argus-ai-scanner 1.11.1

AI-native code security scanner: runtime sandbox-validated remediation. Confirm exploits, auto-patch, replay against the fix — all at machine scale.

Argus Scanner

Verified vulnerability remediation at machine scale. Static scanners give CISOs more findings to triage; Argus closes them. Argus stacks three layers — deterministic preprocessing, semantic LLM reasoning, runtime sandbox validation — each doing what it's fastest at, so a vulnerability goes from detection to verified, sandbox-tested patch in minutes instead of weeks. The LLM designs the exploit; a Firecracker microVM proves it fires. The LLM writes the patch; the same sandbox replays the same exploit against the patched code. You ship kernel-evidence-verified fixes, not tickets that pile up.

Open source. BYOK. Apache 2.0.

Install

pip install argus-ai-scanner
export ANTHROPIC_API_KEY=sk-ant-...

argus scan path/to/file.py            # single file
argus scan-repo .                     # whole repo

That's it. With just an Anthropic key, Argus runs the L1 cascade. Add a Fly.io sandbox (see docs/dast-setup.md, 10 min one-time) to turn on Validation + Remediation.

What a scan looks like

$ argus scan samples/regression_v1/high_with_vuln.py

high_with_vuln.py  →  suspicious  (2 CONFIRMED, 0 NEUTRALIZED, 1 STILL_EXPLOITABLE, 1 UNVERIFIABLE)
                      cost: $0.31      time: 5m 50s

H001  CWE-78 command_injection  critical  CONFIRMED
  function: run_user_command (line 7)
  evidence: sandbox executed `; whoami` via shell=True interpolation
  ▼ Remediation: STILL_EXPLOITABLE
    patch swapped shell=True for sh -c -- "$input" — still shell injection
    manual review required

H002  CWE-78 command_injection  critical  CONFIRMED
  function: list_directory (line 16)
  evidence: sandbox executed `; cat /etc/passwd` via f-string interpolation
  ▼ Remediation: UNVERIFIABLE
    sandbox couldn't decisively replay; manual review

Every CONFIRMED row has a kernel-level event trace. Every Remediation row has a generated patch + a sandbox-replay verdict on whether the patch actually closed the bug. Verbose output, JSON, and SARIF for GitHub Code Scanning all available via --output.

Architecture

The composition is the engineering. Each layer is structurally best-in-class for one job; skipping work the other layers can absorb is what makes the pipeline both fast and verified.

• Deterministic preprocessing — hash dedup, AST parsing, deobfuscation, known-malware hash lookup. Free, byte-deterministic. Argus never burns a token on what a hash match can decide.
• Semantic LLM (Sonnet 4.6 / Opus 4.6) — reads intent, designs exploits, writes patches, judges sandbox traces. The only layer that can answer "is this function supposed to take untrusted input?"
• Runtime sandbox (Firecracker microVM + kernel-syscall observation via bpftrace) — the ground-truth oracle. The only layer that can prove an exploit actually fired or a patch actually closed the hole.

Pure-SAST tools have no runtime. Classic DAST tools have no semantic reasoning. Pattern-based remediation tools generate patches without verification. Argus closes all three gaps in one pipeline.

File
  ↓
Preprocessing             (deterministic, free — hash, deobfuscation, attack-vector flags)
  ↓
Triage                    (Sonnet 4.6 default — CLEAN / LOW / HIGH)
  ↓
L1 analysis               (Sonnet 4.6 → Opus 4.6 escalation on borderline)
  ↓
[default ON]
Finding Validation        (each L1 finding re-run in Firecracker microVM)
  ↓
Remediation               (auto-patch + sandbox replay against original exploit)
  ↓
[opt-in]
Exploit Discovery         (hunts for exploits L1 didn't see — `--enable-runtime-probe`)
Behavioral Profiling      (runtime behavior capture — `--enable-phase-3-discovery`)
Adversarial Reasoning     (model-designed hypotheses anchored on the profile — `--enable-phase-3-loop`)
  ↓
FP-defense oracle stack   (structured assertions / downstream-cap / syscall-sink)
Engine guards             (intent cap, findings-floor invariant)
  ↓
Final verdict

Default cost on a typical scan: $0.10–$0.40 per suspicious file. Opt-in zero-day hunting adds ~$0.30–$1.50/file. Cap with --max-cost.

Coverage

Static + LLM cascade (every supported format):

• Code: Python · JavaScript · TypeScript · shell · Java bytecode (.class, .jar)
• Supply-chain manifests: package.json · requirements.txt · Cargo.lock · go.mod · Gemfile · composer.json · pyproject.toml · Pipfile · Dockerfile · Makefile · .npmrc · .pypirc
• AI-agent configs: CLAUDE.md · mcp.json · .cursorrules · claude_desktop_config.json · AGENTS.md · devcontainer.json
• Doc / web attack surface: Markdown · RST · AsciiDoc · HTML · SVG · XML

Sandbox (Validation + Remediation): Python · JS/TS · shell · Java bytecode. Non-executable formats stay cascade-only.

Roadmap: Go · Rust · .NET.

Per-finding statuses

Status	Meaning
CONFIRMED	Sandbox observed the exploit firing. Patch generated by default.
BLOCKED	Attack was tested; the file's own code defended (sanitization, escaping).
UNREACHED	Attack was tested; the code path is genuinely unreachable.
NOT_TESTED	Sandbox couldn't execute the test. Sub-reason: infra_stub / inconclusive / not_planned.
SUPPRESSED	FP-defense oracle (structured assertion / downstream-cap / syscall-sink) refuted the static match. Audit trail preserved.

For CONFIRMED findings, the Remediation block adds a post-patch status:

Post-patch	Meaning
NEUTRALIZED	Sandbox replay shows the exploit no longer fires. Ship the patch.
STILL_EXPLOITABLE	Patch was insufficient. Sandbox still observes the original exploit firing.
UNVERIFIABLE	Sandbox couldn't decisively replay. Manual review.

Enterprise invariants

• BYOK. You pay Anthropic + Fly directly. Argus collects nothing.
• Zero telemetry. Cascade-only mode: nothing leaves your machine. DAST mode: file content goes only to a Fly.io app you own and control — never to Argus-operated infrastructure.
• Hardware isolation. Detonation happens in Firecracker microVMs (KVM hardware virtualization), ephemeral per-run, strict egress control.
• Local execution. Self-contained pipeline; no SaaS dependency.

CLI essentials

# Skip patch generation (compliance / CI / read-only audits)
argus scan-repo . --no-enable-remediation

# Add zero-day hunting on top of the default cascade
argus scan path/to/file.py \
  --enable-runtime-probe \
  --enable-phase-3-discovery \
  --enable-phase-3-loop

# CI mode — only files changed vs main, SARIF for GitHub Code Scanning
argus scan-repo . --diff origin/main --output sarif --output-file argus.sarif

# Cap per-file API spend
argus scan path/to/file.py --max-cost 0.50

Full reference: argus scan --help, argus scan-repo --help, argus install --help.

Documentation

Topic	Page
Install + first scan	docs/install.md
DAST sandbox setup (Fly.io)	docs/dast-setup.md
Architecture deep dive	docs/architecture.md
Cost guide	docs/cost-guide.md
API key sourcing	docs/api-keys.md
Roadmap	ROADMAP.md
Contributing	CONTRIBUTING.md
Security disclosures	SECURITY.md

License

Apache License 2.0.