Complete codebase diagnosis: all scanners + quantum scoring + git hotspots + dead exports + type coverage.

Deep security scan with false-positive filtering: secrets, injection, XSS, SQLi, path traversal, weak crypto, CORS, open redirect, prototype pollution.

10-dimension weighted codebase score with confidence weighting. Grade S/A/B/C/D/F. Reproducible — same codebase always gives same score.

Files changed most frequently in the last 90 days. High churn = high risk. SonarQube cannot do this without plugins.

Find exported symbols not imported anywhere in the project — dead code that increases bundle size and maintenance cost.

TypeScript type safety audit: any usage, @ts-ignore, type assertions, strictness score.

Detect memory leaks: addEventListener without cleanup, useEffect without return, setInterval without clearInterval.

Code quality scan: empty catch blocks, console.log, @ts-ignore, any types, TODO debt, oversized files.

Test coverage analysis: test/source ratio, assertion-free tests, skipped tests.

Run build, lint, and test suite. Returns pass/fail per check with captured output.

Autonomous self-healing: diagnose → safe-fix → re-score → iterate until target score reached.

Structural gap detection: missing CI/CD, linter, TypeScript config, README, test scripts.

Rust-powered codebase search via ripgrep. 32× faster than grep. Regex, context lines, file type filtering.

Retrieve the most relevant code chunks for a question using local BM25 ranking. No embeddings, no API calls, no data leaves the machine. Returns full code windows with line numbers so answers are grounded in real code.

Ground a specific finding in real code: returns the full enclosing function, every other file referencing the same symbol, and the file's imports. Use this BEFORE acting on any finding to confirm it is real.

Show exactly which findings were rejected as false positives and why. Full transparency into the validation layer — verify ARGUS's own accuracy.

Structured chain-of-thought reasoning. Decompose problems, explore alternatives, reach conclusions.

~150 token repo snapshot. Fast orientation for an agent entering an unfamiliar codebase.

Multi-agent parallel scan with critique loop: security + quality + memory + testing + gaps, deduplicated and false-positive filtered.

4-dimension risk assessment for a planned task. Returns execution mode: Full Autonomy / Mixed / Structured, with human gate count.

Persist a key-value pair across sessions in .argus/memory/. Use to track scores, decisions, or context between runs.

Recall stored values by key or search term. Used for cross-session context.

Check against OWASP Top 10, SOLID principles, 12-Factor App, and Clean Architecture. Scored checklist with pass/fail per rule.

Analyse package.json for outdated dependencies, missing lock files, and known risky patterns.

Which analysis engines are available on this machine (ast-grep, semgrep, gitleaks, trivy, biome, ripgrep, fd) and how to install any that are missing.

Tree-sitter AST structural search via ast-grep. Matches real syntax trees, not text — so patterns can never match inside strings or comments. Use $VAR for one node, $$$ for many. Example: 'try { $$$ } catch ($E) { }'

Run all built-in tree-sitter anti-pattern rules: empty catch, await-in-loop, dangerouslySetInnerHTML, as any, non-null assertions, eval, unhandled .then(). AST-precise — no regex false positives.

Entropy-based secret detection via gitleaks. Set includeHistory=true to scan every commit — secrets in git history stay exploitable until rotated, even after deletion from HEAD.

Known CVEs in your dependency tree via Trivy. Returns severity breakdown and every critical vulnerability with its fixed version.

AWS / Azure / GCP / Kubernetes / Docker infrastructure-as-code misconfiguration scanning via Trivy. Catches public S3 buckets, wildcard IAM policies, unencrypted volumes, privileged containers, exposed ports.

Semgrep rule-pack scanning with CWE mapping. Configs: p/owasp-top-ten, p/security-audit, p/typescript, p/react, p/nodejs, p/secrets, auto.

Biome lint and format check — Rust-based, roughly 25× faster than ESLint.

Comprehensive dead code detection via import-graph reachability: orphan files never imported, unused exports, unused dependencies, unreachable code after return, commented-out code blocks, and duplicate files. Catches whole dead modules that per-symbol analysis misses.

Per-function cyclomatic and cognitive complexity. Cyclomatic drives the minimum number of tests required; cognitive measures nesting-weighted readability cost.

Find every exported symbol with no reference in any test file, ranked by risk. Async, security-adjacent (auth/payment/token/admin), and API-layer exports rank highest.

Generate a runnable Vitest scaffold for a specific untested export, with arrange/act/assert structure and TODOs marking the assertions only a human can specify.

Diff-aware code review of uncommitted changes or a branch comparison. Reviews only ADDED lines — the way a human reviewer reads a PR. Flags new secrets, empty catches, @ts-ignore, XSS sinks, disabled TLS, await-in-loop.

Six independent verification gates: type check, lint, build, tests, secret scan, dependency CVEs. Blocking gates (types, build, tests, secrets) must pass to ship. Returns an explicit SHIP or HOLD verdict.

Record this run's score to .argus/history.json and return the delta versus the previous run. Turns ARGUS from a snapshot into a trend line.

Teach ARGUS that a finding is a false positive. The pattern is remembered in .argus/learned.json and suppressed on every future run — precision improves with use rather than staying static.

List every false-positive pattern ARGUS has learned to suppress for this repository.

Complete end-to-end audit: every scanner, every engine, scored and correlated. Security + AST + secrets + CVEs + IaC + dead code + complexity + test gaps + trend versus last run. This is the single call that tells an agent everything about a codebase.

List every recorded ARGUS run for this repository — run id, tool, date, and git commit. Every scan is persisted to .argus/runs/ as JSON, Markdown, and an HTML dashboard.

Compare two recorded runs metric by metric. Every number is classified as better, worse, or unchanged — so you can prove a change improved the codebase rather than claiming it. Omit run ids to compare the two most recent runs of a tool.

Return the filesystem path to the latest visual HTML dashboard for a tool, ready to open in a browser or attach to a PR.