ArgusJoin the waitlist
Every repo. Every vulnerability. No exceptions.
Argus deploys 5 classes of specialist AI agent — each focused on exactly one threat — against every file, in parallel, on every commit. 55 shipped features. One score. Tracked forever.
HOW-IT-WORKS / PIPELINE
Connect a repo from your SaaS Factory dashboard or invite Argus into any GitHub repository. From that moment, every push triggers a full parallel audit — automatically, without configuration.
One click for SaaS Factory products. For external repos, install the SF_READER GitHub App and paste the owner/repo. Argus gets read-only access — nothing else.
Argus pulls the entire git tree, decomposes it into individual files and token-safe chunks, and stages each one for parallel interrogation. Large files are automatically windowed to fit each agent's context budget.
Every enabled agent runs simultaneously against its relevant files. The SQL Injection agent has thought about nothing but SQL injection its entire existence. Ditto for secrets, SSRF, auth bypass, and every other class in the roster.
A single 0–100 security score is computed from open findings weighted by severity. It updates on every commit. Fixed code raises the score automatically — no human triage required to close findings that disappear.
AGENT-ROSTER / SPECIALIST DEPTH
No generalist scanner. Every agent is a single-purpose specialist that has interrogated nothing but its assigned threat class. The roster grows as new vulnerability classes emerge — existing agents are never diluted.
SQL Injection Parameter parsing, ORM escape bypass, second-order injection across every query path.
Hardcoded Secrets API keys, tokens, private keys, and credentials committed directly into source.
SSRF Outbound requests constructed from user-controlled data — cloud metadata endpoints, internal networks.
Auth Bypass & IDOR Missing role checks, broken object-level access, JWT algorithm confusion.
Weak Cryptography MD5/SHA-1 digests, ECB mode, insufficient entropy, predictable seeds.
XSS & Prototype Pollution Unsanitised DOM writes, reflected inputs, prototype chain manipulation.
Command & Path Injection Shell exec with user input, directory traversal past intended roots.
Insecure CORS & CSRF Wildcard origins on credentialed endpoints, missing CSRF tokens on state-changing routes.
NoSQL & LDAP Injection MongoDB operator injection, LDAP filter manipulation through unescaped input.
Composite Exploit Chains A final Opus-tier pass reviews top findings to identify multi-step attack chains linking individual vulnerabilities.
SCORE-TIMELINE / PER-COMMIT
Every commit computes a fresh score. Fix a vulnerability and the score rises automatically — Argus detects the absence of a finding as confidently as it detects its presence. The full commit timeline is preserved, so regressions are immediately visible.
Score weighted by severity — critical findings cost more than medium ones
Tune severity weights per organisation without code changes
Critical findings trigger instant email notifications to configured recipients
Export PDF audit reports for compliance or handover
POWERED BY / ANTHROPIC CLAUDE
Every audit agent runs on Anthropic Claude — exclusively. Fast agents use Claude Sonnet. Deep-reasoning agents (SSRF, auth bypass, business logic, composite chains) use Claude Opus. No other model provider touches your code.
Secrets, XSS, SQL injection, and other high-signal pattern agents run on Sonnet — high throughput, low latency, cost-efficient across large file batches.
SSRF, auth bypass, race conditions, and the composite exploit-chain pass run on Opus — where multi-step reasoning across business logic catches what pattern matching misses.
Every agent response is Zod-validated against a structured schema before being written to the database — severity, CWE, evidence, line range, and remediation are mandatory typed fields.
FAQ / COMMON QUESTIONS
Join the waitlist. Every repo you ship will roll off the line already audited — every commit, every vulnerability class, forever.
Questions? Email us at support-argus-sf-core@saas-factory.ai
CAPABILITIES / WHAT SHIPS
From the moment you link a repo, every capability below is active. Nothing to configure, no agents to write.
Query across every finding's title, description, and file path. Find 'all SQL injection in /api/admin' in milliseconds.
Every finding is normalised to a CWE ID. Severity is inferred when an agent omits it — consistent scoring across agents.
The same vulnerability across 47 commits appears as one tracked finding — not 47 noisy duplicates.
Generate branded PDF audit reports for compliance. Export filtered findings to .xlsx for Jira or Linear import.
Disable irrelevant agents per organisation. Add policy-specific prompt instructions without touching code.
Email notifications fire immediately when a new critical finding lands. Configure recipients and severity thresholds per repo.
TRIAGE / FINDINGS MANAGEMENT
Mark findings as suppressed, false positive, or fixed — each action requires a reason logged to the audit trail. Suppressed and false-positive findings are excluded from score computation. When a fix ships, the score rises on the next commit automatically.
Virtualized findings list handles 1,000+ findings without lag
Filter by severity, agent, file path, and status
Syntax-highlighted code snippet with vulnerable line range
Claude-generated remediation rendered inline
COVERAGE / REPO CONTROL
Branch-level audit control — track release/* alongside main
Monthly budget cap with auto-pause and notification
Per-audit token and cost telemetry in the settings dashboard
Manual re-audit trigger without waiting for next push
