Argus 发布 MIT 许可的自托管智能体安全运营平台

Open Source Free · MIT Licensed Self-Hosted

Attackers have AI agents now. So do you.

Argus is a free, open-source security operations platform that watches your cloud, logins, code and devices around the clock, catches machine-speed attacks the moment they start, and shuts them down in seconds. AI does the legwork. Guardrails you control decide what it's allowed to touch.

Seconds, not hours From detection to a blocked attacker, with autonomous response on

27 one-click fixes Across AWS, Azure, GCP, Kubernetes, Okta, Entra, CrowdStrike and more

$0 license No seats, no usage fees, no lock-in. You own all of it

A stolen key handed to an AI agent can fire sixty probing calls across twenty of your cloud services in less time than it takes to read this sentence. Swarms of fake identities can spray passwords at your admin accounts from a hundred places at once. By the time a person reads the first alert, the attacker has already moved on to the next system.

Most security tools were built for attackers who sleep. Argus was built for the ones that don't. It watches at machine speed, investigates at machine speed, and when you let it, responds at machine speed. It does all of that through one broker with approvals, dry runs, automatic rollback and a kill switch, so speed never turns into a new risk.

Fast enough to stop an AI attacker. Disciplined enough to trust with your production systems.

01 / See it all

Every asset, every login, one map

Argus pulls in your AWS, Azure, GCP, Kubernetes, GitHub, Okta, Entra, devices and network traffic and links them into one evidence graph. You see the attack paths before an attacker does.

02 / Catch it early

Built to spot AI-driven attacks

Detections for agent swarms, machine-speed recon, privilege escalation, public exposure, leaked secrets and rogue workloads. Tripwires bait attackers' AI agents into revealing themselves.

03 / Shut it down

Respond in seconds, from Slack

Block an IP, contain a laptop through CrowdStrike or SentinelOne, disable a user, lock down a public bucket. Approve, deny or roll back with one tap in Slack, or let a playbook do it for you.

04 / Rein in AI

Stop shadow AI and data leaks

Find every AI tool your team is quietly using. Route your apps' and team's OpenAI and Anthropic calls through one gateway with approved models, data-loss rules, budgets and a full usage log.

05 / Know you're covered

Test your defenses on demand

Replay eight AI-agent attacks in a sealed sandbox and get a report of exactly what you'd catch and what would slip through. Let autonomous pentesting probe your own systems, inside the scope you set.

06 / Prove it

Audit-ready from day one

Every action is signed into a tamper-evident audit trail stored in write-once storage. Control mapping for SOC 2, NIST 800-171 and ISO 27001 is built in.

1. 02:14:07 Attacker An attacker's AI agent finds what looks like an LLM API key in your code and tries to use it.The key is a canary that Argus planted. Nothing real was exposed. Tripwire
2. 02:14:08 Detect Argus raises a high-severity detection with the attacker's source address and the full evidence trail. Caught
3. 02:14:09 Respond Your playbook blocks the source at your Cloudflare firewall, within the hourly cap you set.Policy, deny-lists and the kill switch are checked first, every time. Blocked
4. 02:14:10 Notify Slack lights up with what happened, why, and a one-tap Roll back button. Slack
5. 07:30:00 Review Your team starts the day with a closed incident, a signed audit record and a choice: keep the block, or let it expire.If nobody keeps it, Argus rolls the block back automatically when its timer runs out. Done

Letting software act on its own in production is a big decision, so Argus makes it a small, reversible one. The AI agents never touch your systems directly. They investigate with read-only access and can only propose. Every change, whether a person asks for it, an agent suggests it or a playbook fires, passes through the same broker.

Off until you say so

Autonomous response and autonomous pentesting ship switched off, and each needs both a deployment switch and a per-tenant opt-in.

Shadow mode first

Playbooks start by logging what they would have done, so you see their judgment before you give them the keys.

Reversible only

Autonomous playbooks run reversible actions, and each one rolls back automatically unless someone decides to keep it.

