argus

mcp
Guvenlik Denetimi
Basarisiz
Health Gecti
  • License — License: MIT
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Community trust — 11 GitHub stars
Code Basarisiz
  • child_process — Shell command execution capability in npm/install.js
  • execSync — Synchronous shell command execution in npm/install.js
  • fs.rmSync — Destructive file system operation in npm/install.js
  • fs module — File system access in npm/install.js
Permissions Gecti
  • Permissions — No dangerous permissions requested
Purpose
This is a local-first, AI-powered code review platform designed to act as an independent reviewer for your coding agents. It analyzes your codebase using structural mapping, git history, and semantic search to provide contextual feedback on diffs and pull requests.

Security Assessment
Overall Risk: Medium. The core application is written in Rust and does not request dangerous system permissions. However, the Node.js installer script (`npm/install.js`) poses a supply-chain risk. The automated scans detected synchronous shell command execution, child process spawning, and destructive file system operations (`fs.rmSync`) within this script. While these are standard for downloading and setting up native binaries via `npx`, developers should inspect the script before running it. The tool requires outbound network requests to LLM APIs (OpenAI, Anthropic, or Gemini) and needs an API key to function. Ensure your API keys are stored securely as environment variables and never hardcommit them to your repository.

Quality Assessment
The project is in active development, with its most recent updates pushed today. It is distributed under the permissive and standard MIT license. The developer community footprint is currently very small, sitting at 11 GitHub stars, which indicates limited production battle-testing and minimal external oversight. The documentation is excellent, providing clear installation instructions and multiple setup pathways (Homebrew, Cargo, npm).

Verdict
Use with caution: the underlying tool is safe and well-documented, but you should review the `npm/install.js` script before executing it due to its file system and shell execution privileges.
SUMMARY

AI code review that actually understands your codebase. Self-hosted, local-first, low-noise.

README.md

Argus

Your coding agent shouldn't grade its own homework.

CI
crates.io
npm version
License: MIT
GitHub stars

Argus is a local-first AI code review platform for teams that want an independent reviewer, not a model grading its own output. It combines structural analysis, semantic search, git history intelligence, and LLM-powered review so comments are grounded in the full codebase instead of just the patch.

The short version is simple: your coding agent should not grade its own homework.

git diff HEAD~1 | npx argus-ai review --repo .

Live page: merup.me/argus

Why Argus?

  • Independent review — your AI agent wrote the code, a different AI reviews it. No self-grading.
  • Full codebase context — reviews use structural maps, semantic search, git history, and cross-file analysis. Not just the diff.
  • Zero lock-in — works with OpenAI, Anthropic, or Gemini. Switch providers in one line. Gemini free tier = zero cost.
  • One binary, nine tools — map, diff, search, history, review, describe, feedback, doctor, MCP server. Composable Unix-style subcommands.

Get Started in 60 Seconds

# 1. Install via npm
npx argus-ai init          # creates .argus.toml

# 2. Set your key (Gemini, Anthropic, or OpenAI)
export GEMINI_API_KEY="your-key"

# 3. Review your changes
git diff HEAD~1 | npx argus-ai review --repo .

Install

Homebrew (macOS/Linux)

brew tap Meru143/argus
brew install argus

npm (Recommended)

npx argus-ai --help
# or
npm install -g argus-ai

Cargo

cargo install argus-ai

From Source

cargo install --path .

Subcommands

review — AI Code Review

Run a context-aware review on any diff or PR.

# Review local changes
git diff main | argus review --repo .

# Review a GitHub PR (posts comments back to GitHub)
argus review --pr owner/repo#42 --post-comments

describe — PR Descriptions

Generate structured, conventional-commit PR descriptions from your changes.

# Generate description for staged changes
argus describe

# Generate for a specific PR
argus describe --pr owner/repo#42

feedback — Improve Reviews

Rate comments from your last review to train Argus on your preferences.

