开源安全运营平台：让 AI Agent 承担繁重工作，一切仍在你的掌控之中。

Argus 持续监控你的云环境、身份体系、代码库、终端设备、网络及 Kubernetes。它能以机器速度捕获攻击，利用 AI Agent 开展调查，并在数秒内实施遏制。平台中的每项动作均强类型化、符合策略校验、先空运行（dry-run）验证且完全可逆。它采用自托管、多租户设计并基于 MIT 协议开源，确保你的安全数据永不外流。

在攻击发生时立即阻断，无需等到次日清晨。 自主响应剧本在触发检测的瞬间即可采取行动：在 Cloudflare 侧封锁攻击者、通过 CrowdStrike 或 SentinelOne 切断受害笔记本的网络连接等——提供包含 27 种类型化操作的目录。动作默认以影子模式（shadow mode）运行，便于观察预期效果；所有操作仅限可逆动作，受到每小时调用上限及爆炸半径限制，且除非人工确认保留，否则将自动回滚。

Slack 一键审批。 直接在告警通知中完成批准、拒绝或回滚操作，无需打开控制台，零上下文切换。

专注调查而不擅自接管的 AI。 7 个专职 Agent 利用只读工具完成告警分流、事件调查与威胁狩猎。它们可以提出修复方案，但绝无权直接执行。AI 读取的所有内容均被视作不可信数据，因此隐藏在日志中的 Prompt 注入（提示词注入）只会转化为攻击检测信号，而无法劫持 Agent。

洞悉企业内部实际使用的每一款 AI 工具。 AI 网关将所有通往 OpenAI 与 Anthropic 的流量置于企业受控密钥、模型白名单、数据防泄漏（DLP）、Prompt 注入检测与预算管控之下。Shadow-AI（影子 AI）发现功能则结合网络、云端与 SSO 遥测数据，挖掘未经审批的 AI 外部服务。

当场捕获恶意 AI Agent。 部署专为 AI Agent 量身定制的金丝雀陷阱（蜜罐）：植入 Prompt 注入、伪造 Agent 规则文件、虚假 MCP 服务器以及伪造的 LLM API 密钥。任何咬钩的 Agent 都会触发警报，其 IP 地址、所用模型及 Prompt 均会被完整记录。

在黑客利用前验证防御检测能力。 Agent 级攻击模拟器可在隔离沙箱租户中复现 8 种 AI 驱动的攻击场景（含可选的规避变体），并精准输出已拦截项、漏报项及未启用的检测规则。

持续渗透测试，告别一年一次的被动走过场。 Autopilot 机制支持红队 Agent 自主规划测试，在经过作用域校验的测试靶架中执行，并基于实测发现动态调整方案。该流程仅在人工明确授权无人值守测试的作用域内运行。

即时修复攻击者当前正在利用的漏洞。 每个关联 CVE 的发现项都会自动富化 CISA 已知利用漏洞清单（KEV）与 EPSS 利用概率评分，并自动上调危险等级。支持离线运行，满足离线断网（air-gapped）环境需求。

开箱即用满足合规审计。 基于哈希链与签名的审计流水记录每一项操作、审批以及 Agent 决策步骤，并实时镜像备份至 S3 Object Lock 或 Azure 不可变存储。内置 SOC 2、NIST 800-171 与 ISO 27001 控制项映射。

随处运行，全面适配现有架构。 提供用于测试评估的 Docker Compose，适用于 Kubernetes 的 Helm Chart，以及面向 AWS 和 Azure 的 Terraform 模块。所有自主响应功能默认关闭，自主权大小完全由你的信任度决定。

