Integrations

You will finish this page with Argus wired into the places your team already works: GitHub, your AI coding assistant, your CI pipeline, Slack, and your issue tracker.

Everything here is configured at Settings → Integrations, except the AI provider key, which lives at Settings → AI Scan.

GitHub

The only source-control integration that is live today. It powers repository import, pull-request review, and the fix-PR flow.

See Pull request security for installation, permissions, and the merge gate.

GitLab, Azure DevOps, Bitbucket, Bitbucket Server and local upload appear in the Add Project dialog and are marked coming soon. For those, connect a public Git URL instead, or scan from CI.

API keys

An API key is how scripts, CI jobs and AI assistants authenticate to Argus.

Creating one

1. Settings → API keys → Create Key.
2. Give it a descriptive name, for example CI/CD Pipeline Key.
3. Copy the key immediately. It is displayed once and never again. Store it in a secret manager.

Keys look like argus_live_ followed by a random suffix. Argus stores only a bcrypt hash and a short prefix, so the list shows argus_live_…_****...****.

Only Admins can create or revoke keys.

What a key can do

Keys are not individually scoped. Every key authenticates as the machine principal, which holds exactly these permissions:

A leaked CI token therefore cannot delete your projects or change your organization.

Revoking

Settings → API keys → Revoke. Any integration using that key loses access immediately. This cannot be undone.

MCP, Argus in your AI coding assistant

Argus runs a Model Context Protocol server so Claude Code, Cursor, GitHub Copilot and any other MCP client can query your security data and vet their own work before it lands.

Endpoint: POST <your-argus-url>/api/mcp Transport: Streamable HTTP, JSON-RPC 2.0 Auth: Authorization: Bearer argus_live_xxx

The exact URL for your deployment is shown at Settings → Integrations → AI assistants, CI/CD & IDE, together with copy-paste config for each client.

The 12 tools

Reason about a finding: pass a finding id as vulnId:

Pre-flight your own work: no finding id needed:

Discover the state of your organization:

Act on it:

scan_package accepts these ecosystems: npm, PyPI, Maven, Go, crates.io, RubyGems, NuGet, Packagist. Aliases like node, python and rust work too.

Permissions and limits

The nine read tools need only an authenticated member of your organization. The three write tools require the same permission as their equivalent in the app: trigger_scan needs scan permission, update_finding needs finding-triage permission, import_repo needs project-create permission. An API key holds all three.

scan_diff and scan_package are rate-limited to 30 calls per organization per minute. Exceeding it returns a tool error telling you how long to wait.

Connecting a client

Replace https://your-argus-instance with the MCP URL from Settings → Integrations, and set ARGUS_API_KEY in your environment.

Claude Code

claude mcp add --transport http argus-security \
  https://your-argus-instance/api/mcp \
  --header "Authorization: Bearer $ARGUS_API_KEY"

Or commit .mcp.json so your whole team gets it:

{
  "mcpServers": {
    "argus-security": {
      "type": "http",
      "url": "https://your-argus-instance/api/mcp",
      "headers": { "Authorization": "Bearer ${ARGUS_API_KEY}" }
    }
  }
}

Cursor: .cursor/mcp.json

{
  "mcpServers": {
    "argus-security": {
      "url": "https://your-argus-instance/api/mcp",
      "headers": { "Authorization": "Bearer ${ARGUS_API_KEY}" }
    }
  }
}

GitHub Copilot / VS Code: .vscode/mcp.json

{
  "servers": {
    "argus-security": {
      "type": "http",
      "url": "https://your-argus-instance/api/mcp",
      "headers": { "Authorization": "Bearer ${input:argus_api_key}" }
    }
  },
  "inputs": [
    {
      "id": "argus_api_key",
      "type": "promptString",
      "description": "Argus API key",
      "password": true
    }
  ]
}

Tell the agent when to use it

Connecting the server is not enough, the assistant needs to know the habit. Add this to CLAUDE.md, .cursorrules or copilot-instructions.md:

## Security (Argus)

- Before adding ANY dependency, call `scan_package` with its name and ecosystem.
  If the verdict is `block`, do not install it and do not work around it. Pick a
  different package and say why.
- Before proposing a diff, call `scan_diff` with that diff. Fix anything it reports.
- When working on an Argus finding, call `explain_finding` and `get_fix` first, and
  `check_reachability` before arguing that something is not exploitable.

