Three lenses. One decision.
Defensible automation
Arguss evaluates every dependency upgrade through three independent checks, vulnerability, trust, and pipeline, and gates autonomous merges on safety, not just severity.
The lens model
Three independent checks
Vulnerability
What's known to be broken.
We query OSV.dev and GitHub Security Advisories for every package version in your lockfile, including transitive dependencies. Each finding carries its CVSS severity, EPSS exploitation probability from FIRST.org, and a binary flag for CISA's Known Exploited Vulnerabilities catalog.
OSV.dev · GitHub Advisories · FIRST.org EPSS · CISA KEVTrust
Whether you can trust the upgrade.
We pull maintainer history, ownership records, publish cadence, and download trends from the npm registry and deps.dev. We compute a TrustDelta between the current version and the upgrade target, if a new maintainer appeared mid-window or ownership transferred, the lens raises a veto. Levenshtein distance against a top-1000 package list catches typosquats.
npm registry · deps.dev · Levenshtein detectionPipeline
Whether your CI can verify the fix.
We run zizmor static analysis on your .github/workflows
directory, plus a test-reality check on your package.json scripts and test file inventory.
If your project has no real tests or no CI to run them, the lens vetoes auto-merge,
not because the package is broken, but because there's no way to verify the fix didn't break your project.
The decision
Vetoes drive verdicts
When all three lenses agree a fix is safe, the verdict is AUTO_MERGE. After you confirm action from a Scan assessment, Arguss opens pull requests for those candidates; it does not merge them on GitHub. When any veto fires, the verdict drops to require human review. The fix-confidence score starts at 100 and decreases by a fixed amount for each veto, independent and additive.
Worth knowing
The score reflects safety to auto-merge, not importance of the underlying CVE. A critical-severity CVE and a low-severity CVE for the same package and upgrade window get the same fix-confidence score, because the merge-safety calculus is identical. Severity is for prioritization. Confidence is for action.
Urgency versus safety
CVSS · EPSS · KEV · Three signals, three jobs
CVSS
Severity
Source: NIST National Vulnerability Database (via OSV)
How damaging the vulnerability could be if exploited. Measures attack vector, complexity, and impact scope.
EPSS
Probability
Source: FIRST.org (updated daily)
How likely the CVE will be exploited in the next 30 days, based on real-world threat intelligence signals.
CISA KEV
Confirmation
Source: CISA, BOD 22-01
CVE has documented active exploitation in the wild. Federal agencies have a binding patching deadline.
Severity tells you how bad it could be. Probability tells you how likely you'll find out. Confirmation tells you it's already happening. Arguss tracks all three, and gates merges on safety, not urgency.
How to use it
Three ways to scan
URL scan
Point Arguss at any public GitHub repo. Read-only analysis, no credentials required. Results in seconds.
Scan a repo →Lockfile upload
Upload package-lock.json, optional workflows zip, optional package.json. Useful for private repos or offline analysis.
Scan with action
Scan a repo, pick the fixes, and connect the arguss-bot GitHub App. Arguss opens pull requests for safe auto-merge candidates and escalates the rest for review.
Scan and fix →Under the hood
How Arguss is built
Python · FastAPI · Fly.io · SQLite WAL · HTMX · Tailwind · Anthropic Claude API
Ready to see it?
Run a scan against any npm repo
Try the axios v1.0.0 demo - 178 findings analyzed in seconds.