ARGUS

MCP gateway

AI clients connect to one endpoint. People sign in with Microsoft Entra, and Argus shows only the tools they have been granted. Every call is written to a tamper-evident audit log.

Gateway and tool catalog

One MCP endpoint. The caller sees only the tools they may use.

tools/list returns granted tools. tools/call decides again, then runs guardrails, the destructive-call guard, and the upstream call.
The catalog is built-in tools, documentation search, the ServiceNow sidecar, Axonius, and approved tools from custom MCP servers. Each tool is read, write, or destructive.
People connect their own ServiceNow or Axonius account. Credentials stay in that person’s vault. Administrators cannot read them.

Grants and access

Nothing is granted until an administrator says so. There is no self-service request.

whoami, my access, and the five documentation tools need no grant. Each documentation tool still checks its source.
A grant goes to a person, an org unit, an agent, or a service. Scope is the non-destructive tools of a server, every tool, or one named tool.
A destructive call needs that grant, the person’s own opt-in, and a kill switch that is off. Revoking a grant applies on the next call.

Audit log

Every call is written down, allowed or denied, with the reason.

Each row is hashed with the previous row, in the same transaction as the change. The database rejects updates and deletes.
Org-unit administrators see their own subtree. A session page shows a timeline and a relationship graph. Request and response bodies are for administrators.
Retention defaults to 90 days. Copies can go to Splunk, syslog, Microsoft Sentinel, or S3 Object Lock.

Governance

One signed license covers the installation. Every caller is also rate limited.

There are no per-feature entitlements. Administrators see an expiry warning at 90, 60, 30, 14, and 7 days.
After expiry, a grace period of up to 365 days keeps Argus working. Past grace, MCP and API calls are refused until a renewed license is installed. Sign-in stays available.
The default limit is 60 calls a minute per person, with a burst of 20 inside 10 seconds. The same defaults apply to each role.

Entra sign-in and SCIM

People sign in with Microsoft Entra over SAML 2.0. Argus is the service provider.

There is no Keycloak browser login and no admin page for SAML setup. Operators set it in the deployment.
A user is matched by the identity provider and the Entra object id, never by email.
SCIM 2.0 provisions users and groups. If Entra is down, a break-glass local administrator can sign in.

Custom MCP servers

An administrator adds a server. Its tools stay hidden until they are approved.

Only an approved tool whose schema still matches is offered, and only through a grant.
A changed schema marks the tool drifted and hides it until an administrator approves it again. Shipped ServiceNow and Axonius tools are approved from the risk catalog.
Stdio servers need the optional sandbox runner. Outbound URLs are https only.

Admin console

Everyone gets Home, My Access, and the tool catalog. Governance and administration are for admins.

An environment administrator sees the whole installation. An org-unit administrator manages their own subtree.
Tool risk, guardrails, the kill switch, audit, users, grants, and the license live in that console.
Guardrail rules start off. A match can block, redact, or flag. An AI judge needs Amazon Bedrock.

AI client connection

Cursor, Claude Desktop, Claude Code, and VS Code use one Streamable HTTP endpoint.

Connect a client shows the endpoint and a snippet for each of those apps. The API token is shown once.
People use OAuth or a pasted token with the mcp scope. Agents and services can use HMAC, a verified client certificate, or a JWT. Cookies are not accepted.
A session can be served by any replica. Access is decided again on every request.

Argus is single-tenant. Postgres holds state and the audit log, Redis holds sessions and rate limits, and Qdrant holds the knowledge index. One image runs the gateway, worker, migrate step, an optional sandbox, and the ServiceNow and Axonius sidecars.

PUT ONE GATEWAY IN FRONT OF THE TOOLS

Tell us which clients your staff use and which systems those clients need to reach. Argus signs the person in, grants the tools, and keeps the audit trail.

hello@updateset.com

Loom is UpdateSet’s IT service and security operations workspace. Read about Loom.