Show HN: Argus- open source security platform to protect against agentic attacks

Argus is an open-source, self-hosted security platform designed to safeguard against agentic attacks. It utilizes AI agents to analyze evidence without taking any actions on the estate. The platform is structured into various components, including collectors, a detection engine, a scope-gated test harness, governed agents, and an action broker.

The collectors inventory different types of assets into an evidence graph, while the detection engine evaluates events for various signals. The scope-gated test harness runs authorized security tools, and the governed agents triage, investigate, and hunt using read-only tools. The action broker, with its policy, approvals, dry runs, rollback, and kill switch features, is the only component allowed to alter the system.

The README file provides an overview of the current repository contents, including design documentation and roadmap details. Argus is meant to be forked and extended by users. The platform core, including tenancy, authentication, RBAC, audit chain, queue, policy, and approvals, undergoes end-to-end testing on both SQLite and PostgreSQL in continuous integration (CI).

Users can configure the collectors and detection rules to suit their environment and start in monitoring-only mode before enabling any action. The platform is not a certified product, and users should refer to the compliance documentation for the evidence it can and cannot provide. The trust boundaries are outlined in the threat model documentation, covering routers, the v1 API surface, and other aspects.

To get started, users can access the platform by visiting http://127.0.0.1:8080 with the provided email and password from the .env file. When Redis is not configured, jobs run within the API process. If the database auto-creation is enabled (default), tables are created upon startup. Synthetic demo data is available in an isolated tenant, which does not affect the network.

The demo includes login credentials, labeled assets, authorizations, events, findings, a canary, and an agent run record. The platform refuses to run when deployed in production mode. The Docker Compose file binds the API to 127.0.0.1:8080, runs the API and worker from a single image with a read-only root filesystem, mounts the ./targets directory read-only, and applies the schema at API startup.

Additional configuration options, such as enabling observability, are available. For Kubernetes deployment, the platform provides Helm charts for API and worker deployments, including HPA, PDB, default-deny NetworkPolicy, and ingress with TLS. AWS and Azure deployment instructions are also provided in the documentation. The production checklist outlines the necessary steps for a successful deployment.

The short version of the deployment guidelines is enforced through the assert_safe_config() function during startup. API keys carry roles and optional scopes to further restrict their usage. System principals are utilized only within queue handlers. Agents, represented by the AgentSpec class, have a system prompt, a list of tools, an output schema, and various budgets.

Tools are read-only views of Argus data, with the only propose tool creating a pending ActionRequest through the broker. Every tool result is redacted, truncated, and wrapped as untrusted data, with the guardrail prompt instructing the model to treat instructions in evidence as indicators of injection. Each model and tool step is persisted with input hash, token count, and latency.

The platform supports both AI_PROVIDER=none and provider-specific models. Prompt-injection and precision evaluation suites are available in the agent evaluations directory. Testing is conducted using the app/testing module, which includes TestScope objects with various configuration options. Runs are allowed only if the asset has a current AssetAuthorization that permits the tier, scope, and environment, and if the target passes policy validation.

External tools are executed through run_tool(), with fixed arguments, timeouts, bounded output, and a minimal environment. Actions in Argus are typed, declaring risk, reversibility, and parameter schemas. They also implement dry_run, execute, and rollback methods. Requests for actions pass through policy checks, including kill switch, tenant actions_enabled, deny-lists, maintenance windows, and auto-approval rules for low-risk reversible actions.

High-risk actions require additional approvals and critical actions necessitate a specific principal with the appropriate permissions. All transitions are accompanied by an audit entry. The platform includes assertions for global kill switch (environment variable ACTIONS_KILL_SWITCH) or per-tenant kill switch, which rejects all requests and execution.

Security vulnerabilities should be reported privately through GitHub's private vulnerability reporting process. The repository is licensed under MIT, and third-party tools, cloud SDKs, and model providers have their own separate licenses and terms of use.