Capped

Hourly limits per tenant and per playbook, a blast-radius limit, and two human approvals for high-risk actions.

One switch

The kill switch stops every action in a tenant or across the whole deployment instantly.

Hard to fool

Everything the AI reads is treated as untrusted, and the agents are tested against prompt-injection attacks.

Autonomous response

Threats handled while you sleep

Playbooks turn a detection into a fix with no human in the loop, then undo it on a timer unless you keep it. Approve, deny and roll back from Slack buttons.

AI gateway

One front door for every AI call

Your team uses OpenAI and Anthropic with company-held keys, approved models, data-loss rules, budgets and prompt-injection flags. Staff get Argus keys; your real provider keys stay locked inside Argus.

Shadow-AI discovery

See which AI tools your staff really use

Argus spots AI services in your network traffic, cloud accounts and SSO grants, keeps an inventory, and raises an alert for anything unreviewed or blocked.

Attack simulator

A fire drill for AI-driven attacks

Eight realistic agent attacks, from credential-spray swarms to a rogue Kubernetes agent, replayed in a sealed sandbox. Add "slow and low" evasion variants to find the gaps attackers would exploit.

Autonomous pentesting

A red team that never clocks out

An AI planner picks the tests, Argus runs them through scanners like Nuclei, ZAP and Trivy, then plans the next round from what it found. It stays inside your authorized scope, re-checked before every step.

Threat intel

Fix what's actually being exploited

Every vulnerability is checked against the CISA Known Exploited list and scored for exploit likelihood. Anything attackers are actively using jumps to the top of your queue.

AI-agent canaries

Traps built for AI attackers

Fake LLM keys, fake MCP servers, decoy agent rules files and planted prompt injections. An agent that bites gives itself away instantly.

Endpoint containment

Isolate a compromised laptop in one step

New CrowdStrike and SentinelOne actions contain a device straight from Argus, with the same approvals, dry run and rollback as everything else.

MIT licensedSelf-hostedClaude, OpenAI, local Ollama or no AI at allDocker, Helm, Terraform for AWS and Azure

$ git clone https://github.com/thomasunise/argus.git && cd argus
$ python -m venv .venv && . .venv/bin/activate
$ pip install -r requirements.txt
$ cp .env.example .env && python scripts/generate_secrets.py --write
$ uvicorn app.main:app --host 127.0.0.1 --port 8080

Open 127.0.0.1:8080 and sign in with the admin login from .env. Run python scripts/seed_demo.py for synthetic demo data.

Going to production? There's Docker Compose for a pilot, a Helm chart for Kubernetes, and Terraform for AWS and Azure. Argus refuses to start in production mode without encryption keys, HTTPS, a write-once audit sink and SSO or two-factor, so an unsafe install can't happen by accident. The full checklist is in docs/DEPLOYMENT.md.

Do it yourself

Free, forever

Clone it, deploy it, make it yours. Best for teams with security engineers who want to own every line.

• MIT license: no seats, no usage fees, no vendor lock-in
• Architecture, threat model, runbooks and a step-by-step go-live guide
• Issues and contributions welcome on GitHub

Get it on GitHub

Done for you

I install it and hand it over running

For business owners and lean IT teams who want enterprise-grade protection without hiring a security team to run it. You get the outcome, not the project.

• Deployed in your own AWS, Azure or Kubernetes account. You own everything
• Connected to your cloud, logins, code and devices, with alerts in Slack
• An attack-simulator report showing what you catch today and the gaps we close
• Rules tuned to your business, and autonomous response proven in shadow mode before it goes live
• AI gateway and shadow-AI discovery set up so your team's AI use is safe and visible
• Your team trained on alerts, approvals and the kill switch

Book an install call

What is Argus?

Argus is a free, open-source security operations platform you host yourself. It maps your cloud, identity, code, device, network and Kubernetes assets into one evidence graph, detects attacks including fast, AI-driven ones, uses AI agents to triage and investigate, and fixes problems through an action broker with approvals, dry runs, automatic rollback and a kill switch. It also governs your own company's AI use with an AI gateway and shadow-AI discovery.

