Argus — Free, Open-Source AI Security Operations Platform | Thomas Unise

Open Source Free · MIT Licensed Self-Hosted Attackers have AI agents now.

So do you.

Argus is a free, open-source security operations platform that watches your cloud, logins, code and devices around the clock, catches machine-speed attacks the moment they start, and shuts them down in seconds.

AI does the legwork.

Guardrails you control decide what it's allowed to touch. Seconds, not hours From detection to a blocked attacker, with autonomous response on 27 one-click fixes Across AWS, Azure, GCP, Kubernetes, Okta, Entra, CrowdStrike and more $0 license No seats, no usage fees, no lock-in. You own all of it A stolen key handed to an AI agent can fire sixty probing calls across twenty of your cloud services in less time than it takes to read this sentence. Swarms of fake identities can spray passwords at your admin accounts from a hundred places at once. By the time a person reads the first alert, the attacker has already moved on to the next system. Most security tools were built for attackers who sleep. Argus was built for the ones that don't. It watches at machine speed, investigates at machine speed, and when you let it, responds at machine speed. It does all of that through one broker with approvals, dry runs, automatic rollback and a kill switch, so speed never turns into a new risk.

Fast enough to stop an AI attacker.

Disciplined enough to trust with your production systems. 01 / See it all Every asset, every login, one map Argus pulls in your AWS, Azure, GCP, Kubernetes, GitHub, Okta, Entra, devices and network traffic and links them into one evidence graph. You see the attack paths before an attacker does. 02 / Catch it early Built to spot AI-driven attacks Detections for agent swarms, machine-speed recon, privilege escalation, public exposure, leaked secrets and rogue workloads. Tripwires bait attackers' AI agents into revealing themselves. 03 / Shut it down Respond in seconds, from Slack Block an IP, contain a laptop through CrowdStrike or SentinelOne, disable a user, lock down a public bucket. Approve, deny or roll back with one tap in Slack, or let a playbook do it for you. 04 / Rein in AI Stop shadow AI and data leaks Find every AI tool your team is quietly using. Route your apps' and team's OpenAI and Anthropic calls through one gateway with approved models, data-loss rules, budgets and a full usage log. 05 / Know you're covered Test your defenses on demand Replay eight AI-agent attacks in a sealed sandbox and get a report of exactly what you'd catch and what would slip through. Let autonomous pentesting probe your own systems, inside the scope you set. 06 / Prove it Audit-ready from day one Every action is signed into a tamper-evident audit trail stored in write-once storage. Control mapping for SOC 2, NIST 800-171 and ISO 27001 is built in. 02:14:07 Attacker An attacker's AI agent finds what looks like an LLM API key in your code and tries to use it.The key is a canary that Argus planted.

Nothing real was exposed.

