AI-powered terminal tool for web reconnaissance, vulnerability analysis, and exploit suggestion. Built for penetration testers, security researchers, and developers who want deep automated recon with local LLM analysis.

ARGOS is intended for use ONLY on systems you own or have explicit written permission to test. Unauthorized use against third-party systems is illegal in most jurisdictions. The author (Hemiize) assumes no liability for any misuse, damage, or legal consequences arising from the use of this tool. You are solely responsible for how you use this software.

Terminal UI powered by Rich

• Python 3.10+
• nmap (add to PATH — required for port scanning)
• One of:
  • llama.cpp server (llama-server) with a GGUF model
  • Ollama with any supported model

Installed automatically by setup.bat / pip install -r requirements.txt:

rich, requests, beautifulsoup4, dnspython, python-whois, reportlab, duckduckgo-search, ddgs

git clone https://github.com/Hemiize/argos.git
cd argos
setup.bat

git clone https://github.com/Hemiize/argos.git
cd argos
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Edit config.py to match your LLM setup:

# llama.cpp
LLAMA_URL   = "http://localhost:8080/v1/chat/completions"
LLAMA_MODEL = "bench"   # model id as reported by /v1/models

# Ollama
OLLAMA_URL   = "http://localhost:11434/api/chat"
OLLAMA_MODEL = "llama3"

Or configure at runtime via Settings → [1] LLM Backend.

start.bat

source venv/bin/activate
python argos.py

llama.cpp:

llama-server -m your-model.gguf --port 8080 -c 16384

Ollama:

ollama serve
ollama pull llama3

[1] New Scan          — run standard / deep / ultra scan against a target
[2] View History      — browse past sessions, re-run exploits, export reports
[3] Compare Sessions  — diff two scans to track remediation progress
[4] Settings          — switch backend, model, user-agent, CVE cache
[5] Exit

1. Enter target IP or domain
2. Choose depth (1 / 2 / 3)
3. ARGOS runs all recon tools in parallel with a live progress bar
4. LLM analyses raw scan data with live token counter
5. Results displayed with severity-coloured panels
6. Optionally: execute payloads, chat about results, export report

After a scan, ARGOS offers to execute LLM-suggested exploits via an allowlisted runner:

Allowed tools: nmap, sqlmap, nikto, dirb, gobuster, wfuzz, hydra, curl, whatweb, ffuf, nuclei

• curl commands are routed through Python requests (no curl binary needed on Windows)
• Target placeholders ({target}, TARGET, example.com) are auto-substituted
• Results saved to the session database

Only run this against targets you own or have written permission to test.

From View History → [session] → Export:

argos.py        — main entry point, menu logic
config.py       — paths, URLs, timeouts
settings.py     — user settings (backend, model, user-agent)
llm.py          — LLM bridge (llama.cpp + Ollama, streaming)
tools.py        — 27 recon tool runners
ui.py           — Rich terminal UI components
db.py           — SQLite session database
cve.py          — NVD CVE enrichment
export.py       — PDF, HTML, JSON, Markdown report generation
search.py       — DuckDuckGo web search helper
requirements.txt
setup.bat       — Windows setup script
start.bat       — Windows launcher

• All analysis is performed locally — no scan data is sent to any cloud service
• The LLM runs entirely on your hardware (llama.cpp / Ollama)
• NVD CVE lookups contact services.nvd.nist.gov only (cacheable offline after first run)
• DuckDuckGo search is optional and only used in the follow-up chat search feature

This project is licensed under the MIT License with Attribution Requirement.

You are free to use, modify, and distribute this software provided that:

• You include the original copyright notice, AND
• You visibly credit the author: Hemiize (e.g. "Based on ARGOS by Hemiize")

See LICENSE for full terms.

Hemiize

ARGOS — stay legal.