# Start interactive feedback session
argus feedback

map — Codebase Structure

Generate a ranked map of your codebase structure (tree-sitter + PageRank).

argus map --path . --max-tokens 2048

search — Semantic Search

Hybrid code search using embeddings (Voyage/Gemini/OpenAI) + keywords.

argus search "auth middleware" --path . --limit 5

history — Git Intelligence

Detect hotspots, temporal coupling, and bus factor risks.

argus history --path . --analysis hotspots --since 90

diff — Risk Scoring

Analyze diffs for risk based on size, complexity, and diffusion.

git diff | argus diff

mcp — MCP Server

Connect Argus to Cursor, Windsurf, or Claude Code.

argus mcp --path /absolute/path/to/repo

doctor — Diagnostics

Check your environment, API keys, and configuration.

argus doctor

GitHub Action

Add automated reviews to your PRs:

name: Argus Review
on: [pull_request]
permissions:
  pull-requests: write
  contents: read
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - name: Install Argus
        run: npm install -g argus-ai
      - name: Run Review
        env:
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          argus-ai review \
            --diff origin/${{ github.base_ref }}..HEAD \
            --pr ${{ github.repository }}#${{ github.event.pull_request.number }} \
            --post-comments \
            --fail-on bug

MCP Setup

Claude Code

Add to ~/.mcp.json or project .mcp.json:

{
  "mcpServers": {
    "argus": {
      "command": "argus",
      "args": ["mcp", "--path", "/absolute/path/to/repo"]
    }
  }
}
Cursor / Windsurf

Add to generic MCP settings:

{
  "argus": {
    "command": "argus",
    "args": ["mcp", "--path", "."]
  }
}

Configuration

Run argus init to generate a .argus.toml:

[review]
# max_comments = 5
# min_confidence = 90
# skip_patterns = ["*.lock", "*.min.js", "vendor/**"]

Custom Rules

Argus supports natural language custom rules. Create a file at .argus/rules.md (or .argus/rules/**/*.md) to guide the AI reviewer.

Example .argus/rules.md:

- Always suggest using `anyhow::Result` instead of `Result<T, Box<dyn Error>>`.
- Flag usage of `unwrap()` in production code; suggest `expect()` or error handling.
- Ensure all public functions have doc comments.

LLM Providers

Provider Config Model Env Variable
Gemini provider = "gemini" gemini-2.0-flash GEMINI_API_KEY
OpenAI provider = "openai" gpt-4o OPENAI_API_KEY
Anthropic provider = "anthropic" claude-sonnet-4-5 ANTHROPIC_API_KEY
Ollama provider = "ollama" llama3 (None)

For custom provider endpoints, set [llm].base_url. OpenAI-compatible and Gemini
base URLs can be provided either with or without the version suffix, for example
https://openrouter.ai/api or https://openrouter.ai/api/v1.

Embedding Providers

Provider Config Model Env Variable
Gemini provider = "gemini" text-embedding-004 GEMINI_API_KEY
Voyage provider = "voyage" voyage-code-3 VOYAGE_API_KEY
OpenAI provider = "openai" text-embedding-3-small OPENAI_API_KEY

Zero-cost setup: Use Gemini for both LLM and embeddings with a free API key.

[llm]
provider = "gemini"

[embedding]
provider = "gemini"

Environment Variables

Variable Purpose
GEMINI_API_KEY Gemini LLM + embeddings
OPENAI_API_KEY OpenAI LLM + embeddings
ANTHROPIC_API_KEY Anthropic LLM
VOYAGE_API_KEY Voyage embeddings
GITHUB_TOKEN GitHub PR integration

Architecture

                    ┌─────────────┐
                    │   argus     │
                    └──────┬──────┘
                           │
          ┌────────────────┼────────────────┐
          ▼                ▼                ▼
  ┌───────────────┐ ┌───────────┐ ┌──────────────┐
  │ argus-review  │ │ argus-mcp │ │  subcommands │
  └───────┬───────┘ └─────┬─────┘ └───────┬──────┘
          │               │               │
    ┌─────┴─────┬─────────┘               │
    ▼           ▼           ▼             ▼
┌─────────┐ ┌─────────┐ ┌──────────┐ ┌──────────┐
│ repomap │ │difflens │ │ codelens │ │ gitpulse │
└─────────┘ └─────────┘ └──────────┘ └──────────┘

Crate dependency order:

core (no internal deps)
  ├── repomap (core)
  ├── difflens (core)
  ├── gitpulse (core)
  ├── codelens (core, repomap)
  └── review (core, repomap, difflens, codelens, gitpulse)
        └── mcp (core, review)

Contributing

See CONTRIBUTING.md.

License

MIT

Yorumlar (0)

Sonuc bulunamadi