The in-app Agent rule tab at Settings → Integrations has a copy-paste version.

CI/CD gate

The same scan_diff engine that reviews pull requests can gate any pipeline. It needs only git, curl and jq. Nothing to install.

Save this as argus-scan.sh and call it from your pipeline:

#!/usr/bin/env bash
set -euo pipefail

: "${ARGUS_API_KEY:?Set ARGUS_API_KEY to an Argus API key}"
ARGUS_URL="${ARGUS_URL:-https://your-argus-instance}"
BASE="${BASE:-${GITHUB_BASE_REF:-${CI_MERGE_REQUEST_TARGET_BRANCH_NAME:-${CHANGE_TARGET:-main}}}}"

git fetch --depth=50 origin "$BASE" >/dev/null 2>&1 || true
git diff "origin/$BASE...HEAD" > pr.diff || git diff "origin/$BASE" > pr.diff

if [ ! -s pr.diff ]; then
  echo "Argus: no diff against $BASE, nothing to scan."
  exit 0
fi

jq -Rs '{jsonrpc:"2.0",id:1,method:"tools/call",params:{name:"scan_diff",arguments:{diff:.}}}' \
  pr.diff > req.json

curl -sS -X POST "$ARGUS_URL/api/mcp" \
  -H "Authorization: Bearer $ARGUS_API_KEY" \
  -H "content-type: application/json" \
  -d @req.json > out.json

if jq -e '.error' out.json >/dev/null 2>&1; then
  echo "Argus request failed:"; jq -r '.error.message' out.json
  exit 2
fi

jq -r '.result.structuredContent.findings[]? | "[\(.severity)] \(.file):\(.line) \(.title)"' out.json

BLOCK=$(jq '[.result.structuredContent.findings[]?
  | select((.severity|ascii_upcase)|test("CRITICAL|HIGH"))] | length' out.json)
echo "Argus: $BLOCK blocking finding(s)."
[ "$BLOCK" -eq 0 ]

Exit codes: 0 clean or no diff · 1 at least one CRITICAL or HIGH finding · 2 the request to Argus failed.

For GitHub Actions specifically, see the ready-made workflow in Pull request security.

Slack

Installing

Settings → Integrations → Slack → Add to Slack. Approve the scopes; Argus stores the workspace token encrypted, scoped to your organization.

Then pick an Alerts channel and click Save channel. Public channels and any private channel the bot is in are listed, for a private channel, /invite @Argus first. Send test confirms delivery. Without a channel set, Argus posts to #general.

Slash commands

All replies are ephemeral, only you see them.

What Argus posts

Buttons on a finding card

• Suppress: marks the finding a false positive in Argus and replaces the message with who suppressed it.
• Reopen: sets it back to Open.
• View in Argus: opens the Issues workspace.

Uninstalling the Slack app, or revoking its token, disconnects Argus automatically.

Jira

Settings → Integrations → Issue Tracking → Jira. Provide:

Credentials are encrypted at rest.

Once connected:

• The Assign dialog on Issues lists Jira users. Picking one creates the issue in Jira and assigns it to them.
• The detail drawer's Create Jira ticket creates a ticket for that finding.
• API Inventory → Send to Jira creates tickets for the selected endpoints' linked findings.

Issues are created as type Bug, with priority mapped from severity: CRITICAL → Highest, HIGH → High, everything else → Medium. The summary is [Argus] <finding title>, or [Argus] N security findings when you assign several at once. The resulting ticket URL is written back onto every finding in the selection.

Linear

Settings → Integrations → Issue Tracking → Linear. Provide a Linear personal API key, and optionally a team id. Without a team id, Argus uses the workspace's first team.

Once connected, Linear people appear in the Assign dialog exactly like Jira, and selecting one creates and assigns the issue there.

If a tracker call fails, Argus reports the real error and writes nothing. It never fabricates a ticket reference.

AI provider

AI features, triage, PR review, agentic fixes, Ask AI, need a model provider.

Settings → AI Scan → AI provider key.

Keys are stored encrypted, and only a masked form is ever shown back to you. Remove deletes it.

Then set:

• Enable AI Scanning: the master switch for all AI calls in your organization.
• AI security review on pull requests: the extra AI detection pass on PR diffs. See Pull request security.
• Triage Model: the model used for PR-review triage, fix generation and Ask AI. Deliberately fast and cheap.

Next

• Policies and gates, define what a passing build means
• API reference, the full GraphQL surface