Argus Instinct Get Argus
00Argus Instinct Local security monitor · Windows PCs and Linux servers

Know what runson your machine.

Agents, package scripts and servers run code with your credentials. Argus watches the machine, keeps the evidence on it, and says plainly what it cannot see.

Download Pricing · $79 desktop · $50 server
  • 01Observesprocesses, autostarts, accounts
  • 02Recordsevidence stays on the machine
  • 03Asksbefore anything bigger than undo
  • 04Admitswhat it cannot see

01 Monitoring

A timeline,
not a verdict.

Processes, autostarts, accounts, network activity, sensors and firewall state are observed and joined into one timeline, so every change has a before and an after. What is recorded comes first; what responds to it comes second.

  • Evidence before response
  • Absence is logged as not observed, never as fixed
  • Public threat feeds can only add suspicion, never clear it
argus timeline --since 1hobserving
  1. observednode · spawned by code in ~/work/api
  2. observedpostinstall script ran curl to an unseen host
  3. flaggednew autostart: ~/.config/systemd/user/upd.service
  4. asked youdisable it? reversible · undo kept in the ledger
  5. observedssh login from a network not seen before
  6. cannot seekernel-level hiding needs the optional sensor

Example of the timeline format. Every line keeps its evidence.

Watching is not
the same as trusting.

02 Processes

What runs,
and why it runs.

Argus shows what runs because you opened an editor, a repository or a shell, which is exactly where a coding agent works. Follow a branch down and you see who started what.

  1. shell → editor → node the tree as it was started
  2. npm → postinstall a script reaches for a host never seen
  3. flagged the reticle settles on it, with the evidence
  4. held the connection waits for you; undo is kept

Ask it a question

Each audit answers
one plain question.

No dashboard to decode. You ask, it answers with the evidence behind it, and with what it could not check.

argus spy
Is anything monitoring me? Who used the microphone or camera?
argus hidden
Is anything hiding from the normal process list?
argus toolchain
What runs because I opened an editor, a repo or a shell?
argus secrets
Which credentials are sitting in plain text on this disk?
argus evasion
Is anything in a position to lie to these checks?
argus gaps
What attacker tradecraft do I not cover yet?

03 Data protection

Your data stays
where it is.

Argus finds credentials sitting in plain text on the disk and shows you where they are. Its own findings stay on the machine: the dashboard listens only locally and there is no telemetry.

  1. scan passes down through the disk
  2. found SSH keys, tokens and passwords left in plain text, lifted out so you can see them
  3. contained nothing crosses the boundary: no telemetry, findings stay local

How it responds

Watch, ask, propose, act.

  1. 01

    Observe

    Processes, autostarts, accounts, network activity, sensors and firewall state.

  2. 02

    Correlate

    Events are joined into a timeline so a change has a before and an after.

  3. 03

    Explain

    Findings come with the evidence behind them and with what could not be seen.

  4. 04

    Respond

    Reversible containment only when you switch it on. Anything more waits for you.

0audits on a Windows + WSL2 PC
0audits on a plain Linux server
0bytes of telemetry by default

04 The server edition

On Linux, it runs as its own unprivileged account.

Read-only capabilities, systemd units, nothing to configure to start. It audits SSH keys and configuration, sudo rules, systemd units, cron, password-guessing in the auth log, web shells in document roots, container exposure and kernel-level hiding.

Any systemd distribution
curl -fsSLO https://www.archymedes.xyz/downloads/argus/argus-server-linux-x86_64.tar.gz
tar -xzf argus-server-linux-x86_64.tar.gz
sudo ./argus-server/install.sh

Signed releases. Verify the download against SHA256SUMS first.

Get Argus

Two editions, one name.

Desktop

Windows 10 and 11 with WSL2

Audits the Windows host and the WSL2 side, and names its own blind spots.

Download for Windows

Server

Linux servers with systemd

A .deb for Debian and Ubuntu, or a tar.gz for any systemd distribution.

Download for Linux

Pricing

Two plans.
One year at a time.

Desktop

$79per year

Windows, Linux and other desktop systems.

Get Desktop

Server

$50per server, per year

Linux servers with systemd.

Get Server

Pay by card (Stripe) or mobile money (Paypack). Argus never sees your payment details.

Questions

Said plainly, up front.

Does Argus send my data anywhere?

No telemetry. Findings stay on the machine and the dashboard listens only locally. Argus fetches public threat feeds and timestamps, and nothing fetched is ever executed.

Which systems does it run on?

Windows 10 and 11 (64-bit) with WSL2, and Linux servers with systemd.

What does it cost?

Argus Desktop is $79 per year. Argus Server is $50 per server, per year. Pay by card (Stripe) or mobile money (Paypack).

Does it replace endpoint security?

No. It is not a replacement for enterprise endpoint security. Someone with full administrator or kernel control can falsify what any local tool sees, and Argus says so instead of hiding it.

What can it not see?

It compares current attacker techniques with what its own sensors cover and reports the gaps as a work list: argus gaps.