Argus - Black-box, open-source red-team testing for AI age

项目说明

Argus

Black-box red-team testing for AI agents. Point Argus at any HTTP, gRPC,
MCP, payment-agent, or browser-using agent endpoint, run 205 ad
probes (OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, garak wrappers, TAP / PAIR
/ GCG), and get
LLM-judged findings as SARIF 2.1.0 / JUnit XML / HTML — drop straight into CI
as a GitHub Code Scanning gate.


---

Moti

LLM e score single prompt-response pairs. **That's not what
ships.** What ships is an *agent* — a system that plans, calls tools,
recovers from errors, reads documents, opens browsers, holds state across
turns. The failure surface of that system is dominated by **ad
robustness**, not benchmark accuracy: prompt injection through retrieved
docs, tool-call confusion, sleeper triggers, indirect injection via
URLs, jailbreaks that compose across turns.

Argus tests the agent the way an attacker would: as a black box, over the
wire, against the production endpoint, without source access. It picks up
where unit tests and LLM-evals leave off, and it produces reports your
security team can map to OWASP LLM Top 10, MITRE ATLAS and **NIST
AI RMF** controls without translation.

Scope

What Argus does:

205 probes in the bundled library — 15 OWASP LLM Top 10 hand-authored,

5 from public LLM system cards (best-of-N, crescendo, confused deputy,
many-shot jailbreak, sleeper agent), 31 browser-agent specific, 26
payment-abuse probes (x402 wallet flows, against payment_agent), 12
MCP-abuse probes (poisoned tool servers, against mcp_agent), 16
Semia-mapped agent-skill detectors (missing human gate, encoded payload,
install-time exec, shadow credentials), 1 custom unicode-smuggling probe
(see RESULTS.md), and 99 garak
wrappers for NVIDIA's existing catalog. Exact per-standard counts are
generated, not hand-maintained — see docs/probe-mapping.md.

8 target adapters: openai_compat, anthropic_native, custom_http

(Jinja2 + JSONPath), grpc (with reflection auto-discovery), http_upload
(file-upload-and-render sinks), browser_use (Playwright-driven
full-browser flows), payment_agent (x402 wallet-carrying agents, runs
against payment_testbed/), and mcp_agent (MCP tool-ser, runs
against mcp_testbed/).

Scan suites — pass suite instead of enumerating probe_ids on

POST /api/v1/redteam/runs: owasp-llm-top10, mitre-atlas,
nist-ai-rmf, eu-ai-act, payments, mcp.

Algorithmic iterati: TAP, PAIR, GCG black-box.

LLM-judge harness (default Anthropic Haiku, escalation to Sonnet on

high-se findings) with per-probe rubrics in
orchestrator/orchestrator/redteam/rubrics/.

Report formats: SARIF 2.1.0 (drops into GitHub Code Scanning), JUnit

XML (CI gate), HTML (humans). SARIF and HTML also carry a per-standard
co section (what the library does and does not test) and, for
probes with captured e (payment/MCP interactions), an e
section alongside the judge's .

Daily cost cap + per-run cap with predicti, so the judge

bill stays bounded.

Optional runtime guardrail control — PromptGuard wraps Meta

Llama-Prompt-Guard-2-86M *or* ProtectAI deberta-ion-v2
for before/after defense experiments. See RESULTS.md.

What Argus does not do:

It does not train new models, score benchmark accuracy, or replace your

LLM-evals harness.

It does not need source access. It does not patch the target. It does

not run inside the target's runtime.

It does not protect production — it *attacks* it. Guardrails (incl. our

PromptGuard integration) are for defense control experiments, not
for putting Argus inline as a runtime gate.

Quick start (no API keys required)

The repo ships with demo_target/ — a deliberately- FastAPI
chatbot whose system prompt contains four fake "secrets" — and a local
demo runner that exercises a curated probe subset against it. The demo
runs in deterministic mode without any external API calls.

Sample output:

Real measured results, plus the with-guardrail comparison, are written up
in RESULTS.md.

Running against your own agent

Targets are described in a small YAML file:

Other kind : anthropic_native, custom_http (with Jinja2 body
templates and JSONPath response extractors), grpc, http_upload,
browser_use, payment_agent, mcp_agent. Full target-spec cookbook in
docs/onboarding/target-spec-cookbook.md.

Once you have a target spec, run a scan with the argus-probe CLI:

Output is a SARIF 2.1.0 file you can attach to GitHub Code Scanning, plus
a JSON dump of all per-prompt .

For CI-gated scans, see the bundled argus-probe-action@v1
composite GitHub Action — --block-on-critical will fail the workflow on
any high-se finding.

