Local security monitor · Windows PCs and Linux servers

Know what runs
on your machine.

Agents, package scripts and servers run code with your credentials. Argus watches the machine: what is running, what starts on its own, what could take or keep control, and what has quietly changed. It keeps the evidence locally and says plainly what it cannot see.

argus timeline --since 1hobserving
  1. observednode · spawned by code in ~/work/api
  2. observedpostinstall script ran curl to an unseen host
  3. flaggednew autostart: ~/.config/systemd/user/upd.service
  4. asked youdisable it? reversible · undo kept in the ledger
  5. observedssh login from a network not seen before
  6. cannot seekernel-level hiding needs the optional sensor

Illustration of the timeline format. Every line keeps its evidence.

01 Monitoring

A timeline, not a verdict.

Processes, autostarts, accounts, network activity, sensors and firewall state are observed and joined into one timeline, so every change has a before and an after. What is recorded comes first; what responds to it comes second.

  • Evidence before response
  • Absence is logged as not observed, never as fixed
  • Public threat feeds can only add suspicion, never clear it

02 Processes

What runs, and why it runs.

Argus shows what runs because you opened an editor, a repository or a shell, which is exactly where a coding agent works. It looks for anything hiding from the normal process list and anything in a position to lie to these checks.

  • Parent and child: who started what
  • Autostarts, services, scheduled tasks and cron
  • Who used the microphone or camera

03 Data

Your data stays where it is.

Argus finds credentials sitting in plain text on the disk and shows where they are. Its own findings stay on the machine: the dashboard listens only locally and there is no telemetry. Automatic actions are limited to reversible containment, written to a ledger, with an undo.

  • Plain-text secrets, SSH keys and tokens located
  • No telemetry; fetches only public threat feeds and timestamps
  • Anything bigger than reversible asks you first

Ask it a question

Each audit answers
one plain question.

No dashboard to decode. You ask, it answers with the evidence behind it, and with what it could not check.

argus spy
Is anything monitoring me? Who used the microphone or camera?
argus hidden
Is anything hiding from the normal process list?
argus toolchain
What runs because I opened an editor, a repo or a shell?
argus secrets
Which credentials are sitting in plain text on this disk?
argus evasion
Is anything in a position to lie to these checks?
argus gaps
What attacker tradecraft do I not cover yet?

How it responds

Watch, ask, propose, act.

  1. 01

    Observe

    Processes, autostarts, accounts, network activity, sensors and firewall state.

  2. 02

    Correlate

    Events are joined into a timeline so a change has a before and an after.

  3. 03

    Explain

    Findings come with the evidence behind them and with what could not be seen.

  4. 04

    Respond

    Reversible containment only when you switch it on. Anything more waits for you.

The server edition

On Linux, it runs as its own unprivileged account.

Read-only capabilities, systemd units, nothing to configure to start. It audits SSH keys and configuration, sudo rules, systemd units, cron, password-guessing in the auth log, web shells in document roots, container exposure and kernel-level hiding.

Any systemd distribution
curl -fsSLO https://www.archymedes.xyz/downloads/argus/argus-server-linux-x86_64.tar.gz
tar -xzf argus-server-linux-x86_64.tar.gz
sudo ./argus-server/install.sh

Signed releases. Verify the download against SHA256SUMS before installing.

Get Argus

Two editions, one name.

Desktop

Windows 10 and 11 with WSL2

Audits the Windows host and the WSL2 side, and names its own blind spots. Free during the beta.

Download for Windows

Server

Linux servers with systemd

A .deb for Debian and Ubuntu, or a tar.gz for any systemd distribution. Free, with or without a review.

Download for Linux

Pricing

Free to run. Pay for the review.

Argus

Free

Desktop (beta) and server editions. Monitoring never depends on a licence.

Server Review

$149per server, once

One week of observation on one Linux server, then a plain report: what happened that week and what Argus could not see. 14-day refund.

Buy a review

Argus Watch

$9per server, per month

The weekly report and change alerts after the review. Cancel any time.

Start Watch

Desktop

Free betathen $79 per year

Nothing stops working when the paid plan opens.

The review reports what Argus observed and what it could not see. It is not a security audit, a penetration test or a certification. Payments are handled by Stripe at checkout; Argus never sees your card.

What it cannot do

Said plainly, up front.