How HN: Argus – open-source security scanner with MCP

Argus, an open-source security scanner that orchestrates 20+ industry-standard tools including Semgrep, Trivy, Gitleaks, tfsec, Checkov, and OWASP ZAP behind a single command and an MCP server, is now available under the MIT license. It supports CLI, MCP, and GitHub SARIF formats, runs locally without a subscription, and is designed for solo developers, OSS maintainers, and teams seeking DevSecOps without proprietary scanner SaaS. The scanner is read-only and only applies fixes when explicitly requested by the user.

In Greek mythology, Argus Panoptes was the hundred-eyed giant — an all-seeing guardian who never slept. One open-source scanner. Many eyes. SAST, SCA, secrets, IaC, Terraform, Ansible — CLI, MCP, and GitHub SARIF. Argus orchestrates 20+ industry-standard tools Semgrep, Trivy, Gitleaks, tfsec, Checkov, OWASP ZAP, and more behind a single command and an MCP server for any MCP-compatible IDE or AI client. Runs locally. No Argus subscription. MIT licensed. Install: pip install argus-scan · npm install -D argus-codescan · Docker /argus-code-scanning/argus-codescan-mcp/blob/main/packages/docker/README.md · Launch kit /argus-code-scanning/argus-codescan-mcp/blob/main/docs/launch/show-hn.md | Run scanners yourself | Argus | | |---|---|---| Setup | Install & configure each tool separately | One CLI / MCP config | Output | Different JSON/text per tool | Unified report + SARIF | CI | Wire scripts yourself | --format sarif , .argus.yml , baseline diff | AI MCP IDE | Manual copy-paste | MCP tools: scan all , compare scans , apply fix | Cost | Free DIY labor | Free MIT — AI client optional | Fixes | You decide | Scan never auto-fixes; fix only when you ask | Good for: solo devs, OSS maintainers, teams wanting DevSecOps without a proprietary scanner SaaS. Not a replacement for: managed AppSec platforms with centralized policy, SOC, or compliance sign-off — Argus is a local orchestrator you own. argus scan sast /my/project argus scan terraform /my/infra argus scan all /my/project --fail-on high argus scan code /my/project --format sarif -o argus.sarif argus compare baseline.json current.json --fail-on-new argus tools Works for anyone. Just install Argus and the open-source scanner tools. argus mcp starts the MCP server Connect Cursor, VS Code, Claude Desktop, JetBrains, Windsurf, or any MCP-compatible IDE and drive scans through natural language. The AI subscription is for the AI client — Argus itself is always free. | Category | Tools | |---|---| SAST | Semgrep · Bandit · ESLint-security · flake8-bandit | DAST | OWASP ZAP · Nikto | SCA | Trivy · Safety · pip-audit · npm audit | Secrets | Gitleaks · detect-secrets · TruffleHog | IaC | Checkov · Trivy config · Terrascan · KICS | Terraform | tfsec · tflint · terraform validate · KICS · Checkov | Ansible | ansible-lint · KICS · Checkov | Container | Trivy image scan | | Tool | What It Does | |---|---| scan sast | Static code analysis — all languages | scan dast | Dynamic scan of a running web app | scan sca | Vulnerable dependency detection | scan secrets | Leaked API keys, tokens, passwords | scan iac | Terraform, K8s, Dockerfile, Helm, Ansible misconfigs | scan terraform | Deep Terraform scan tfsec, tflint, validate, KICS | scan ansible | Ansible playbook & role security scan | scan container | Container image CVE scanning | scan all | Everything, in parallel | apply fix | Preview or apply a fix for one finding user must ask — scans never auto-fix | compare scans | Diff baseline vs current scan JSON new/fixed findings | get scan report | Reformat a previous scan JSON as Markdown or SARIF | check tools | List which scanners are installed | Scans are read-only . Fixes run only when you ask — via apply fix , VS Code Quick Fix, or your AI editing code from fix guidance . Argus never modifies your code during a scan . After results come back: | How | AI token needed? | |---|---| VS Code Quick Fix lightbulb → Show fix guidance / Apply automated fix | No | MCP with apply fix apply=true ESLint / Semgrep autofix only | Only if AI calls it for you | AI edits code from finding guidance secrets, CVEs, IaC, OWASP, etc. | Yes for the AI client | CLI and MCP scans — detect only argus scan all /path/to/project MCP: user asks AI to fix a specific finding → apply fix { target, file, tool, apply: true } Details: API Reference — apply fix /argus-code-scanning/argus-codescan-mcp/blob/main/docs/api-reference.md apply fix Ship security findings to GitHub Code Scanning, enforce repo policy, and fail CI only on new