Tripwire 02:14:08 Detect Argus raises a high-severity detection with the attacker's source address and the full evidence trail. Caught 02:14:09 Respond Your playbook blocks the source at your Cloudflare firewall, within the hourly cap you set.Policy, deny-lists and the kill switch are checked first, every time. Blocked 02:14:10 Notify Slack lights up with what happened, why, and a one-tap Roll back button. Slack 07:30:00 Review Your team starts the day with a closed incident, a signed audit record and a choice: keep the block, or let it expire.If nobody keeps it, Argus rolls the block back automatically when its timer runs out. Done Letting software act on its own in production is a big decision, so Argus makes it a small, reversible one. The AI agents never touch your systems directly. They investigate with read-only access and can only propose. Every change, whether a person asks for it, an agent suggests it or a playbook fires, passes through the same broker. Off until you say soAutonomous response and autonomous pentesting ship switched off, and each needs both a deployment switch and a per-tenant opt-in. Shadow mode firstPlaybooks start by logging what they would have done, so you see their judgment before you give them the keys. Reversible onlyAutonomous playbooks run reversible actions, and each one rolls back automatically unless someone decides to keep it. CappedHourly limits per tenant and per playbook, a blast-radius limit, and two human approvals for high-risk actions. One switchThe kill switch stops every action in a tenant or across the whole deployment instantly. Hard to foolEverything the AI reads is treated as untrusted, and the agents are tested against prompt-injection attacks. Autonomous responseThreats handled while you sleep Playbooks turn a detection into a fix with no human in the loop, then undo it on a timer unless you keep it. Approve, deny and roll back from Slack buttons. AI gatewayOne front door for every AI call Your team uses OpenAI and Anthropic with company-held keys, approved models, data-loss rules, budgets and prompt-injection flags. Staff get Argus keys; your real provider keys stay locked inside Argus. Shadow-AI discoverySee which AI tools your staff really use Argus spots AI services in your network traffic, cloud accounts and SSO grants, keeps an inventory, and raises an alert for anything unreviewed or blocked. Attack simulatorA fire drill for AI-driven attacks Eight realistic agent attacks, from credential-spray swarms to a rogue Kubernetes agent, replayed in a sealed sandbox. Add "slow and low" evasion variants to find the gaps attackers would exploit. Autonomous pentestingA red team that never clocks out An AI planner picks the tests, Argus runs them through scanners like Nuclei, ZAP and Trivy, then plans the next round from what it found. It stays inside your authorized scope, re-checked before every step. Threat intelFix what's actually being exploited Every vulnerability is checked against the CISA Known Exploited list and scored for exploit likelihood. Anything attackers are actively using jumps to the top of your queue. AI-agent canariesTraps built for AI attackers Fake LLM keys, fake MCP servers, decoy agent rules files and planted prompt injections. An agent that bites gives itself away instantly. Endpoint containmentIsolate a compromised laptop in one step New CrowdStrike and SentinelOne actions contain a device straight from Argus, with the same approvals, dry run and rollback as everything else. MIT licensedSelf-hostedClaude, OpenAI, local Ollama or no AI at allDocker, Helm, Terraform for AWS and Azure quickstart $ git clone https://github.com/thomasunise/argus.git && cd argus $ python -m venv .venv && . .venv/bin/activate $ pip install -r requirements.txt $ cp .env.example .env && python scripts/generate_secrets.py --write $ uvicorn app.main:app --host 127.0.0.1 --port 8080 Open 127.0.0.1:8080 and sign in with the admin login from .env. Run python scripts/seed_demo.py for synthetic demo data. Going to production? There's Docker Compose for a pilot, a Helm chart for Kubernetes, and Terraform for AWS and Azure. Argus refuses to start in production mode without encryption keys, HTTPS, a write-once audit sink and SSO or two-factor, so an unsafe install can't happen by accident. The full checklist is in docs/DEPLOYMENT.md. Do it yourselfFree, forever Clone it, deploy it, make it yours. Best for teams with security engineers who want to own every line. MIT license: no seats, no usage fees, no vendor lock-in Architecture, threat model, runbooks and a step-by-step go-live guide Issues and contributions welcome on GitHub Get it on GitHub Done for youI install it and hand it over running For business owners and lean IT teams who want enterprise-grade protection without hiring a security team to run it. You get the outcome, not the project. Deployed in your own AWS, Azure or Kubernetes account. You own everything Connected to your cloud, logins, code and devices, with alerts in Slack An attack-simulator report showing what you catch today and the gaps we close Rules tuned to your business, and autonomous response proven in shadow mode before it goes live AI gateway and shadow-AI discovery set up so your team's AI use is safe and visible Your team trained on alerts, approvals and the kill switch Book an install call What is Argus? Argus is a free, open-source security operations platform you host yourself. It maps your cloud, identity, code, device, network and Kubernetes assets into one evidence graph, detects attacks including fast, AI-driven ones, uses AI agents to triage and investigate, and fixes problems through an action broker with approvals, dry runs, automatic rollback and a kill switch. It also governs your own company's AI use with an AI gateway and shadow-AI discovery. Can Argus act on its own?

Is that safe?

Only if you turn it on. Autonomous response and autonomous pentesting are off by default and need both a deployment setting and a per-tenant opt-in. Playbooks start in shadow mode, run only reversible actions, are capped per hour, and roll back automatically unless someone keeps the change. The AI agents themselves never execute anything: they investigate with read-only access and can only propose actions. Every change goes through the same broker, and the kill switch stops everything instantly. Can an attacker trick the AI? Argus is designed on the assumption that someone will try. Everything an agent reads is wrapped and labelled as untrusted data, and the agent is told that instructions found inside evidence are a sign of an attack. The agents are tested against prompt-injection evaluation suites, and because they cannot execute anything themselves, a tricked agent can at most file a request that still has to pass policy and approval. What does the attack simulator do to my systems?

Nothing.