ArgusRed
We post-trained a model that pen tests instead of refusing your code
Last verified:
What is ArgusRed?
cos is a self-serve CLI tool from ArgusRed that performs security scans and penetration testing on codebases. It offers two modes in one CLI: Security Scan (read-only audit of local code with findings tied to files and line numbers) and Pen Test (offensive testing that attempts exploits against authorized systems). The tool uses a custom Go harness below a post-trained model to enforce safety guards—blocking mutating operations in Security Scan mode and limiting network access to authorized targets in Pen Test mode.
Key features include modular scanning with 8 active modules (Dependency Vulnerability Analysis, Secret & Credential Detection, SQL Injection/XSS Vectors, Input Validation & Sanitisation, File Permission & Access Controls, plus optional Authentication & Session Flows, CORS & CSP Misconfigurations, and Cryptographic Weakness Scan), parallel swarm execution of modules, a terminal user interface (TUI) with live estimates, and markdown report output containing location, severity, cause, and fix direction for every grounded finding. The tool runs locally on your machine and can be used behind a firewall.
cos is designed for security engineers, developers, and teams who need to audit their codebase for vulnerabilities or conduct authorized penetration testing. It targets users who want ground-truth vulnerabilities tied to specific code locations rather than vibes-based findings, and who need both read-only code auditing and active exploitation testing in a single tool.
ArgusRed pricing
Pricing model: Freemium
Installation is free. Running scans requires an active $20/month Cosine subscription—the same login that runs Cosine's coding agent. One account covers both products. Pen Test pricing is decided per engagement at booking, where scope and effort level determine the time-box, and the time-box determines the price.
ArgusRed pros
- Free installation with no upfront cost
- Two modes in one CLI: Security Scan and Pen Test
- Read-only enforcement in Security Scan mode via Go harness
- Findings tied to specific files and line numbers
- No vibes-based vulnerabilities—only grounded findings included
- Parallel swarm execution of modules for sub-linear scaling
- Live estimate shown in TUI before starting scan
- Single markdown report output with executive summary
- Runs locally on your machine behind a firewall
- Custom post-trained model for offensive security (not off-the-shelf API)
- Terminal Access, Network Requests, and File Write permissions configurable
- 8 modular scan types including Dependency Vulnerability and Secret Detection
- Reproduction scripts included for confirmed exploits in Pen Test
- No destructive actions in Pen Test mode
- Scope cannot expand beyond authorized targets in Pen Test
- TUI supports tab navigation, mode switching, and target addition
- SBOM-free—closed binary built on Cosine's own model
ArgusRed cons
- $20/month Cosine subscription required to run scans
- Pen Test mode requires booking access (not immediately available)
- Closed binary—not open source
- No fuzzing, DAST, or live exploitation in Security Scan mode
- Cannot modify your code (read-only only)
- Pen Test has no destructive actions or denial-of-service resilience testing by default
- Brute-force credential spraying disabled at Moderate effort level
- May trigger WAF rules or rate limits during Pen Test
- Cryptographic Weakness Scan and CORS/CSP Misconfig modules not active by default
Frequently asked questions about ArgusRed
How long does a scan take?
Time scales sub-linearly with codebase size because modules run as a parallel swarm. A 6-module scan of Bank of Anthos (~30k LOC) finished in ~10 minutes, while a full scan of Symfony (~1.5M LOC) took ~40 minutes. The TUI shows a live estimate before you start.
What's the output file?
A single markdown file at .cos/scan-<date>.md containing an executive summary, per-module findings, location, severity, cause, and fix direction for every finding. The file stays on your machine.
What does it cost?
Install is free. Running scans requires an active $20/month Cosine subscription—the same login that runs Cosine's coding agent. One account covers both products.
How is Pen Test different from Security Scan?
Security Scan reads code and infers vulnerabilities from what's there. Pen Test actually attempts exploits against running systems you authorize—they use a different binary mode, different agent behaviour, and deliver an engagement summary rather than an audit report.
How does scoping work for Pen Test?
You provide hosts/endpoints plus written consent at booking. The agent's network is scoped to that list—it can't reach anything else, even if a finding suggests it should.
What does Pen Test cost?
Pricing is decided per engagement at booking. Scope and effort level determine the time-box, and the time-box determines the price.
Will cos modify my code?
No. Read-only is enforced by the Go harness below the model—every tool call is intercepted before execution. Mutating tools (file writes, command execution) are deterministically blocked regardless of what the model wants.
Will cos run Pen Test without signed authorization?
No. Booking is the legal step—targets, time-box, and what's allowed are written down before anything runs. The tool won't run without signed authorization.
Can cos expand scope if it finds interesting targets next door?
No. Authorized targets only—even if interesting ones show up next door, the agent won't expand scope beyond the booked list.
Is cos open source?
No. The binary you install with brew, curl, or winget is a closed binary built on Cosine's own post-trained model. It runs locally on your machine and you can run it behind a firewall.