findings. Export SARIF for GitHub Code Scanning argus scan code . --format sarif -o argus.sarif --fail-on high MCP: scan sast / scan all with format: "sarif" Upload in GitHub Actions see .github/workflows/argus-sarif.yml : - run: pip install argus-scan && argus scan code . --format sarif -o argus.sarif - uses: github/codeql-action/upload-sarif@v3 with: sarif file: argus.sarif category: argus Copy .argus.yml.example /argus-code-scanning/argus-codescan-mcp/blob/main/.argus.yml.example to .argus.yml in your repo root: fail on: high exclude paths: - "tests/fixtures/ " semgrep: config: p/owasp-top-ten suppressions: - rule id: bandit.B101 path: "tests/ " reason: "asserts in tests" expires: "2026-12-31" Argus auto-discovers .argus.yml when scanning. Override with --policy path/to/.argus.yml . Save baseline from main argus scan all . --format json -o baseline.json On PR — compare against baseline argus scan all . --baseline baseline.json --format json -o current.json argus compare baseline.json current.json --fail-on-new Or set in .argus.yml: baseline: .argus/baseline.json fail on new only: true Secret findings include step-by-step rotate/revoke guidance AWS, GitHub tokens, private keys, Stripe, etc. : argus scan secrets . --format json fix guidance on each finding MCP apply fix for secrets returns remediation steps no auto-fix Built-in static rules for SQL injection, connection strings, migration GRANTs, ORM raw queries: argus scan code . includes database.yaml rules via argus-languages Full docs: docs/features-roadmap.md /argus-code-scanning/argus-codescan-mcp/blob/main/docs/features-roadmap.md · API reference /argus-code-scanning/argus-codescan-mcp/blob/main/docs/api-reference.md Send scan results to the Argus cloud dashboard when ARGUS API KEY is set. Local scans still work without any key. export ARGUS API URL=http://localhost:4000/v1 default export ARGUS API KEY=arg live PASTE YOUR KEY argus scan all /path/to/project uploads automatically argus scan sast . --upload --fail-on high force upload argus scan secrets . --no-upload skip upload MCP — add env to your IDE's MCP config e.g. Cursor ~/.cursor/mcp.json , VS Code MCP settings, Claude Desktop config : { "mcpServers": { "argus": { "command": "argus", "args": "mcp" , "env": { "ARGUS API URL": "http://localhost:4000/v1", "ARGUS API KEY": "arg live PASTE YOUR KEY" } } } } Print the same template: argus mcp --config After each MCP scan or CLI scan, results upload to {ARGUS API URL}/scans with repo/branch/commit from git. Full setup: docs/AGENT-UPLOAD.md /argus-code-scanning/argus-codescan-mcp/blob/main/docs/AGENT-UPLOAD.md Pick the package that matches your project: | Your project | Install | Scan command | |---|---|---| React / Next.js / Node | npm install -D argus-codescan | npx argus-codescan scan all . | Java, PHP, Flutter, Terraform, Ansible | pip install argus-languages | argus-languages scan /path/to/project | Full suite MCP, DAST, IaC tools | pip install argus-scan | argus scan all /path/to/project | npm install -D argus-codescan npx argus-codescan scan sca . dependencies npm audit npx argus-codescan scan sast . source code JS/TS npx argus-codescan scan secrets . API keys, tokens npx argus-codescan scan all . everything CSV report written automatically or set path with --output npx argus-codescan scan all . --output ./reports/security.csv Add to package.json : { "scripts": { "security:scan": "argus-codescan scan sca . --output ./reports/deps.csv", "security:code": "argus-codescan scan sast . --output ./reports/code.csv", "security:secrets": "argus-codescan scan secrets . --output ./reports/secrets.csv", "security:all": "argus-codescan scan all . --output ./reports/full.csv" } } pip install argus-languages Any supported language / IaC in one command argus-languages scan /path/to/project Examples argus-languages scan ./my-java-app argus-languages scan ./terraform argus-languages scan ./flutter-app pip install argus-scan With all Python-native scanners: pip install "argus-scan all-tools " argus scan code /path/to/project built-in multi-language uses argus-languages argus scan sast /path/to/project + Semgrep, Bandit, ESLint if installed argus scan terraform /path/to/infra argus scan ansible /path/to/playbooks argus scan all /path/to/project --fail-on high argus scan all /path/to/project --upload cloud dashboard needs ARGUS API KEY argus scan all . --format sarif -o argus.sarif GitHub Code Scanning export argus compare baseline.json current.json diff two scan JSON files argus tools show installed scanners argus mcp start MCP server for any MCP-compatible