{"slug": "how-hn-argus-open-source-security-scanner-with-mcp", "title": "How HN: Argus – open-source security scanner with MCP", "summary": "Argus, an open-source security scanner that orchestrates 20+ industry-standard tools including Semgrep, Trivy, Gitleaks, tfsec, Checkov, and OWASP ZAP behind a single command and an MCP server, is now available under the MIT license. It supports CLI, MCP, and GitHub SARIF formats, runs locally without a subscription, and is designed for solo developers, OSS maintainers, and teams seeking DevSecOps without proprietary scanner SaaS. The scanner is read-only and only applies fixes when explicitly requested by the user.", "body_md": "In Greek mythology, Argus Panoptes was the hundred-eyed giant — an all-seeing guardian who never slept.\n\n**One open-source scanner. Many eyes. SAST, SCA, secrets, IaC, Terraform, Ansible — CLI, MCP, and GitHub SARIF.**\n\nArgus orchestrates **20+ industry-standard tools** (Semgrep, Trivy, Gitleaks, tfsec, Checkov, OWASP ZAP, and more) behind a single command and an **MCP server** for any MCP-compatible IDE or AI client. Runs locally. **No Argus subscription.** MIT licensed.\n\n**Install:** `pip install argus-scan`\n\n· `npm install -D argus-codescan`\n\n· [Docker](/argus-code-scanning/argus-codescan-mcp/blob/main/packages/docker/README.md) · [Launch kit](/argus-code-scanning/argus-codescan-mcp/blob/main/docs/launch/show-hn.md)\n\n| Run scanners yourself | Argus | |\n|---|---|---|\nSetup |\nInstall & configure each tool separately | One CLI / MCP config |\nOutput |\nDifferent JSON/text per tool | Unified report + SARIF |\nCI |\nWire scripts yourself | `--format sarif` , `.argus.yml` , baseline diff |\nAI (MCP IDE) |\nManual copy-paste | MCP tools: `scan_all` , `compare_scans` , `apply_fix` |\nCost |\nFree (DIY labor) | Free (MIT) — AI client optional |\nFixes |\nYou decide | Scan never auto-fixes; fix only when you ask |\n\n**Good for:** solo devs, OSS maintainers, teams wanting DevSecOps without a proprietary scanner SaaS.\n\n**Not a replacement for:** managed AppSec platforms with centralized policy, SOC, or compliance sign-off — Argus is a **local orchestrator** you own.\n\n```\nargus scan sast /my/project\nargus scan terraform /my/infra\nargus scan all /my/project --fail-on high\nargus scan code /my/project --format sarif -o argus.sarif\nargus compare baseline.json current.json --fail-on-new\nargus tools\n```\n\nWorks for anyone. Just install Argus and the open-source scanner tools.\n\n```\nargus mcp    # starts the MCP server\n```\n\nConnect Cursor, VS Code, Claude Desktop, JetBrains, Windsurf, or any MCP-compatible IDE and drive scans through natural language. The AI subscription is for the AI client — Argus itself is always free.\n\n| Category | Tools |\n|---|---|\nSAST |\nSemgrep · Bandit · ESLint-security · flake8-bandit |\nDAST |\nOWASP ZAP · Nikto |\nSCA |\nTrivy · Safety · pip-audit · npm audit |\nSecrets |\nGitleaks · detect-secrets · TruffleHog |\nIaC |\nCheckov · Trivy config · Terrascan · KICS |\nTerraform |\ntfsec · tflint · terraform validate · KICS · Checkov |\nAnsible |\nansible-lint · KICS · Checkov |\nContainer |\nTrivy image scan |\n\n| Tool | What It Does |\n|---|---|\n`scan_sast` |\nStatic code analysis — all languages |\n`scan_dast` |\nDynamic scan of a running web app |\n`scan_sca` |\nVulnerable dependency detection |\n`scan_secrets` |\nLeaked API keys, tokens, passwords |\n`scan_iac` |\nTerraform, K8s, Dockerfile, Helm, Ansible misconfigs |\n`scan_terraform` |\nDeep Terraform scan (tfsec, tflint, validate, KICS) |\n`scan_ansible` |\nAnsible playbook & role security scan |\n`scan_container` |\nContainer image CVE scanning |\n`scan_all` |\nEverything, in parallel |\n`apply_fix` |\nPreview or apply a fix for one finding (user must ask — scans never auto-fix) |\n`compare_scans` |\nDiff baseline vs current scan JSON (new/fixed findings) |\n`get_scan_report` |\nReformat a previous scan JSON as Markdown or SARIF |\n`check_tools` |\nList which scanners are installed |\n\nScans are **read-only**. Fixes run only when you ask — via `apply_fix`\n\n, VS Code Quick Fix, or your AI editing code from `fix_guidance`\n\n.