本 README 介绍了当前仓库的功能实现。设计细节见 docs/ARCHITECTURE.md；已实现功能与未来规划见 docs/ROADMAP.md。

Argus 定位于开源基础底座，旨在供社区 Fork 并二次开发拓展。平台核心（租户隔离、认证、RBAC、审计链、任务队列、策略与审批）在 CI 中已在 SQLite 和 PostgreSQL 上通过端到端测试。在启用任何主动处置操作之前，请根据实际资产环境调优采集器与检测规则，并建议先在纯监控模式下运行（详见 docs/GO-LIVE.md）。本项目非第三方认证合规产品，具体合规支持边界请参阅 docs/COMPLIANCE.md。

text Browser / SDK / sensors | v HTTPS (Caddy, ALB, Front Door or your ingress) +-------------------------------------------------------------+ | API (FastAPI) auth: session / OIDC+PKCE / TOTP / API keys | | RBAC (viewer < analyst < operator < admin < owner), CSRF, | | per-principal rate limits, request ids, security headers | +------+------------------+------------------+----------------+ | | | PostgreSQL Redis queue Audit chain (tenant_id on (leases, retries, (hash-linked per tenant, every table) python -m HMAC, JSONL / S3 Object app.worker) Lock / Azure immutable) | | +------+------------------+----------------------------------+ | Worker processes run the same handlers as the API: | | collectors.run detections.run / baselines | | graph.recompute testing.run agents.run | | autoresponse.evaluate testing.autopilot | | simulation.run intel.enrich / refresh ai.discover | +------------------------------------------------------------+ | v agents call propose_action only -> ActionRequest(pending) Action broker (separate policy, approvals, dry run, rollback, kill switch)

信任边界（各一句话总结，详情见 docs/THREAT-MODEL.md）：

1. Agent 无法直接执行任何动作；其唯一的写入工具仅能创建待办请求（pending request）。自主响应只能经由 Broker 代理以系统主体身份运行，且限定为具备上限与自动回滚机制的可逆非关键动作。
2. Agent 读取的所有输入均被封装为不可信数据，并在 Prompt 中明确声明。
3. 主动测试仅在已记录的授权与明确作用域内执行，并在运行时重新校验。
4. 每个领域数据表均包含 tenant_id；所有查询统一经由带作用域的辅助函数执行；测试套件强制断言校验。
5. 审计链通过哈希关联、HMAC 签名（生产环境强制要求），并镜像备份到外部存储（可选 WORM 一写多读存储）。

