based Engine

Builds a resource dependency graph across all IaC files. Detects cross-resource issues — like S3 buckets without public access blocks — that flat scanners miss.

Secret Detection

16 regex + entropy patterns catch AWS keys, GitHub tokens, private keys, JWT tokens, Slack webhooks, and more — across any file type.

SCA with 89K+ CVEs

Scans 8 package ecosystems (npm, pip, Maven, Go, Cargo, Gem, PHP, NuGet). 89K+ CVEs refreshed every 15 minutes. Client-side or server-side.

79 Built-in Policies

IaC misconfigurations, secret exposure, vulnerable dependencies, graph-based relationships — all covered with severity + compliance mappings.

API + Dashboard

REST API for CI/CD integration. Web dashboard with scorecards, compliance tracking, trend analysis. Both modes coexist.

Argus Eye

Scheduled CVE ingestion daemon. Pulls from multiple feeds, normalizes, deduplicates, enriches — always current.

Dual-mode scanning

Scan locally for air-gapped environments. Or use the API server for lightweight, fast scans.

Client-Side

  • Full offline capability
  • All 89K CVEs loaded locally
  • No data leaves your machine
  • Air-gapped compatible
$ argus scan ./infra

Server-Side

  • Lightweight client (kilobytes)
  • Server holds the 671MB CVE database
  • Centralized policy updates
  • Fast API responses
$ argus scan ./ --server https://argus.example.com

CLI at your fingertips

argus scan ./infraFull scan — IaC + secrets + SCA
argus scan ./ --framework scaDependency vulnerability scan only
argus scan ./ --framework secretsSecret detection only
argus scan ./ --severity HIGHReport HIGH and above only
argus scan ./ --skip-check AG_AWS_001Skip a specific check
argus scan ./ --output jsonMachine-readable JSON output
argus scan ./ --soft-failAlways return exit code 0 (CI friendly)
argus-eye --feed /path/to/feedRebuild CVE database from feed
argus-eyed start -bStart Argus Eye daemon (15min refresh)

Ready to scan your infrastructure?

Open source. Built in-house. One command to find everything.