\n\nArgus **never modifies your code during a scan**. After results come back:\n\n| How | AI token needed? |\n|---|---|\nVS Code Quick Fix (lightbulb → Show fix guidance / Apply automated fix) |\nNo |\nMCP with `apply_fix` `apply=true` (ESLint / Semgrep autofix only) |\nOnly if AI calls it for you |\nAI edits code from finding guidance (secrets, CVEs, IaC, OWASP, etc.) |\nYes (for the AI client) |\n\n```\n# CLI and MCP scans — detect only\nargus scan all /path/to/project\n\n# MCP: user asks AI to fix a specific finding\n# → apply_fix { target, file, tool, apply: true }\n```\n\nDetails: [API Reference — apply_fix](/argus-code-scanning/argus-codescan-mcp/blob/main/docs/api-reference.md#apply_fix)\n\nShip security findings to GitHub Code Scanning, enforce repo policy, and fail CI only on **new** findings.\n\n```\n# Export SARIF for GitHub Code Scanning\nargus scan code . --format sarif -o argus.sarif --fail-on high\n\n# MCP: scan_sast / scan_all with format: \"sarif\"\n```\n\nUpload in GitHub Actions (see `.github/workflows/argus-sarif.yml`\n\n):\n\n```\n- run: pip install argus-scan && argus scan code . --format sarif -o argus.sarif\n- uses: github/codeql-action/upload-sarif@v3\n  with:\n    sarif_file: argus.sarif\n    category: argus\n```\n\nCopy [ .argus.yml.example](/argus-code-scanning/argus-codescan-mcp/blob/main/.argus.yml.example) to\n\n`.argus.yml`\n\nin your repo root:\n\n```\nfail_on: high\nexclude_paths:\n  - \"tests/fixtures/**\"\nsemgrep:\n  config: p/owasp-top-ten\nsuppressions:\n  - rule_id: bandit.B101\n    path: \"tests/**\"\n    reason: \"asserts in tests\"\n    expires: \"2026-12-31\"\n```\n\nArgus auto-discovers `.argus.yml`\n\nwhen scanning. Override with `--policy path/to/.argus.yml`\n\n.\n\n```\n# Save baseline from main\nargus scan all . --format json -o baseline.json\n\n# On PR — compare against baseline\nargus scan all . --baseline baseline.json --format json -o current.json\nargus compare baseline.json current.json --fail-on-new\n\n# Or set in .argus.yml:\n# baseline: .argus/baseline.json\n# fail_on_new_only: true\n```\n\nSecret findings include step-by-step rotate/revoke guidance (AWS, GitHub tokens, private keys, Stripe, etc.):\n\n```\nargus scan secrets . --format json   # fix_guidance on each finding\n# MCP apply_fix for secrets returns remediation steps (no auto-fix)\n```\n\nBuilt-in static rules for SQL injection, connection strings, migration GRANTs, ORM raw queries:\n\n```\nargus scan code .    # includes database.yaml rules via argus-languages\n```\n\nFull docs: [docs/features-roadmap.md](/argus-code-scanning/argus-codescan-mcp/blob/main/docs/features-roadmap.md) · [API reference](/argus-code-scanning/argus-codescan-mcp/blob/main/docs/api-reference.md)\n\nSend scan results to the Argus cloud dashboard when `ARGUS_API_KEY`\n\nis set. Local scans still work without any key.\n\n```\nexport ARGUS_API_URL=http://localhost:4000/v1   # default\nexport ARGUS_API_KEY=arg_live_PASTE_YOUR_KEY\n\nargus scan all /path/to/project                 # uploads automatically\nargus scan sast . --upload --fail-on high       # force upload\nargus scan secrets . --no-upload                # skip upload\n```\n\n**MCP** — add env to your IDE's MCP config (e.g. Cursor `~/.cursor/mcp.json`\n\n, VS Code MCP settings, Claude Desktop config):\n\n```\n{\n  \"mcpServers\": {\n    \"argus\": {\n      \"command\": \"argus\",\n      \"args\": [\"mcp\"],\n      \"env\": {\n        \"ARGUS_API_URL\": \"http://localhost:4000/v1\",\n        \"ARGUS_API_KEY\": \"arg_live_PASTE_YOUR_KEY\"\n      }\n    }\n  }\n}\n```\n\nPrint the same template: `argus mcp --config`\n\nAfter each MCP scan or CLI scan, results upload to `{ARGUS_API_URL}/scans`\n\nwith repo/branch/commit from git. Full setup: [docs/AGENT-UPLOAD.md](/argus-code-scanning/argus-codescan-mcp/blob/main/docs/AGENT-UPLOAD.md)\n\nPick the package that matches your project:\n\n| Your project | Install | Scan command |\n|---|---|---|\nReact / Next.js / Node |\n`npm install -D argus-codescan` |\n`npx argus-codescan scan all .