领域模块	状态	对应路径
App 工厂、配置、DB、RBAC、认证（本地、OIDC、TOTP、API 密钥）、CSRF、速率限制	已实现，已测试	app/core/, app/api/auth.py, app/api/deps.py
带 JSONL / S3 Object Lock / Azure 不可变 blob 转储的审计链	已实现	app/core/audit.py
任务队列（内存与 Redis、租约、重试、取消、清理器）与独立 Worker	已实现	app/core/queue.py, app/worker.py
Prometheus 指标、JSON 日志、可选的 OpenTelemetry 链路追踪	已实现	app/core/telemetry.py
证据图谱：节点、边、攻击路径、暴露面评分	已实现	app/graph/, app/api/graph.py
检测引擎：13 条规则（群体/swarm x4、身份 x2、云、k8s、代码、金丝雀、异常、Agent 行为、未授权 AI 服务）、基线、金丝雀（12 种类型，其中 4 种针对 AI Agent：植入 Prompt 注入、Agent 规则文件、伪造 MCP 服务、伪造 LLM 密钥）	已实现	app/detections/, app/api/detections.py, app/api/canaries.py
采集器：AWS、Azure、GCP、Kubernetes、GitHub、Okta、Entra、osquery、netflow	已通过测试数据（fixtures）实现；云厂商 SDK 为可选依赖	app/collectors/, app/api/collectors.py
测试框架：作用域策略、速率限制、适配器（Web 基线、trivy、nuclei、zap、prowler、caldera、semgrep、gitleaks）	已实现；对应工具需独立安装	app/testing/, app/api/tests.py, app/api/scans.py
Agent 运行时、提供商适配（Anthropic、OpenAI、Ollama、none）、只读工具、7 个专职 Agent、评估套件	已实现	app/agents/, app/api/agents.py, app/api/evals.py
动作代理（Action Broker）：27 种类型化动作目录（AWS、Azure、GCP、Kubernetes、GitHub、Okta、Entra、Cloudflare、CrowdStrike、SentinelOne、Argus 内部），支持策略管控、审批、空运行、执行、回滚与紧急制动（kill switch）	已实现	app/actions/, app/api/actions.py
自主响应：无需人工介入根据检测直接触发的响应剧本（优先影子模式、仅限可逆动作、配额限制、自动回滚）；Slack 批准 / 拒绝 / 回滚按钮	已实现；默认关闭	app/actions/autoresponse.py, app/api/autoresponse.py, app/api/slack.py, docs/AUTONOMOUS-RESPONSE.md
AI 网关（受控的 OpenAI / Anthropic 代理：企业统管密钥、模型白名单、DLP、Prompt 注入标记、预算、使用日志）与基于网络、云和 SSO 遥测的 Shadow-AI 发现	已实现；网关默认关闭	app/ai/, app/api/ai_gateway.py, app/api/ai_inventory.py, docs/AI-GATEWAY.md
自主渗透测试：由红队规划 Agent 生成的计划在经过范围校验的测试框架中运行，并根据测试结果重新规划	已实现；默认关闭，按租户与范围选择性开启（opt-in）	app/testing/autopilot.py, app/api/autopilot.py, docs/AUTOPENTEST.md
威胁情报：自动集成 CISA KEV 与 EPSS 对发现项富化，支持离线缓存	已实现	app/intel/, app/api/intel.py, docs/INTEL.md
Agent 级攻击模拟器：在隔离沙箱租户中复现 8 种由 Agent 驱动的攻击场景，提供覆盖率报告与规避变体	已实现	app/simulator/, app/api/simulations.py, docs/SIMULATOR.md
集成生态：POST /api/v1/ingest/{source} 支持的 13 种入站解析器，6 种出站通知渠道（Webhook、Slack、Jira、ServiceNow、PagerDuty、邮件）带投递与重试机制，Wazuh indexer 拉取支持	已实现	app/integrations/, app/api/ingest.py, app/api/integrations.py
路由管理：Admin、资产、发现项、事件、调查、审批、审计、报告路由器	已实现	app/api/
Alembic 数据迁移（4 个版本演进，涵盖自主化与 AI 安全）及 scripts/migrate.py	已实现	alembic/, docs/MIGRATIONS.md
容器、Compose、Helm、Terraform（AWS、Azure）、CI、可观测性及文档	已实现	Dockerfile, compose*.yaml, infra/, .github/, docs/

路由具备自动发现机制。完整的 v1 API 规范参见 docs/API.md。

快速上手（开发环境，SQLite，无需 Docker）

环境依赖：Python 3.11 或 3.12。

bash python -m venv .venv && . .venv/bin/activate # Windows 环境下执行: .venv\Scripts\activate pip install -r requirements.txt -r requirements-dev.txt cp .env.example .env python scripts/generate_secrets.py --write # 填充三个 REPLACE_ 变量，并在为空时自动生成 AUDIT_SIGNING_KEY 与 DATA_ENCRYPTION_KEY uvicorn app.main:app --host 127.0.0.1 --port 8080

打开浏览器访问 http://127.0.0.1:8080，并使用 .env 中配置的 ADMIN_EMAIL / ADMIN_PASSWORD 登录。当 REDIS_URL 为空时，任务将在 API 进程内部执行（WORKERS_INPROCESS=true）。当 DB_AUTO_CREATE=true（默认值）时，系统启动时将自动建表；如需使用 Alembic 管理数据库 schema，请将其设为 false 并执行 python scripts/migrate.py（参考 docs/MIGRATIONS.md）。

在隔离租户中生成模拟演示数据（绝不访问外部网络）：

bash python scripts/seed_demo.py

该脚本将打印 demo 租户的登录信息，并创建标记为 DEMO 的资产、授权、能触发 cloud.public_exposure_change 与 swarm.machine_speed_sequence 的事件、发现项、金丝雀以及 Agent 运行记录。在 APP_ENV=production 环境下该脚本会拒绝执行。