Architecture

| Sub-project | Role |
|---|---|
| api_service/ | Central REST API (FastAPI + asyncpg + PostgreSQL). Owns the redteam_runs, redteam_findings, redteam_design_partners tables. |
| orchestrator/ | Probe dispatcher + judge harness + 8 target adapters + guardrail wrappers. |
| client_agent/ | Edge agent (browser-use + Playwright) for browser-dri. |
| frontend/ | Next.js 16 web UI: dashboard, chat, marketing pages. |
| cli/ | argus-probe Python CLI (PyPI). |
| demo_target/ | Deliberately- FastAPI chatbot for offline demos. |
| payment_testbed/ | Mock x402 payment world + insecure demo agent, for payment_agent probes. |
| mcp_testbed/ | Hostile MCP tool server + insecure demo agent, for mcp_agent probes. |
| kubernets/ | Helm charts + ArgoCD ApplicationSets for AKS / k3s deploys. |
| terraform/ | Azure IaC reference (AKS, ACR, PG, Key Vault, B2C apps). |
| database/ | Flyway schema migrations. |

The three legacy testing_* services moved to separate repositories:

testing_api_service + testing_web_fetch_service →

gy/argus-api-testing

testing_web_ui_service (+ browser-use) →

gy/argus-web-ui-testing

The orchestrator still references them over HTTP via run_api_test and
run_web_ui_cloud planner tools — deploy from those repos if you need
the in-cluster services.

Probe library structure

Every probe is a single YAML with this schema:

The loader ignores keys it does not recognise, so a typo in judge.rubric_path
degrades silently to rubrics/default.md rather than erroring. Run the test
suite after adding a probe — tests/test_redteam_probe.py asserts every probe
carries mappings.

See docs/probe-mapping.md for the full
probe × OWASP LLM Top 10 × MITRE ATLAS × NIST AI RMF mapping table.

Defense control experiments

Argus can prepend an input-side guardrail before every target call so you
can measure how much your guardrail actually buys you. Wrappers live in
orchestrator/orchestrator/guardrails/:

| Guardrail | Backend | Notes |
|---|---|---|
| PromptGuard (default) | protectai/deberta-ion-v2 | Open access (180M, DeBERTa-) |
| PromptGuard (alt) | meta-llama/Llama-Prompt-Guard-2-86M | Gated — requires huggingface-cli login and Meta-appro (86M) |

Enable via --guardrail prompt-guard on the local demo runner, or via
the orchestrator's guardrail field on POST /api/v1/redteam/runs.

RESULTS.md walks through a real before/after experiment
on this repo's demo target: Prompt Guard cuts the attack-success rate
from 22.9 % to 2.9 % (−87 %) with ~275 ms p50 latency o, and we
document the one bypass + 12 false positives in detail.

Documentation

RESULTS.md — measured demo run with and without guardrail.

docs/probe-mapping.md — probe → OWASP / ATLAS / NIST cross-ref.

docs/onboarding/quickstart.md — first 30 minutes.

docs/onboarding/target-spec-cookbook.md — writing target adapters.

docs/onboarding/probe-id-cheatsheet.md — what each probe ID does.

docs/reference/services.md — REST API + SSE event flows.

docs/CI_CD.md — GitHub Actions + ArgoCD pipeline.

docs/runbooks/local-dev.md — run each service locally.

docs/runbooks/deploy.md — AKS / Helm deploy.

Status

Pre-1.0. The CLI, REST API, probe library, judge harness, and report
formats are stable interfaces; the orchestrator's internal probe-dispatch
contract may still change. The Web UI and the SaaS API surface are under
acti.

License

Apache 2.0 — see LICENSE and NOTICE for third-party
attribution.

Argus does not third-party source. browser-use
(MIT) and garak (Apache-2.0) are ordinary
package dependencies; the probes/garak/ wrappers reference garak's catalogue
rather than redistributing it.

Contributing

See CONTRIBUTING.md for the full guide — repo layout, how to
run the suite, and the probe schema.

Issues and PRs welcome. Please open an issue before sending large changes so we
can align on direction. New probes should ship with mappings, a
judge.rubric_path pointing at a real rubric, and an attack_class taxonomy
entry.

For security-sensiti (e.g. a new probe that demonstrates a
real C issue in an open-source LLM stack), email rather than
filing a public issue.

项目信息

开发语言：Python

Star 数：206

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Black-box, open-source red-team testing for AI agents. Point it at any HTTP, gRPC, or browser-using agent endpoint; run 205 probes mapped to OWASP LLM Top 10 / MITRE ATLAS / NIST AI RMF, incl. payment and MCP tool-abuse families whose verdicts come from captured evidence, not LLM opinion. Reports state what was NOT tested. SARIF, CLI, GH Action.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。