▶ Watch the feature tour (narrated · guardrail refusal · real Network · Linux · Windows · AD scans · CVSS/MITRE · HMAC audit) · short real-scan demo · architecture site

Argus

Run supervised defensive assessments inside an explicitly authorized, separately verified lab. Argus turns bounded read-only collection into proof-annotated findings behind a fail-closed guardrail.

Most "AI pentest" tools are a scanner with a chatbot bolted on: they run a linear checklist and summarize it. Argus V1 is built around a deterministic guardrail and sandboxed collectors. V2 agent, continuous, and evidence-graph modules are experimental scaffolding and are not a production continuous service.

Maturity: supervised release candidate; alpha runtime. V1 is the supported product. V2 continuous mode is experimental, explicitly gated, and unsupported. Argus is not approved for unattended, network-exposed, multi-user, production, regulated, or 24/7 deployment. The web console is localhost-only and live web execution is disabled by default.

🛡️ Authorized internal security testing only. Ships with a fully-isolated, intentionally-vulnerable lab — run there first. Live use requires written authorization, a defined CIDR scope, and a regulated-systems exclusion list.

---

Why it exists

If you have watched an "AI security tool" hallucinate a critical finding with no evidence, or refuse to run anywhere near production because it might break something — this is the antidote.

• The agent proposes, the guardrail disposes. Every step the planner chooses is re-authorized by the guardrail: scope, tool firewall, budget, audit. Autonomy can never escape the authorized CIDR, arm an exploit, or touch a denied tool — no matter what the model "reasons."
• Read-only by default. No exploitation, credential spraying, writes, or DoS. Credentialed checks use null/guest/audit-mode only. The one component that can emit beyond recon — the PoC verifier — is triple-gated to an isolated lab.
• Evidence or it didn't happen. Every attack path is tagged proof: observed (every link backed by collected evidence) or proof: theoretical (plausible, not yet demonstrated). No silent guesses.
• Operator-selected analysis. Use cloud Claude only for approved non-sensitive data, local Ollama to avoid cloud egress, or the offline heuristic engine. Local processing reduces data movement; it is not a compliance guarantee.
• Tamper-evident. Every authorize / exec / deny is written to an HMAC-SHA256 chained audit log; argus audit replays and verifies the whole chain.

How it works

targets ─▶ guardrail ─▶ sandbox ─▶ collectors ─▶ AI triage ─▶ chain reasoning ─▶ report
           (fail-       (internal  (network·host  (Haiku→      (observed |        (CSV·MD·
            closed)      Docker)    ·AD·web)        Sonnet)      theoretical)       JSON)
                 ▲                                                   │
                 └────────────── agentic re-plan loop ◀──────────────┘
                        observe → decide next action → AUTHORIZE → collect → repeat

The bounded V1 planner proposes a profile; the guardrail authorizes it before a collector executes. This is an operator-invoked loop, not unattended autonomy.

Architecture

flowchart TD
    OP["🎛️ Operator Console — CLI + FastAPI GUI"] --> GR
    subgraph GR["🛡️ Guardrail — 7 layers, fail-closed"]
      direction LR
      G1[Scope guard] --> G2[Tool firewall] --> G3[Arg hygiene] --> G4[Budget/time] --> G5[HMAC audit] --> G6[Output sanitizer]
    end
    GR --> SB["📦 Sandbox — internal Docker net, argv-only exec"]
    SB --> CO["🔬 Collectors, read-only — network · Linux/SSH · Windows/WinRM · AD/LDAP · web"]
    CO --> EN["✨ Enrichment — shadow-AI · segmentation · cred-exposure"]
    EN --> AI["🧠 AI triage to correlation — Claude · Ollama · offline"]
    AI --> CH["🔗 Chaining engine — proof: observed or theoretical"]
    CH --> RP["📊 Report — CSV · Markdown · JSON"]
    AI -. re-plan .-> PL["🤖 Planner loop"]
    PL -. next action .-> GR

Loading

The agentic loop

flowchart LR
    O["observe — evidence set"] --> D["decide — next read-only profile"]
    D --> A{"🛡️ guardrail authorize?"}
    A -- denied --> X["skip + audit"]
    A -- allowed --> C["collect in sandbox"]
    C --> R{"new evidence? budget? depth?"}
    R -- continue --> O
    R -- stop --> F["chain + report"]
    X --> R