测试：

试用部署（Docker Compose：API、Worker、PostgreSQL、Redis）

bash cp .env.example .env && python scripts/generate_secrets.py --write docker compose up --build -d docker compose logs -f api

compose.yaml 默认仅将 API 绑定至 127.0.0.1:8080，API 与 Worker 共享同一镜像运行，采用只读根文件系统、剥离 Linux capabilities 权限、禁止挂载 Docker socket，将 ./targets 以只读方式挂载，并在 API 启动时自动应用数据库迁移（RUN_MIGRATIONS=true）。添加 --profile observability 参数可启用 OpenTelemetry 收集器、Prometheus（抓取 /metrics）以及预装 infra/grafana/argus.json 仪表盘的 Grafana。

单主机 TLS 证书终止配置：

bash

.env 配置示例: APP_ENV=production COOKIE_SECURE=true BASE_URL=https://host ARGUS_DOMAIN=host ACME_EMAIL=ops@example.com

docker compose -f compose.yaml -f compose.prod.yaml up -d

Kubernetes 部署参考：infra/helm/argus（包含 API 与 Worker Deployment、HPA、PDB、默认拒绝的 NetworkPolicy、带 TLS 的 Ingress、可选的 ServiceMonitor）。AWS 部署参考：infra/terraform（ECS Fargate、RDS、ElastiCache、S3 Object Lock 审计桶、Secrets Manager、ALB + WAF）。Azure 部署参考：infra/terraform-azure（Container Apps、Flexible Postgres、Azure Cache、不可变 blob 容器、Key Vault、Front Door + WAF）。

生产环境上线核对清单见 docs/DEPLOYMENT.md。核心要点概括如下（系统启动时通过 assert_safe_config() 进行部分强制校验）：

• 在 APP_ENV=production 模式下，若缺少 PostgreSQL、REDIS_URL、COOKIE_SECURE=true、https:// 前缀的 BASE_URL、DATA_ENCRYPTION_KEY(S)、AUDIT_SIGNING_KEY(S)、外部审计转储目标，或未配置 OIDC / TOTP_REQUIRED=true 之一，系统将拒绝启动。
• 必须使用独立 Worker 进程（WORKERS_INPROCESS=false, python -m app.worker）。
• 必须配置对象锁定审计存储槽（S3 Object Lock 或 Azure 不可变 blob），不能仅依赖 JSONL。
• 边缘网络阻断 /metrics 访问；Worker 开启出站网络流量过滤；敏感配置统一存放于凭据管理器。
• 容器镜像严格绑定 digest 哈希并通过 cosign 完成签名校验（.github/workflows/release.yml）。

角色权限呈层级累加（app/core/rbac.py）：

角色	增量权限
viewer	租户内所有资源的只读权限，包括自动响应剧本和 AI 资产清单
analyst	编辑发现项与检测规则，运行 Agent 及评估套件，管理金丝雀，记录审批，使用 AI 网关
operator	管理与授权资产，运行测试、扫描、Autopilot 与采集器，发起、审批、执行与回滚动作，运行检测与模拟
admin	用户管理、

The open-source security operations platform where AI agents do the legwork and you stay in control.

Argus watches your cloud, identity, code, endpoints, network and Kubernetes. It catches attacks at machine speed, investigates them with AI agents, and contains them in seconds. Every action is typed, checked against policy, dry-run first and reversible. It is self-hosted, multi-tenant and MIT licensed, so your security data never leaves your hands.

Stop attacks while they are happening, not the next morning. Autonomous response playbooks act the moment a detection fires: block an attacker at Cloudflare, cut a laptop off the network through CrowdStrike or SentinelOne, and more from a catalog of 27 typed actions. They start in shadow mode so you can see what they would do, use only reversible actions, stay within hourly and blast-radius caps, and roll themselves back unless you keep the change.

Approve from Slack in one click. Approve, deny or roll back actions straight from the alert. No console, no context switch.

AI that investigates without taking the wheel. Seven specialist agents triage, investigate and hunt using read-only tools. They can propose a fix but never execute one. Everything they read is treated as untrusted data, so a prompt injection hidden in a log becomes a signal instead of a hijack.