` |\nJava, PHP, Flutter, Terraform, Ansible |\n`pip install argus-languages` |\n`argus-languages scan /path/to/project` |\nFull suite (MCP, DAST, IaC tools) |\n`pip install argus-scan` |\n`argus scan all /path/to/project` |\n\n```\nnpm install -D argus-codescan\n\nnpx argus-codescan scan sca .       # dependencies (npm audit)\nnpx argus-codescan scan sast .      # source code (JS/TS)\nnpx argus-codescan scan secrets .   # API keys, tokens\nnpx argus-codescan scan all .       # everything\n\n# CSV report written automatically (or set path with --output)\nnpx argus-codescan scan all . --output ./reports/security.csv\n```\n\nAdd to `package.json`\n\n:\n\n```\n{\n  \"scripts\": {\n    \"security:scan\": \"argus-codescan scan sca . --output ./reports/deps.csv\",\n    \"security:code\": \"argus-codescan scan sast . --output ./reports/code.csv\",\n    \"security:secrets\": \"argus-codescan scan secrets . --output ./reports/secrets.csv\",\n    \"security:all\": \"argus-codescan scan all . --output ./reports/full.csv\"\n  }\n}\npip install argus-languages\n\n# Any supported language / IaC in one command\nargus-languages scan /path/to/project\n\n# Examples\nargus-languages scan ./my-java-app\nargus-languages scan ./terraform\nargus-languages scan ./flutter-app\npip install argus-scan\n# With all Python-native scanners:\npip install \"argus-scan[all-tools]\"\n\nargus scan code /path/to/project    # built-in multi-language (uses argus-languages)\nargus scan sast /path/to/project    # + Semgrep, Bandit, ESLint if installed\nargus scan terraform /path/to/infra\nargus scan ansible /path/to/playbooks\nargus scan all /path/to/project --fail-on high\nargus scan all /path/to/project --upload          # cloud dashboard (needs ARGUS_API_KEY)\nargus scan all . --format sarif -o argus.sarif    # GitHub Code Scanning export\nargus compare baseline.json current.json          # diff two scan JSON files\nargus tools                         # show installed scanners\nargus mcp                           # start MCP server for any MCP-compatible IDE\nargus mcp --config                  # print MCP config with cloud env vars\nuvx argus-scan       # full Python CLI via uv\nnpx argus-codescan   # Node/React via npm\ngo install github.com/OkiriGabriel/argus-codescan-mcp/packages/go/cmd/argus@latest\ncurl -sSfL https://raw.githubusercontent.com/OkiriGabriel/argus-codescan-mcp/main/packages/shell/install.sh | sh\ndocker pull ghcr.io/okirigabriel/argus-codescan-mcp:latest\n\n# MCP server (add to ~/.cursor/mcp.json — see packages/docker/README.md)\ndocker run --rm -i -v \"$(pwd):/workspace\" ghcr.io/okirigabriel/argus-codescan-mcp\n\n# One-shot CLI scan\ndocker run --rm -v \"$(pwd):/workspace\" ghcr.io/okirigabriel/argus-codescan-mcp \\\n  scan all /workspace\n```\n\nFull Docker guide: [packages/docker/README.md](/argus-code-scanning/argus-codescan-mcp/blob/main/packages/docker/README.md)\n\nInstall **Argus Security Scanner** from the VS Code Marketplace.\n\n```\nnpm install -D argus-codescan\nnpm run security:all   # after adding scripts — see Install section above\npip install argus-languages\nargus-languages scan /path/to/project\npip install \"argus-scan[all-tools]\"\nargus tools\nargus scan code /path/to/project\nargus scan terraform /path/to/infra\nargus scan all /path/to/project --format table\nargus scan all /path/to/project --fail-on high\n```\n\nAdd to your MCP client config (e.g. Cursor `~/.cursor/mcp.json`\n\n, VS Code MCP settings, Claude Desktop `claude_desktop_config.json`\n\n):\n\n```\n{\n  \"mcpServers\": {\n    \"argus\": {\n      \"command\": \"argus\",\n      \"args\": [\"mcp\"],\n      \"env\": {\n        \"ARGUS_API_URL\": \"http://localhost:4000/v1\",\n        \"ARGUS_API_KEY\": \"arg_live_PASTE_YOUR_KEY\"\n      }\n    }\n  }\n}\n```\n\nOmit the `env`\n\nblock if you only want local scans (no cloud upload). Or zero-install with `uvx`\n\n:\n\n```\n{\n  \"mcpServers\": {\n    \"argus\": { \"command\": \"uvx\", \"args\": [\"argus-scan\", \"mcp\"] }\n  }\n}\n```\n\nThen ask your AI:\n\n```\nScan /path/to/myproject for security vulnerabilities\nAre there any hardcoded secrets in this repo?