Argus Launches: Open-Source Security Platform for Read-Only AI Agents

Argus

Argus is a self-hosted, multi-tenant security operations platform in which AI agents analyze evidence but never act on the estate. Collectors inventory cloud, identity, code, endpoint, network and Kubernetes assets into an evidence graph; a detection engine evaluates events for swarm, identity, cloud, code and canary signals; a scope-gated test harness runs authorized security tools; governed agents triage, investigate and hunt with read-only tools; and a separate action broker (typed actions, policy, approvals, dry runs, rollback, kill switch) is the only component allowed to change anything.

This README describes what is in the repository today. docs/ARCHITECTURE.md describes the design; docs/ROADMAP.md lists what is implemented versus planned.

Project status

Argus is an early open-source foundation, meant to be forked and extended. The platform core (tenancy, auth, RBAC, audit chain, queue, policy and approvals) is tested end to end on SQLite and PostgreSQL. The cloud and identity collectors and the action executors are tested against recorded fixtures and mocked APIs, not yet against live accounts, and the 12 detection rules are an untuned starting set. Expect to adapt collectors and rules to your estate, and run monitoring-only (docs/GO-LIVE.md) before enabling any action. It is not a certified product; see docs/COMPLIANCE.md for what it can and cannot evidence.

Architecture

  Browser / SDK / sensors
          |
          v  HTTPS (Caddy, ALB, Front Door or your ingress)
  +-------------------------------------------------------------+
  |  API  (FastAPI)  auth: session / OIDC+PKCE / TOTP / API keys |
  |  RBAC (viewer < analyst < operator < admin < owner), CSRF,   |
  |  per-principal rate limits, request ids, security headers    |
  +------+------------------+------------------+----------------+
         |                  |                  |
   PostgreSQL           Redis queue        Audit chain
   (tenant_id on       (leases, retries,   (hash-linked per tenant,
    every table)        python -m          HMAC, JSONL / S3 Object
                        app.worker)        Lock / Azure immutable)
         |                  |
  +------+------------------+----------------------------------+
  |  Worker processes run the same handlers as the API:        |
  |   collectors.run   detections.run / baselines              |
  |   graph.recompute  testing.run   agents.run                |
  +------------------------------------------------------------+
         |
         v  agents call propose_action only -> ActionRequest(pending)
  Action broker (separate policy, approvals, dry run, rollback, kill switch)

Trust boundaries, in one sentence each (details in docs/THREAT-MODEL.md):

1. Agents cannot execute anything; their one write-capable tool creates a pending request.
2. Everything an agent reads is wrapped as untrusted data and the prompt says so.
3. Active testing runs only inside a recorded authorization and scope, re-checked at run time.
4. Every domain table carries tenant_id; queries go through a scoped helper; tests assert it.
5. The audit chain is hash-linked, HMAC-signed (required in production), and mirrored to an external, optionally WORM, sink.

What is in this checkout

Routers are discovered automatically. The full v1 surface is in docs/API.md.

（注：更多技术实现细节与完整 API 文档请查阅原项目 README）