See every AI tool your company is really using. The AI gateway puts OpenAI and Anthropic traffic behind org-held keys, model allowlists, data-loss prevention, prompt-injection flags and budgets. Shadow-AI discovery finds the services people use without approval, using your network, cloud and SSO telemetry.

Catch rogue AI agents in the act. Plant canaries built for agents: hidden prompt injections, agent rules files, a fake MCP server and fake LLM API keys. Any agent that takes the bait trips a detection, with its IP, model and prompt recorded.

Prove your detections work before an attacker tests them. The agentic attack simulator replays 8 AI-driven attack scenarios in an isolated sandbox tenant, with optional evasion variants, and reports exactly which ones you caught, which you missed and which rules were off.

Pentest continuously, not once a year. Autopilot has the red-team agent plan tests, runs them through the scope-checked harness, and re-plans from what it finds. It only runs inside scopes a human has marked for unattended testing.

Fix what attackers are exploiting right now. Every finding with a CVE is enriched with CISA's Known Exploited Vulnerabilities list and EPSS exploit-probability scores, and severity is raised automatically. It works offline for air-gapped installs.

Audit-ready from day one. A hash-linked, signed audit chain records every action, approval and agent step, mirrored to S3 Object Lock or Azure immutable storage. Control mappings for SOC 2, NIST 800-171 and ISO 27001 are included.

Runs anywhere you do. Docker Compose for a pilot, Helm for Kubernetes, and Terraform for AWS and Azure. Every autonomous feature ships off by default, so you turn on exactly as much autonomy as you trust.

This README describes what is in the repository today. docs/ARCHITECTURE.md describes the design; docs/ROADMAP.md lists what is implemented versus planned.

Argus is an open-source foundation, meant to be forked and extended. The platform core (tenancy, auth, RBAC, audit chain, queue, policy and approvals) is tested end to end on SQLite and PostgreSQL in CI. Tune collectors and detection rules to your estate, and start in monitoring-only mode (docs/GO-LIVE.md) before enabling any action. It is not a certified product; see docs/COMPLIANCE.md for what it can and cannot evidence.

  Browser / SDK / sensors
          |
          v  HTTPS (Caddy, ALB, Front Door or your ingress)
  +-------------------------------------------------------------+
  |  API  (FastAPI)  auth: session / OIDC+PKCE / TOTP / API keys |
  |  RBAC (viewer < analyst < operator < admin < owner), CSRF,   |
  |  per-principal rate limits, request ids, security headers    |
  +------+------------------+------------------+----------------+
         |                  |                  |
   PostgreSQL           Redis queue        Audit chain
   (tenant_id on       (leases, retries,   (hash-linked per tenant,
    every table)        python -m          HMAC, JSONL / S3 Object
                        app.worker)        Lock / Azure immutable)
         |                  |
  +------+------------------+----------------------------------+
  |  Worker processes run the same handlers as the API:        |
  |   collectors.run   detections.run / baselines              |
  |   graph.recompute  testing.run   agents.run                |
  |   autoresponse.evaluate   testing.autopilot                |
  |   simulation.run   intel.enrich / refresh   ai.discover    |
  +------------------------------------------------------------+
         |
         v  agents call propose_action only -> ActionRequest(pending)
  Action broker (separate policy, approvals, dry run, rollback, kill switch)

Trust boundaries, in one sentence each (details in docs/THREAT-MODEL.md):

1. Agents cannot execute anything; their one write-capable tool creates a pending request. Autonomous response acts only through the broker, as the system principal, with reversible non-critical actions, caps and automatic rollback.
2. Everything an agent reads is wrapped as untrusted data and the prompt says so.
3. Active testing runs only inside a recorded authorization and scope, re-checked at run time.
4. Every domain table carries tenant_id; queries go through a scoped helper; tests assert it.
5. The audit chain is hash-linked, HMAC-signed (required in production), and mirrored to an external, optionally WORM, sink.