\nFix the high-severity finding in src/api.js line 42\nRun a full security audit and give me a prioritised fix list\n```\n\nRun `argus tools`\n\nto see what's installed. Quick install for common tools:\n\n```\n# macOS\nbrew install semgrep trivy gitleaks trufflehog tfsec tflint kics\npip install bandit safety pip-audit detect-secrets checkov ansible-lint\ndocker pull ghcr.io/zaproxy/zaproxy:stable   # OWASP ZAP\n\n# Linux\npip install \"argus-scan[all-tools]\"\ncurl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh\n```\n\nFull guide: [docs/tool-setup.md](/argus-code-scanning/argus-codescan-mcp/blob/main/docs/tool-setup.md)\n\n**No Argus subscription** for local scanning. Every scanner runs on your machine:\n\n| Layer | Cost | Requires |\n|---|---|---|\n| Argus CLI & MCP | Free | Python 3.10+ |\n| Semgrep, Trivy, Bandit, tfsec… | Free | Local install |\n| Cloud dashboard upload | Optional | `ARGUS_API_KEY` from your dashboard |\n| AI client (Cursor, Claude) | Subscription | Only for chat-driven scans and fixes |\n\nThe AI subscription is for the **AI client**, not for Argus. Cloud upload uses your **Argus API key** (`arg_live_…`\n\n), not your Cursor/Claude token.\n\n```\nargus-codescan-mcp/\n├── packages/\n│   ├── python/          pip install argus-scan\n│   │   └── src/argus/\n│   │       ├── cli.py             Standalone CLI\n│   │       ├── server.py          MCP server\n│   │       ├── cloud_upload.py    Optional dashboard upload\n│   │       └── tools/             SAST, DAST, SCA, secrets, IaC, …\n│   ├── languages/       pip install argus-languages  ← Java, PHP, Terraform, Ansible, all code\n│   │   └── src/argus_languages/\n│   │       └── bundled_rules/     YAML rules shared across Python (and future Go client)\n│   ├── npm/             npx argus-codescan  (Node.js / JS-TS only)\n│   ├── go/              go install .../argus@latest\n│   ├── shell/           curl | sh installer\n│   └── docker/          ghcr.io/okiriGabriel/argus-codescan-mcp\n├── extensions/\n│   └── vscode/          Argus Security Scanner VS Code extension\n├── docs/\n│   ├── getting-started.md\n│   ├── architecture.md\n│   ├── api-reference.md\n│   ├── AGENT-UPLOAD.md\n│   └── tool-setup.md\n└── .github/\n    ├── workflows/        CI for Python, npm, Go, VS Code, Docker\n    └── ISSUE_TEMPLATE/\n```\n\n| Doc | Description |\n|---|---|\n|\n\n[Architecture](/argus-code-scanning/argus-codescan-mcp/blob/main/docs/architecture.md)[API Reference](/argus-code-scanning/argus-codescan-mcp/blob/main/docs/api-reference.md)[Agent Upload](/argus-code-scanning/argus-codescan-mcp/blob/main/docs/AGENT-UPLOAD.md)[Tool Setup](/argus-code-scanning/argus-codescan-mcp/blob/main/docs/tool-setup.md)[Contributing](/argus-code-scanning/argus-codescan-mcp/blob/main/CONTRIBUTING.md)[Security Policy](/argus-code-scanning/argus-codescan-mcp/blob/main/SECURITY.md)All contributions welcome — new scanners, new language clients, bug fixes, docs.\nSee [CONTRIBUTING.md](/argus-code-scanning/argus-codescan-mcp/blob/main/CONTRIBUTING.md).\n\nMIT — see [LICENSE](/argus-code-scanning/argus-codescan-mcp/blob/main/LICENSE)", "url": "https://wpnews.pro/news/how-hn-argus-open-source-security-scanner-with-mcp", "canonical_source": "https://github.com/argus-code-scanning/argus-codescan-mcp", "published_at": "2026-08-05 09:54:21+00:00", "updated_at": "2026-08-05 10:22:29.919630+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools", "ai-agents"], "entities": ["Argus", "Semgrep", "Trivy", "Gitleaks", "tfsec", "Checkov", "OWASP ZAP", "MCP"], "alternates": {"html": "https://wpnews.pro/news/how-hn-argus-open-source-security-scanner-with-mcp", "markdown": "https://wpnews.pro/news/how-hn-argus-open-source-security-scanner-with-mcp.md", "text": "https://wpnews.pro/news/how-hn-argus-open-source-security-scanner-with-mcp.txt", "jsonld": "https://wpnews.pro/news/how-hn-argus-open-source-security-scanner-with-mcp.jsonld"}}