Argus is an open-source, MIT-licensed security operations platform described in its repository as a self-hosted system for monitoring cloud, identity, code, endpoints, networks and Kubernetes. The project says security data remains under the operator’s control and that the platform can run offline for air-gapped installations.

The repository describes seven specialist AI agents that use read-only tools for triage, investigation and threat hunting. Agents can propose fixes, but their write-capable tool creates a pending action request rather than executing a change. A separate action broker handles policy checks, approvals, dry runs, execution, rollback and a kill switch.

Argus says its autonomous response playbooks can begin in shadow mode and use reversible actions subject to hourly and blast-radius limits. Autonomous features are off by default, and the documentation recommends starting in monitoring mode before enabling actions. Slack controls are included for approving, denying or rolling back actions.

The project also lists an AI gateway for governed OpenAI and Anthropic traffic, shadow-AI discovery, agent-focused canaries, an isolated simulator with eight AI-driven attack scenarios, and scope-checked autonomous testing. Other listed capabilities include CISA Known Exploited Vulnerabilities and EPSS enrichment, encrypted backups, tenant retention policies, and a hash-linked audit chain that can be mirrored to immutable storage.

Deployment options listed in the repository include Docker Compose, Helm and Terraform for AWS and Azure. The project says its test process runs more than 460 automated tests on each commit, alongside security scans and infrastructure validation.