Area	Status	Where
App factory, settings, DB, RBAC, auth (local, OIDC, TOTP, API keys), CSRF, rate limits	implemented, tested	app/core/, app/api/auth.py, app/api/deps.py
Audit chain with JSONL / S3 Object Lock / Azure immutable blob sinks	implemented	app/core/audit.py
Job queue (in-memory and Redis, leases, retries, cancellation, reaper) and standalone worker	implemented	app/core/queue.py, app/worker.py
Prometheus metrics, JSON logging, optional OpenTelemetry tracing	implemented	app/core/telemetry.py
Evidence graph: nodes, edges, attack paths, exposure scoring	implemented	app/graph/, app/api/graph.py
Detections: 13 rules (swarm x4, identity x2, cloud, k8s, code, canary, anomaly, agentic, unsanctioned AI service), baselines, canaries (12 kinds, 4 aimed at AI agents: planted prompt injection, agent rules file, fake MCP server, fake LLM key)	implemented	app/detections/, app/api/detections.py, app/api/canaries.py
Collectors: AWS, Azure, GCP, Kubernetes, GitHub, Okta, Entra, osquery, netflow	implemented with fixtures; cloud SDKs optional	app/collectors/, app/api/collectors.py
Test harness: scope policy, rate limits, adapters for web baseline, trivy, nuclei, zap, prowler, caldera, semgrep, gitleaks	implemented; tools must be installed separately	app/testing/, app/api/tests.py, app/api/scans.py
Agent runtime, providers (Anthropic, OpenAI, Ollama, none), read-only tools, 7 specialists, eval suites	implemented	app/agents/, app/api/agents.py, app/api/evals.py
Action broker: catalog of 27 typed actions (AWS, Azure, GCP, Kubernetes, GitHub, Okta, Entra, Cloudflare, CrowdStrike, SentinelOne, Argus-internal), policy, approvals, dry run, execute, rollback, kill switch	implemented	app/actions/, app/api/actions.py
Autonomous response: playbooks that act on detections without a human (shadow mode first, reversible actions only, caps, automatic rollback); Slack approve / deny / roll back buttons	implemented; off by default	app/actions/autoresponse.py, app/api/autoresponse.py, app/api/slack.py, docs/AUTONOMOUS-RESPONSE.md
AI gateway (governed OpenAI / Anthropic proxy: org-held keys, model allowlists, DLP, prompt-injection flags, budgets, usage log) and shadow-AI discovery from network, cloud and SSO telemetry	implemented; gateway off by default	app/ai/, app/api/ai_gateway.py, app/api/ai_inventory.py, docs/AI-GATEWAY.md
Autonomous pentesting: the red-team planner's plans are run through the scope-checked harness and re-planned from results	implemented; off by default, opt-in per tenant and per scope	app/testing/autopilot.py, app/api/autopilot.py, docs/AUTOPENTEST.md
Threat intel: automatic CISA KEV and EPSS enrichment of findings, offline cache	implemented	app/intel/, app/api/intel.py, docs/INTEL.md
Agentic attack simulator: 8 agent-driven attack scenarios replayed in an isolated sandbox tenant, coverage report, evasion variants	implemented	app/simulator/, app/api/simulations.py, docs/SIMULATOR.md
Integrations: 13 inbound parsers behind POST /api/v1/ingest/{source}, 6 outbound channels (webhook, Slack, Jira, ServiceNow, PagerDuty, email) with deliveries and retries, Wazuh indexer pull	implemented	app/integrations/, app/api/ingest.py, app/api/integrations.py
Admin, assets, findings, events, investigations, approvals, audit, reports routers	implemented	app/api/
Alembic migrations (4 revisions, through autonomy and AI security) and scripts/migrate.py	implemented	alembic/, docs/MIGRATIONS.md
Containers, compose, Helm, Terraform (AWS, Azure), CI, observability, docs	implemented	Dockerfile, compose*.yaml, infra/, .github/, docs/

Routers are discovered automatically. The full v1 surface is in docs/API.md.

