thomasunise/argus

What is it?

Key features

• 01Detects attacks across cloud, identity, code, endpoints, network and Kubernetes using 13 detection rules.
• 02AI specialist agents investigate with read-only tools and cannot execute actions directly.
• 03Action broker enforces policy, two-person approvals, dry runs and rollback for 27 typed actions.
• 04Optional autonomous response playbooks run in shadow mode first, with hourly caps and automatic rollback.
• 05Tamper-evident audit chain mirrored to S3 Object Lock or Azure immutable storage.
• 06Scope-checked pentest harness and CISA KEV / EPSS vulnerability enrichment.

Use cases

• Security teams monitoring AWS, Azure or GCP accounts for public exposure and suspicious activity.
• Organizations that need to govern employee use of OpenAI and Anthropic APIs with data-loss prevention and budgets.
• Teams running regular, scope-limited penetration tests against staging or lab environments.
• Companies that must keep audit trails for SOC 2, NIST 800-171 or ISO 27001 reviews.

Quick start

1. 1

   Create a virtual environment and activate it

   python -m venv .venv && . .venv/bin/activate
2. 2

   Install the requirements

   pip install -r requirements.txt -r requirements-dev.txt
3. 3

   Copy the environment file and generate secrets

   cp .env.example .env && python scripts/generate_secrets.py --write
4. 4

   Start the API locally

   uvicorn app.main:app --host 127.0.0.1 --port 8080

Things to know

• !Requires Python 3.11 or 3.12 and, for production, PostgreSQL, Redis and an external audit sink.
• !Many features (autonomous response, AI gateway, autopilot) are off by default and need deliberate setup.
• !Cloud and security tool integrations need your own accounts, API keys and installed tools.
• !The project is young with 114 stars, so expect limited community support.

In collections

Topics

FAQ

What is argus?

Self-hosted, MIT-licensed security operations platform where AI agents investigate detections and act on them under policy, approvals and rollback. Argus watches cloud accounts, identity providers, code repositories, endpoints, networks and Kubernetes clusters, then raises detections when it sees attack patterns. Specialist AI agents triage and investigate these detections using read-only tools, and can only propose changes. Proposed changes go through a separate action broker that enforces policy, human approvals, dry runs, reversibility and a kill switch.

Is argus free to use? What license does it have?

argus is open source under the MIT license. Check the license terms before using it in commercial products.

Is argus still maintained?

Actively maintained. The last commit to argus was on Nov 5, 2026.

What can I use argus for?

Security teams monitoring AWS, Azure or GCP accounts for public exposure and suspicious activity. Organizations that need to govern employee use of OpenAI and Anthropic APIs with data-loss prevention and budgets. Teams running regular, scope-limited penetration tests against staging or lab environments. Companies that must keep audit trails for SOC 2, NIST 800-171 or ISO 27001 reviews.

How do I install argus?

Create a virtual environment and activate it: python -m venv .venv && . .venv/bin/activate Install the requirements: pip install -r requirements.txt -r requirements-dev.txt Copy the environment file and generate secrets: cp .env.example .env && python scripts/generate_secrets.py --write Start the API locally: uvicorn app.main:app --host 127.0.0.1 --port 8080

Where can I get argus?

The source code and installation instructions are on GitHub: https://github.com/thomasunise/argus