Plain questions, direct answers
Is anything monitoring me? Is anything hiding from the process list? What starts on its own? Each audit answers one question.
Is my machine still mine?
Argus
A guardian for the machines your work runs on.
Agents and servers run code with your credentials. Argus watches the machine: what is running, what could take or keep control, and what has quietly changed. It works locally, keeps evidence, and tells you what it cannot see. One edition for Windows PCs, one for Linux servers.
How it works
01
Observe
Processes, autostarts, accounts, network activity, sensors and firewall state, on a Windows PC or a Linux server.
02
Correlate
Events are joined into a timeline so a change has a before and an after.
03
Explain
Findings come with the evidence behind them and with what could not be seen.
04
Respond
Reversible containment only when you have switched it on. Anything more waits for you.
What it does
Local security guardian
The developer's trust surface
It shows what runs because you opened an editor, a repository or a shell, which is exactly where an agent works.
Evidence first
What is observed is recorded before anything responds to it. Something that is merely absent from a later scan is logged as not observed, never as fixed.
A response ladder
Watch, ask, propose, act. Automatic actions are limited to reversible containment, every action is in a ledger, and there is an undo.
Threat intelligence that can only add suspicion
Public threat feeds are vetted by a deliberately simple checker. Nothing fetched is ever executed, and intelligence can never clear a finding.
It names its own blind spots
Argus compares current attacker techniques with what its own sensors cover and reports the gaps as a work list.
An edition for servers
On Linux, Argus runs as its own unprivileged account with read-only capabilities. It audits SSH keys and configuration, sudo rules, systemd units, cron, password-guessing in the auth log, web shells in document roots, container exposure and kernel-level hiding.
Local by construction
The dashboard only listens on your own machine. There is no telemetry by default, and the core depends on almost nothing but the language it is written in.
Illustration
Pricing
Free to run. Pay for the review.
Server edition
Free
Observes, records evidence and alerts on your Linux server. Protection never depends on a licence.
Server Review
$149 per server, once
One week of observation, then a report: what happened that week and what Argus could not see. A licence key unlocks the full report. 14-day refund.
Argus Watch
$9 per server, per month
The weekly report and change alerts after the review. Cancel any time.
Desktop (ARGUS-INSTINCT)
Free beta then $79 per year
Windows + WSL2 computers. Free while in beta; nothing stops working when the plan opens.
Payments are handled by Polar, the merchant of record: it takes the card, charges tax and sends the invoice. Argus never sees your card. The review is not a security audit, a penetration test or a certification.
Download · 2026.10.30-2
Two editions, one way of looking.
Linux server
x86-64 Linux with systemd and glibc 2.28 or newer (Ubuntu 20.04+, Debian 10+, RHEL/Alma/Rocky 8+). One native program, no Python; runs as its own unprivileged account.
curl -fsSLO https://www.archymedes.xyz/downloads/argus/argus-server-linux-x86_64.tar.gz
tar -xzf argus-server-linux-x86_64.tar.gz
sudo ./argus-server/install.shOr, on Debian and Ubuntu, the same program as a package:
curl -fsSLO https://www.archymedes.xyz/downloads/argus/argus-server_2026.10.30.2_amd64.deb
sudo apt install ./argus-server_2026.10.30.2_amd64.debThe dashboard listens on the server's loopback only. Reach it over SSH, or with the desktop app below.
Then run argus investigate for a first full report.
Windows PC
Argus on Windows itself.
The Windows edition is being rebuilt as a native program and is not in this release. To watch a Linux server from a Windows PC, use the desktop app below.
Desktop app
A window, tray icon and notifications for an Argus server you run. It watches nothing itself: it shows the server's dashboard through an SSH tunnel. Linux (WebKitGTK) and Windows 10/11.
- Install it. Windows: the .exe needs no installer; keep it in a folder of your own and open it once, and it adds ARGUS-1 to the Start menu. Linux, from the folder you downloaded to:
sudo apt install ./argus-desktop_2026.10.30.2_amd64.deb - On the server, give the app its own token (shown once):
argus desktop pair --name desktop - Save that token, on its own line, as client.token in %APPDATA%\local.jarvis.desktop (Windows) or ~/.config/local.jarvis.desktop (Linux, then chmod 600 it).
- Keep this tunnel open while you use the app, then open ARGUS-1:
ssh -N -L 8787:127.0.0.1:8787 your-server
The Windows app is not code-signed yet. If Windows says “Windows protected your PC”, select More info, check the app is argus-desktop-windows-x64.exe, then Run anyway. No Run anyway button means this PC's policy blocks unsigned programs: do not turn that protection off for Argus.
The app only talks to 127.0.0.1; the dashboard is never exposed to the network. To revoke the app: argus desktop revoke ID (argus desktop clients lists the IDs).
SHA256SUMS · SHA256SUMS.sig · allowed_signers · Verify a download · Documentation
In practice
Ask it a question
argus spy- Is anything monitoring me? Who used the microphone or camera?
argus hidden- Is anything hiding from the normal process list?
argus toolchain- What runs because I opened an editor, a repo or a shell?
argus secrets- Which credentials are sitting in plain text on this disk?
argus evasion- Is anything in a position to lie to these checks?
argus gaps- What attacker tradecraft do I not cover yet?
What it is not
- Not a replacement for enterprise endpoint security.
- Windows 10 and 11 (64-bit), and Linux servers with systemd. No macOS edition yet.
- Someone with full administrator or kernel control can falsify what any local tool sees. Argus says so instead of hiding it.