Run all built-in tree-sitter anti-pattern rules: empty catch, await-in-loop, dangerouslySetInnerHTML, as any, non-null assertions, eval, unhandled .then(). AST-precise — no regex false positives.

Tree-sitter AST structural search via ast-grep. Matches real syntax trees, not text — so patterns can never match inside strings or comments. Use $VAR for one node, $$$ for many. Example: 'try { $$$ } catch ($E) { }'

Complete end-to-end audit: every scanner, every engine, scored and correlated. Security + AST + secrets + CVEs + IaC + dead code + complexity + test gaps + trend versus last run. This is the single call that tells an agent everything about a codebase.

Autonomous self-healing: diagnose → safe-fix → re-score → iterate until target score reached.

Biome lint and format check — Rust-based, roughly 25× faster than ESLint.

~150 token repo snapshot. Fast orientation for an agent entering an unfamiliar codebase.

Code quality scan: empty catch blocks, console.log, @ts-ignore, any types, TODO debt, oversized files.

Compare two recorded runs metric by metric. Every number is classified as better, worse, or unchanged — so you can prove a change improved the codebase rather than claiming it. Omit run ids to compare the two most recent runs of a tool.

Per-function cyclomatic and cognitive complexity. Cyclomatic drives the minimum number of tests required; cognitive measures nesting-weighted readability cost.

Show exactly which findings were rejected as false positives and why. Full transparency into the validation layer — verify ARGUS's own accuracy.

Known CVEs in your dependency tree via Trivy. Returns severity breakdown and every critical vulnerability with its fixed version.

Comprehensive dead code detection via import-graph reachability: orphan files never imported, unused exports, unused dependencies, unreachable code after return, commented-out code blocks, and duplicate files. Catches whole dead modules that per-symbol analysis misses.

Find exported symbols not imported anywhere in the project — dead code that increases bundle size and maintenance cost.

Analyse package.json for outdated dependencies, missing lock files, and known risky patterns.

Which analysis engines are available on this machine (ast-grep, semgrep, gitleaks, trivy, biome, ripgrep, fd) and how to install any that are missing.

Find every exported symbol with no reference in any test file, ranked by risk. Async, security-adjacent (auth/payment/token/admin), and API-layer exports rank highest.

Complete codebase diagnosis: all scanners + quantum scoring + git hotspots + dead exports + type coverage.

Structural gap detection: missing CI/CD, linter, TypeScript config, README, test scripts.

Generate a runnable Vitest scaffold for a specific untested export, with arrange/act/assert structure and TODOs marking the assertions only a human can specify.

Files changed most frequently in the last 90 days. High churn = high risk. SonarQube cannot do this without plugins.

Ground a specific finding in real code: returns the full enclosing function, every other file referencing the same symbol, and the file's imports. Use this BEFORE acting on any finding to confirm it is real.

AWS / Azure / GCP / Kubernetes / Docker infrastructure-as-code misconfiguration scanning via Trivy. Catches public S3 buckets, wildcard IAM policies, unencrypted volumes, privileged containers, exposed ports.

List every false-positive pattern ARGUS has learned to suppress for this repository.

Teach ARGUS that a finding is a false positive. The pattern is remembered in .argus/learned.json and suppressed on every future run — precision improves with use rather than staying static.

List every recorded ARGUS run for this repository — run id, tool, date, and git commit. Every scan is persisted to .argus/runs/ as JSON, Markdown, and an HTML dashboard.

Recall stored values by key or search term. Used for cross-session context.

Detect memory leaks: addEventListener without cleanup, useEffect without return, setInterval without clearInterval.

Persist a key-value pair across sessions in .argus/memory/. Use to track scores, decisions, or context between runs.

Return the filesystem path to the latest visual HTML dashboard for a tool, ready to open in a browser or attach to a PR.

10-dimension weighted codebase score with confidence weighting. Grade S/A/B/C/D/F. Reproducible — same codebase always gives same score.

Retrieve the most relevant code chunks for a question using local BM25 ranking. No embeddings, no API calls, no data leaves the machine. Returns full code windows with line numbers so answers are grounded in real code.

Diff-aware code review of uncommitted changes or a branch comparison. Reviews only ADDED lines — the way a human reviewer reads a PR. Flags new secrets, empty catches, @ts-ignore, XSS sinks, disabled TLS, await-in-loop.

4-dimension risk assessment for a planned task. Returns execution mode: Full Autonomy / Mixed / Structured, with human gate count.

Rust-powered codebase search via ripgrep. 32× faster than grep. Regex, context lines, file type filtering.

Entropy-based secret detection via gitleaks. Set includeHistory=true to scan every commit — secrets in git history stay exploitable until rotated, even after deletion from HEAD.

Deep security scan with false-positive filtering: secrets, injection, XSS, SQLi, path traversal, weak crypto, CORS, open redirect, prototype pollution.

Semgrep rule-pack scanning with CWE mapping. Configs: p/owasp-top-ten, p/security-audit, p/typescript, p/react, p/nodejs, p/secrets, auto.

Check against OWASP Top 10, SOLID principles, 12-Factor App, and Clean Architecture. Scored checklist with pass/fail per rule.

Multi-agent parallel scan with critique loop: security + quality + memory + testing + gaps, deduplicated and false-positive filtered.

Test coverage analysis: test/source ratio, assertion-free tests, skipped tests.

Structured chain-of-thought reasoning. Decompose problems, explore alternatives, reach conclusions.

Record this run's score to .argus/history.json and return the delta versus the previous run. Turns ARGUS from a snapshot into a trend line.

TypeScript type safety audit: any usage, @ts-ignore, type assertions, strictness score.

Run build, lint, and test suite. Returns pass/fail per check with captured output.

Six independent verification gates: type check, lint, build, tests, secret scan, dependency CVEs. Blocking gates (types, build, tests, secrets) must pass to ship. Returns an explicit SHIP or HOLD verdict.