Can Argus act on its own? Is that safe?

Only if you turn it on. Autonomous response and autonomous pentesting are off by default and need both a deployment setting and a per-tenant opt-in. Playbooks start in shadow mode, run only reversible actions, are capped per hour, and roll back automatically unless someone keeps the change. The AI agents themselves never execute anything: they investigate with read-only access and can only propose actions. Every change goes through the same broker, and the kill switch stops everything instantly.

Can an attacker trick the AI?

Argus is designed on the assumption that someone will try. Everything an agent reads is wrapped and labelled as untrusted data, and the agent is told that instructions found inside evidence are a sign of an attack. The agents are tested against prompt-injection evaluation suites, and because they cannot execute anything themselves, a tricked agent can at most file a request that still has to pass policy and approval.

What does the attack simulator do to my systems?

Nothing. It replays synthetic attack data in a hidden, isolated sandbox that copies your detection settings. It sends no traffic, runs no tools and touches no real system. Simulated detections can't trigger autonomous response, alerts or findings. You get a coverage report showing which attacks your rules would catch and which would get through.

What is shadow AI, and how does Argus help?

Shadow AI is staff using AI tools the business hasn't approved, often by pasting in customer or company data. Argus finds AI services in your network, cloud and SSO data and keeps an inventory you review. Its AI gateway gives your team approved access to OpenAI and Anthropic models with company-held keys, data-loss rules, budgets, prompt-injection flags and a usage log.

Does it replace my SIEM or EDR?

It works with them. Argus takes events in from thirteen sources, including CrowdStrike, SentinelOne, GuardDuty, Wazuh and CloudTrail, can contain devices through CrowdStrike and SentinelOne, and sends alerts to Slack, Jira, ServiceNow, PagerDuty, email and webhooks. Many teams run it alongside existing tools as the layer that connects the evidence, investigates it and governs the response.

Which AI models does it work with?

Anthropic Claude, OpenAI, local models through Ollama, or none at all. With no model configured, the specialists fall back to deterministic logic, so detection and triage still work. Budgets cap every agent run by steps, tokens, time and cost.

Does my data leave my network?

Argus is self-hosted, so the platform and its data stay in your infrastructure. The only outside calls are the ones you set up: the cloud and identity APIs it collects from, the channels you send alerts to, the public threat-intel feeds, and a model provider if you choose a hosted one. With a local model and offline threat-intel files, no AI or intel traffic leaves your network at all.

Is it ready for production?

The platform core (tenancy, sign-in, roles, the audit trail, the job queue, policy and approvals) is tested end to end on SQLite and PostgreSQL in CI. Like any security platform, it should be tuned to your environment: connect the collectors you use, tune the detection rules, and run in monitoring-only mode before enabling any action. That tuning is exactly what the install service covers. Argus is not a certified product.

Does Argus make us SOC 2 or ISO 27001 compliant?

No software does that alone. Argus ships a control mapping for SOC 2, NIST 800-171 and ISO 27001 that shows which controls it can provide evidence for, such as the signed audit trail, role-based access and approval records. That makes the audit faster, but your auditor still assesses your program as a whole.

What does it cost?

The software is free under the MIT license. You pay only for the infrastructure you run it on and any AI model you choose. If you want it installed for you, the install is scoped and priced after a short call about your environment, and you keep everything: the code, the configuration and the credentials.

I'm a business owner, not a security engineer. Is this for me?

If you have cloud accounts, staff logins, customer data or code worth protecting, the protection is for you. You don't need to run it yourself. Book a call, tell me what you use, and I'll tell you plainly whether Argus is the right fit or whether something simpler would serve you better.

Get AI-speed protection without hiring a security team.

Thirty minutes. We look at what you run, where you're exposed, and what an install takes. You leave with a plan, a timeline and a fixed price, or a straight answer that you don't need it yet.

Book an install call