Quick start (development, SQLite, no Docker)

Requirements: Python 3.11 or 3.12.

python -m venv .venv && . .venv/bin/activate        # Windows: .venv\Scripts\activate
pip install -r requirements.txt -r requirements-dev.txt
cp .env.example .env
python scripts/generate_secrets.py --write          # fills the three REPLACE_ values, plus AUDIT_SIGNING_KEY and DATA_ENCRYPTION_KEY when they are empty
uvicorn app.main:app --host 127.0.0.1 --port 8080

Open http://127.0.0.1:8080 and sign in as ADMIN_EMAIL / ADMIN_PASSWORD from .env. With REDIS_URL empty, jobs run inside the API process (WORKERS_INPROCESS=true). With DB_AUTO_CREATE=true (the default) tables are created at startup; for Alembic-managed schemas set it to false and run python scripts/migrate.py (see docs/MIGRATIONS.md).

Synthetic demo data in an isolated tenant (never touches the network):

python scripts/seed_demo.py

It prints a demo tenant login and creates DEMO-labelled assets, authorizations, events that trip cloud.public_exposure_change and swarm.machine_speed_sequence, findings, a canary and an agent run record. Refuses to run when APP_ENV=production.

Tests:

Pilot (Docker Compose: API, worker, PostgreSQL, Redis)

cp .env.example .env && python scripts/generate_secrets.py --write
docker compose up --build -d
docker compose logs -f api

compose.yaml binds the API to 127.0.0.1:8080 only, runs the API and worker from one image with a read-only root filesystem, no capabilities and no Docker socket, mounts ./targets read-only, and applies the schema at API start (RUN_MIGRATIONS=true). Add --profile observability for an OpenTelemetry collector, Prometheus (scraping /metrics) and Grafana with the dashboard in infra/grafana/argus.json.

TLS termination for a single host:

# .env: APP_ENV=production COOKIE_SECURE=true BASE_URL=https://host ARGUS_DOMAIN=host ACME_EMAIL=ops@example.com
docker compose -f compose.yaml -f compose.prod.yaml up -d

Kubernetes: infra/helm/argus (API + worker deployments, HPA, PDB, default-deny NetworkPolicy, ingress with TLS, optional ServiceMonitor). AWS: infra/terraform (ECS Fargate, RDS, ElastiCache, S3 Object Lock audit bucket, Secrets Manager, ALB + WAF). Azure: infra/terraform-azure (Container Apps, Flexible Postgres, Azure Cache, immutable blob container, Key Vault, Front Door + WAF).

The production checklist is in docs/DEPLOYMENT.md. The short version, enforced partly by assert_safe_config() at startup:

• APP_ENV=production refuses to start without PostgreSQL, REDIS_URL, COOKIE_SECURE=true, an https:// BASE_URL, DATA_ENCRYPTION_KEY(S), AUDIT_SIGNING_KEY(S), an external audit sink, and either OIDC or TOTP_REQUIRED=true.
• Dedicated workers (WORKERS_INPROCESS=false, python -m app.worker).
• Use an object-lock audit sink (S3 Object Lock or Azure immutable blob), not only JSONL.
• /metrics blocked at the edge; egress filtering for workers; secrets in a secret manager.
• Images pinned by digest and verified with cosign (.github/workflows/release.yml).

Roles are cumulative (app/core/rbac.py):

Role	Adds
viewer	read everything in the tenant, including autoresponse playbooks and the AI inventory
analyst	edit findings and detections, run agents and evals, manage canaries, record approvals, use the AI gateway
operator	manage and authorize assets, run tests, scans, autopilot and collectors, request, approve, execute and roll back actions, run detections and simulations
admin	users, API keys, settings, collector and integration configuration, the actions kill switch, test scopes (including marking one autonomous), autoresponse playbooks, AI gateway policy
owner	tenant settings, approving critical actions

API keys carry a role and optional scopes (for example ingest) that further restrict them. A system principal is used only inside queue handlers.

