devatsecure/Argus Security
The All-Seeing AI Security Platform: Multi-agent security analysis with 5 specialized AI personas, 9 security scanners, Claude/OpenAI triage, and intelligent false positive reduction
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Mar 28, 2026
- License
- MIT
Pinned Snippet
uses: devatsecure/argus-security@7a6b42c8ab79016743c5115c0f360720ebaeb05b # v3.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| pipeline-mode | Pipeline mode: "fast" uses run_ai_audit.py (AI code review, 2-3 LLM calls), "full" uses hybrid_analyzer.py (6-phase pipeline with Semgrep+Trivy+Checkov+TruffleHog+AI enrichment) | no | fast |
| review-type | Type of review to run (audit, security, review) — used in fast mode | no | audit |
| project-path | Path to the project to review | no | . |
| project-type | Project type (backend-api, dashboard-ui, data-pipeline, infrastructure, or auto) — used in fast mode | no | auto |
| fail-on-blockers | Fail the workflow if merge blockers are found | no | true |
| fail-on | Granular fail conditions (e.g., "security:high,security:critical,test:critical") | no | "" |
| comment-on-pr | Comment on PR with review results | no | true |
| upload-reports | Upload review reports as artifacts | no | true |
| ai-provider | AI provider to use: anthropic, openai, openrouter, ollama, or auto | no | auto |
| anthropic-api-key | Anthropic API key for Claude AI analysis | no | "" |
| openai-api-key | OpenAI API key for GPT-4 analysis | no | "" |
| openrouter-api-key | OpenRouter API key for DeepSeek/Qwen/200+ models | no | "" |
| openrouter-model | OpenRouter model ID (e.g., deepseek/deepseek-v3.2, qwen/qwen3-235b-a22b) | no | deepseek/deepseek-v3.2 |
| semgrep-enabled | Enable Semgrep SAST scanning with 2,000+ security rules | no | true |
| ollama-endpoint | Ollama endpoint URL for local LLM (e.g., http://localhost:11434) | no | "" |
| model | AI model to use (e.g., claude-sonnet-4, gpt-4, llama3) | no | auto |
| multi-agent-mode | Enable multi-agent mode: single, sequential, or parallel | no | single |
| enable-multi-agent | Enable specialized agent personas (SecretHunter, ArchitectureReviewer, ExploitAssessor, FalsePositiveFilter, ThreatModeler) for collaborative security analysis | no | true |
| enable-spontaneous-discovery | Enable agents to find security issues beyond scanner rules (15-20% more findings): missing controls, architectural flaws, implicit trust issues, config mistakes, supply chain risks | no | true |
| enable-collaborative-reasoning | Enable multi-agent collaboration and discussion for consensus-based decisions (30-40% fewer false positives, but 40% higher cost) | no | false |
| enable-api-security | Enable OWASP API Top 10 testing for REST/GraphQL/gRPC endpoints (BOLA, broken auth, SSRF, misconfigurations) | no | true |
| enable-dast | Enable DAST scanning with Nuclei (4000+ templates) - Requires dast-target-url parameter | no | false |
| dast-target-url | Target URL for DAST scanning (e.g., https://staging.example.com) | no | "" |
| enable-sandbox | Enable Docker sandbox validation for exploit verification (Phase 4) — requires Docker, full mode only | no | false |
| enable-proof-by-exploitation | Enable LLM-powered proof-of-concept exploit generation + sandbox validation — requires Docker + LLM credits, full mode only | no | false |
| enable-supply-chain | Enable supply chain attack detection (typosquatting, malicious packages, compromised dependencies) | no | true |
| enable-fuzzing | Enable AI-guided fuzzing with 60+ payloads for APIs, functions, and file parsers | no | false |
| fuzzing-duration | Fuzzing duration in seconds (default: 300) | no | 300 |
| enable-threat-intel | Enable threat intelligence enrichment (CISA KEV, EPSS, NVD, exploit databases, real-time threat context) | no | true |
| enable-remediation | Enable AI-powered vulnerability fix generation with code patches and testing guidance | no | true |
| enable-runtime-security | Enable container runtime security monitoring with Falco (requires Docker) | no | false |
| runtime-monitoring-duration | Runtime monitoring duration in seconds (default: 60) | no | 60 |
| enable-regression-testing | Enable security regression test generation to ensure fixed vulnerabilities stay fixed | no | true |
| enable-iris | Enable IRIS semantic analysis for research-proven 2x improvement in vulnerability detection (arXiv 2405.17238) | no | true |
| severity-filter | Comma-separated severity levels to include in reports (e.g., critical,high,medium). Empty means all severities. | no | "" |
| enable-exploit-analysis | ✅ PRODUCTION: Enable exploit chain analysis and exploitability assessment (Aardvark mode) - Working in sequential mode | no | true |
| generate-security-tests | ✅ PRODUCTION: Auto-generate security tests for discovered vulnerabilities - Working in sequential mode | no | true |
| exploitability-threshold | Block merge if exploitability is at this level or higher (trivial, moderate, complex, theoretical, none) | no | trivial |
| only-changed | Only analyze changed files (PR mode) | no | false |
| include-paths | Glob patterns to include (comma-separated) | no | "" |
| exclude-paths | Glob patterns to exclude (comma-separated) | no | .github/**,node_modules/**,*.lock,package-lock.json |
| max-file-size | Max file size in bytes | no | 50000 |
| max-files | Max files to analyze | no | 50 |
| max-tokens | Max tokens per LLM call | no | 8000 |
| cost-limit | Max cost in USD per run | no | 1.0 |
| deep-analysis-mode | Phase 2.7 Deep Analysis mode (off, semantic-only, conservative, full) | no | off |
| max-files-deep-analysis | Maximum files for Phase 2.7 Deep Analysis | no | 50 |
| deep-analysis-cost-ceiling | Cost ceiling in USD for Phase 2.7 | no | 5.0 |
| deep-analysis-timeout | Timeout in seconds for Phase 2.7 | no | 300 |
| benchmark | Enable benchmark reporting | no | false |
Outputs
| name | description |
|---|---|
| review-completed | Whether the review completed successfully |
| blockers-found | Number of merge blockers found |
| suggestions-found | Number of suggestions found |
| report-path | Path to the generated report |
| sarif-path | Path to SARIF file for Code Scanning |
| json-path | Path to structured JSON results |
| cost-estimate | Estimated cost in USD |
| files-analyzed | Number of files analyzed |
| duration-seconds | Analysis duration in seconds |
| exploitability-trivial | Number of trivially exploitable vulnerabilities found |
| exploitability-moderate | Number of moderately exploitable vulnerabilities found |
| exploitability-complex | Number of complex exploitability vulnerabilities found |
| exploit-chains-found | Number of exploit chains identified |
| tests-generated | Number of security test files generated |
| pipeline-mode-used | Which pipeline mode was used (fast or full) |
| total-findings | Total findings from full pipeline scan |
| scanners-used | Comma-separated list of scanners that ran |
| scan-duration-seconds | Full pipeline scan duration in seconds |