IDE argus mcp --config print MCP config with cloud env vars uvx argus-scan full Python CLI via uv npx argus-codescan Node/React via npm go install github.com/OkiriGabriel/argus-codescan-mcp/packages/go/cmd/argus@latest curl -sSfL https://raw.githubusercontent.com/OkiriGabriel/argus-codescan-mcp/main/packages/shell/install.sh | sh docker pull ghcr.io/okirigabriel/argus-codescan-mcp:latest MCP server add to ~/.cursor/mcp.json — see packages/docker/README.md docker run --rm -i -v "$ pwd :/workspace" ghcr.io/okirigabriel/argus-codescan-mcp One-shot CLI scan docker run --rm -v "$ pwd :/workspace" ghcr.io/okirigabriel/argus-codescan-mcp \ scan all /workspace Full Docker guide: packages/docker/README.md /argus-code-scanning/argus-codescan-mcp/blob/main/packages/docker/README.md Install Argus Security Scanner from the VS Code Marketplace. npm install -D argus-codescan npm run security:all after adding scripts — see Install section above pip install argus-languages argus-languages scan /path/to/project pip install "argus-scan all-tools " argus tools argus scan code /path/to/project argus scan terraform /path/to/infra argus scan all /path/to/project --format table argus scan all /path/to/project --fail-on high Add to your MCP client config e.g. Cursor ~/.cursor/mcp.json , VS Code MCP settings, Claude Desktop claude desktop config.json : { "mcpServers": { "argus": { "command": "argus", "args": "mcp" , "env": { "ARGUS API URL": "http://localhost:4000/v1", "ARGUS API KEY": "arg live PASTE YOUR KEY" } } } } Omit the env block if you only want local scans no cloud upload . Or zero-install with uvx : { "mcpServers": { "argus": { "command": "uvx", "args": "argus-scan", "mcp" } } } Then ask your AI: Scan /path/to/myproject for security vulnerabilities Are there any hardcoded secrets in this repo? Fix the high-severity finding in src/api.js line 42 Run a full security audit and give me a prioritised fix list Run argus tools to see what's installed. Quick install for common tools: macOS brew install semgrep trivy gitleaks trufflehog tfsec tflint kics pip install bandit safety pip-audit detect-secrets checkov ansible-lint docker pull ghcr.io/zaproxy/zaproxy:stable OWASP ZAP Linux pip install "argus-scan all-tools " curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh Full guide: docs/tool-setup.md /argus-code-scanning/argus-codescan-mcp/blob/main/docs/tool-setup.md No Argus subscription for local scanning. Every scanner runs on your machine: | Layer | Cost | Requires | |---|---|---| | Argus CLI & MCP | Free | Python 3.10+ | | Semgrep, Trivy, Bandit, tfsec… | Free | Local install | | Cloud dashboard upload | Optional | ARGUS API KEY from your dashboard | | AI client Cursor, Claude | Subscription | Only for chat-driven scans and fixes | The AI subscription is for the AI client , not for Argus. Cloud upload uses your Argus API key arg live … , not your Cursor/Claude token. argus-codescan-mcp/ ├── packages/ │ ├── python/ pip install argus-scan │ │ └── src/argus/ │ │ ├── cli.py Standalone CLI │ │ ├── server.py MCP server │ │ ├── cloud upload.py Optional dashboard upload │ │ └── tools/ SAST, DAST, SCA, secrets, IaC, … │ ├── languages/ pip install argus-languages ← Java, PHP, Terraform, Ansible, all code │ │ └── src/argus languages/ │ │ └── bundled rules/ YAML rules shared across Python and future Go client │ ├── npm/ npx argus-codescan Node.js / JS-TS only │ ├── go/ go install .../argus@latest │ ├── shell/ curl | sh installer │ └── docker/ ghcr.io/okiriGabriel/argus-codescan-mcp ├── extensions/ │ └── vscode/ Argus Security Scanner VS Code extension ├── docs/ │ ├── getting-started.md │ ├── architecture.md │ ├── api-reference.md │ ├── AGENT-UPLOAD.md │ └── tool-setup.md └── .github/ ├── workflows/ CI for Python, npm, Go, VS Code, Docker └── ISSUE TEMPLATE/ | Doc | Description | |---|---| | Architecture /argus-code-scanning/argus-codescan-mcp/blob/main/docs/architecture.md API Reference /argus-code-scanning/argus-codescan-mcp/blob/main/docs/api-reference.md Agent Upload /argus-code-scanning/argus-codescan-mcp/blob/main/docs/AGENT-UPLOAD.md Tool Setup /argus-code-scanning/argus-codescan-mcp/blob/main/docs/tool-setup.md Contributing /argus-code-scanning/argus-codescan-mcp/blob/main/CONTRIBUTING.md Security Policy /argus-code-scanning/argus-codescan-mcp/blob/main/SECURITY.md All contributions welcome — new scanners, new language clients, bug fixes, docs. See CONTRIBUTING.md /argus-code-scanning/argus-codescan-mcp/blob/main/CONTRIBUTING.md . MIT — see LICENSE /argus-code-scanning/argus-codescan-mcp/blob/main/LICENSE