ArgusRed – Security Scan and Pen Test CLI

TL;DR

TL;DR: ArgusRed is an AI-powered CLI that switches between read-only Security Scan and gated Pen Test modes, running actual exploits against systems you authorize so developers get actionable finding reports rather than generic SAST output.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: argusred.com
• Source repository: github.com/CosineAI/argusred-dist (public release artifacts; source is private)
• License: Proprietary (free tier with token limits; no open-source license listed)
• HN launch thread: news.ycombinator.com/item?id=48609231
• Source last checked: 2026-06-28

What Is ArgusRed?

ArgusRed is a CLI security tool from CosineAI that uses a post-trained model to perform penetration testing against your own infrastructure. Unlike mainstream LLMs that refuse offensive security tasks, ArgusRed was specifically fine-tuned to attempt real exploits rather than describe them hypothetically.

The tool ships two distinct modes:

• Security Scan — read-only static analysis. Scans your codebase for vulnerability patterns, hardcoded secrets, SQL injection vectors, XSS entry points, and more.
• Pen Test — active exploitation against systems you explicitly authorize. You pick the modules, set agent permissions, optionally enable exploit verification, and ArgusRed attempts real attacks to confirm findings.

The core problem it solves: most AI security tools are SAST wrappers that output theoretical vulnerability descriptions. ArgusRed closes the loop by validating findings through live exploitation in a sandboxed environment.

Setup Workflow

Step 1: Install

macOS and Linux are supported. Windows is on the roadmap.

# Via Homebrew
brew install CosineAI/argusred/argusred

# Or via the install script
curl -fsSL https://argusred.com/install | sh

Step 2: First Run and Authentication

On first run, ArgusRed opens a browser window for CosineAI account creation. New accounts receive 2M free tokens.

cd /path/to/your/repo
argusred

Step 3: Select Scan Mode

When the scan starts, you are prompted to pick:

• Security Scan — read-only, no further gating
• Pen Test — choose modules, set permissions, optionally enable exploit verification

Step 4: Configure Scope

Pen Test mode lets you toggle individual security modules:

Dependency Vulnerability Analysis         [toggle]
Secret & Credential Detection             [toggle]
SQL Injection / XSS Vectors               [toggle]
Authentication & Session Flows            [toggle]
Input Validation & Sanitisation           [toggle]
CORS & CSP Misconfigurations              [toggle]
Cryptographic Weakness                    [toggle]
File Permission & Access Controls         [toggle]

Agent permissions control what ArgusRed can do during active testing:

• Terminal Access — enabled or sandboxed
• Network Requests — sandboxed or unrestricted
• File Write — sandboxed or disabled
• Exploit Verification — attempts safe reproduction of reported findings

Step 5: Review the Report

Output is a markdown report with location, severity, cause, and fix direction for every finding.

Deeper Analysis

Why Post-Training Matters

Anthropic and OpenAI explicitly guardrail their publicly available models against offensive security tasks. Their cyber-focused models exist only for enterprise customers. This leaves small and mid-market teams without access to capable AI penetration testing.

ArgusRed addresses this gap by using a model that was post-trained specifically for pen testing workflows. The distinction matters: a general-purpose LLM that tells you “this code might be vulnerable to SQL injection” is a SAST wrapper. A post-trained model that actually attempts the injection and reports what happened is a different class of tool.

Gated Access Design

Pen Test mode is gated by design. You must explicitly authorize the target systems, pick the modules, and set permissions. This is not a “point at any domain and fire” tool — it is meant for testing your own infrastructure where you have explicit authorization to probe.

Exploit Verification

The exploit verification option attempts safe reproduction of each finding. Rather than trusting the initial report, ArgusRed re-runs the attack in a controlled way to confirm the vulnerability is real before including it in the final markdown output. This reduces false positives from generic SAST-style scanning.

Token-Based Pricing

Free tier includes 2M tokens on signup. After that, usage is billed against your CosineAI account. No per-scan flat fee — it is consumption-based.

Practical Evaluation Checklist

• [ ] Installed on macOS (brew or install script)
• [ ] Ran first scan against a test repository
• [ ] Toggled Pen Test mode and reviewed module scope options
• [ ] Enabled exploit verification and compared report against baseline Security Scan
• [ ] Verified markdown report readability and actionability
• [ ] Checked that agent permission settings behave as documented
• [ ] Confirmed token consumption tracking in the Cosine dashboard

Security Notes

• Authorization scope — Pen Test mode only runs against systems you explicitly target. Running it against systems you do not own or lack authorization to test may violate applicable law.
• Sandboxing — Network and file write access are independently toggleable. Keep them sandboxed unless you specifically need unrestricted access for a given test.
• No exfiltration by design — The tool does not send code or findings to third parties beyond the CosineAI token billing infrastructure.
• Self-hosted dist repo — Release binaries are distributed via a public GitHub repository with SHA-256 checksum verification in the installer.

FAQ

Q: Is ArgusRed open source? A: No. The release artifacts are distributed publicly (github.com/CosineAI/argusred-dist) but the model and core source are proprietary. There is no open-source license.

Q: How is this different from standard SAST tools like Semgrep or CodeQL? A: SAST tools match code against static vulnerability patterns. ArgusRed’s Pen Test mode actively attempts exploits against running systems to confirm findings. Security Scan mode is closer to SAST, but the Pen Test mode is the differentiator.

Q: Does it work on Windows? A: Windows support is listed as “coming soon” on the project page. Currently only macOS and Linux are supported.

Q: How many free tokens do I get? A: New accounts receive 2M free tokens. After that, usage is billed against your CosineAI account on a consumption basis.

Q: What language models does ArgusRed use? A: The HN launch thread mentions that general-purpose models are guard-railed and cyber-focused models are enterprise-gated. ArgusRed uses a post-trained model specifically for pen testing. The exact base model and training approach are not publicly documented beyond what is on the HN thread.

Q: Can I run ArgusRed in CI/CD pipelines? A: The CLI runs locally against a target repository. There is no documented CI/CD integration as of June 2026, but the install script approach suggests it can be embedded in build scripts with an existing CosineAI token.

Conclusion

ArgusRed fills a real gap: AI-powered penetration testing without enterprise-only model access. The combination of read-only Security Scan and gated Pen Test in a single CLI, backed by a 2M-token free tier, makes it accessible to individual developers and small teams who need actionable vulnerability reports rather than theoretical findings.

The self-serve onboarding, clear markdown output, and independently toggleable sandbox controls are practical touches that make the tool usable without a dedicated red team background. If you have been looking for an AI agent that actually attempts exploits rather than describing them, ArgusRed is worth a first scan.