Loading

Capabilities

Domain	What Argus does
🌐 Network	16 read-only tools across 9 profiles — nmap, masscan, nuclei, sslscan, whatweb, enum4linux-ng, smbmap, snmp, ldapsearch
🐧 Host · Linux	credentialed SSH audit — SUID/GTFOBins, NOPASSWD sudo, weak sshd, world-writable, Lynis
🪟 Host · Windows	WinRM audit — SMB signing, AlwaysInstallElevated, unquoted services, WDigest, UAC, LAPS
🗂️ Active Directory	anonymous LDAP enumeration — RootDSE disclosure, null-bind, user enum
🕸️ Web / API	curated read-only probe — .env, .git, actuator, Swagger/OpenAPI surface
🧩 Segmentation	flags database / management / directory planes reachable from a user VLAN
🤖 Shadow-AI	discovers ungoverned local LLMs/notebooks — Ollama, Jupyter, Gradio, vLLM, vector DBs
🔑 Credential exposure	detects GPP cpassword, exposed secrets — reports the path, never the secret
🔗 Chain reasoning	deterministic decision-trees derive multi-step attack paths with proof annotations

Why it's different

	Typical "AI scanner"	Argus
Safety model	run, then hope	fail-closed guardrail authorizes every action
Autonomy	linear checklist	agent re-plans from evidence, still guardrail-bounded
Findings	isolated, often unverified	chained attack paths, tagged observed/theoretical
AI privacy	cloud-only	Claude · local Ollama · fully offline
Exploitation	active by default	read-only; PoC is triple-gated to an isolated lab
Auditability	logs, maybe	HMAC-chained, tamper-evident, self-verifying

Quickstart

cd aegis
python3.12 -m venv .venv && . .venv/bin/activate
python -m pip install --require-hashes -r requirements.lock
export PENTEST_AUDIT_HMAC_KEY=$(openssl rand -hex 32)   # required — refuses to run unaudited
# optional AI: export ANTHROPIC_API_KEY=…   or   export AEGIS_OLLAMA_MODEL=qwen2.5:7b-instruct

  # Localhost-only web console; dry-run is server-enforced by default
uvicorn aegis.web:app --host 127.0.0.1 --port 8800      # http://127.0.0.1:8800

# Or the CLI
python -m aegis scan  172.30.0.10 172.30.0.11 --profile full   # network recon + AI
python -m aegis web   172.30.0.11                              # web/API recon
python -m aegis agent 172.30.0.11 --seed network              # agentic loop
python -m aegis host  172.30.0.20                             # Linux host audit
python -m aegis ad    172.30.0.21                            # AD/LDAP
python -m aegis audit                                       # verify the HMAC chain

Out-of-scope or obfuscated targets are refused before anything executes:

$ python -m aegis scan 10.0.0.5 --dry-run
REFUSED target 10.0.0.5: scope: 10.0.0.5/32 outside allowed scope
$ python -m aegis scan 167772165 --dry-run     # decimal-encoded 10.0.0.5
REFUSED target 167772165: scope: 10.0.0.5/32 outside allowed scope

The bundled lab

An intentionally vulnerable lab configured on an internal: true Docker network. Treat isolation as a deployment prerequisite to verify independently; scripts/verify-isolation.sh is a diagnostic helper, not proof against every host/runtime route.

targets/   Juice Shop · DVWA · Samba · misconfigured Linux SSH host · anonymous-bind LDAP · Kali attacker
frrlab/    simulated 2-router OSPF network (FRR, native arm64) for containerlab
scripts/   verify-isolation.sh — proves the lab cannot reach the real LAN/internet

cd targets && docker compose up -d
LAN_GW=192.168.1.1 ../scripts/verify-isolation.sh    # verify isolation FIRST

Security posture

Default posture: the V1 CLI is sandbox-first and dry-run capable; some explicitly selected profiles and PoC paths can emit traffic or execute remote checks. The PoC runner requires all three gates: armed (--arm poc), target inside AEGIS_LAB_NET, and AEGIS_POC_CONFIRM_ISOLATED=1. The localhost-only web console rejects request-selected live/armed modes and defaults to dry-run; host and AD web endpoints are denied unless live mode is enabled in server startup configuration. Before any live use: written authorization, CIDR scope, exclusions, separately verified isolation, and non-production credentials. See aegis/SECURITY.md.

Tests

Current release-closeout collection: 292 tests on Python 3.12. Historical counts in the build log and phase delivery reports remain labeled snapshots.

cd aegis && PENTEST_AUDIT_HMAC_KEY=$(openssl rand -hex 32) python -m pytest -q

Docs

• Release control dashboard — generated status, roadmap, architecture, evidence, and warnings
• Canonical project control — claim-versus-code matrix and supported boundary
• Evidence-gated roadmap · decisions · runbook
• aegis/docs/AGENTIC_ROADMAP.md — the agentic design and module map
• aegis/BUILD_AND_TEST_LOG.md — full build + live-validation record
• aegis/SECURITY.md — the strict posture contract
• Live page: the animated architecture guide is served at /architecture by the web console

---

_{Argus · authorized internal security testing only · the agent proposes, the guardrail disposes}