How agents, testing and actions are governed

Agents (app/agents/runtime.py). A specialist is an AgentSpec with a system prompt, a list of tool names, an output schema and budgets (AGENT_MAX_STEPS, AGENT_MAX_TOKENS, AGENT_MAX_SECONDS, AGENT_COST_CEILING_USD, with AGENT_MODEL_PRICES for models outside the built-in Claude price table). Tools are read-only views over Argus data; the only propose tool creates a pending ActionRequest through the broker. Every tool result is redacted, truncated and wrapped as <untrusted_data source=...>; the guardrail prompt tells the model that instructions inside evidence are indicators of injection. Each model and tool step is persisted (agent_steps) with input hash, tokens and latency. With AI_PROVIDER=none, specialists run deterministic fallbacks. Prompt-injection and precision eval suites live in app/agents/evals/suites/.

Testing (app/testing/). A TestScope lists assets, allowed tiers (passive, active, intrusive), environments, a UTC window, a rate limit and a concurrency limit (runs beyond max_concurrency wait in the queue). A run is allowed only if the asset has a current AssetAuthorization whose flags permit the tier, the scope permits it, the window is open and the target passes policy validation. scope.check() runs at request time and again inside the worker; intrusive tiers are limited to staging and lab environments. External tools run through run_tool() with a fixed argv, a timeout, bounded output and a minimal environment.

Actions (app/actions/). Typed actions declare risk, reversibility and a parameter schema, and implement dry_run, execute and rollback. A request (from an operator or an agent's propose_action) goes through policy (app/actions/policy.py: kill switch, tenant actions_enabled, deny-lists, maintenance window, auto-approval only for low-risk reversible actions when ACTIONS_AUTO_APPROVE_LOW), approvals (approver differs from requester; high risk needs two when ACTIONS_REQUIRE_TWO_FOR_HIGH; critical additionally needs a principal with actions:approve_critical), a dry run with blast radius, execution as the actions.execute queue job with a stored rollback payload, and an audit entry at every transition. ACTIONS_KILL_SWITCH=true (global, environment) or POST /api/v1/actions/kill-switch (per tenant, sets actions_enabled=false) rejects every request and execution.

Autonomy (docs/AUTONOMOUS-RESPONSE.md, docs/AUTOPENTEST.md). Both autonomous features need a global switch and a tenant opt-in, and both are off by default. Autonomous response playbooks start in shadow mode (they record what they would have done), may only use reversible, non-critical actions, are capped per hour and by blast radius, roll actions back automatically unless a human keeps them, and ignore detections from the simulator. Autopilot runs only in scopes a human has marked autonomous; the red-team agent plans, and every test it proposes is re-checked by the normal scope machinery before and during execution. AUTOPENTEST_KILL_SWITCH and the actions kill switch stop each one at once.

Document	Content
docs/ARCHITECTURE.md	design: packages, interfaces, data model, API table
docs/API.md	v1 route summary with status
docs/DEPLOYMENT.md	dev, compose, Kubernetes, AWS, Azure; production checklist
docs/AUTONOMOUS-RESPONSE.md	autonomous response playbooks, safety limits, Slack buttons
docs/AUTOPENTEST.md	autonomous pentesting gates and how runs proceed
docs/AI-GATEWAY.md	AI gateway policy, DLP, budgets and shadow-AI discovery
docs/SIMULATOR.md	agentic attack simulator scenarios and coverage reports
docs/INTEL.md	CISA KEV and EPSS enrichment, caching and offline mode
docs/MIGRATIONS.md	Alembic workflow
docs/GO-LIVE.md	step-by-step production rollout in monitoring-only mode
docs/SECURITY.md	security model as implemented, reporting
docs/THREAT-MODEL.md	STRIDE per trust boundary, prompt injection, SSRF, tenancy, credentials, broker abuse, supply chain
docs/RUNBOOKS.md	incident procedures
docs/COMPLIANCE.md	SOC 2 / NIST 800-171 / ISO 27001 control mapping (evidence support, not certification)
docs/ROADMAP.md	implemented versus next
CONTRIBUTING.md	contributing guide

Please report vulnerabilities privately through GitHub's private vulnerability reporting (Security tab), not in public issues. Details in docs/SECURITY.md.

MIT for this repository. Third-party tools (nuclei, ZAP, Prowler, CALDERA, Semgrep, Gitleaks, Trivy), cloud SDKs and model providers are governed by their own licenses and terms.