{
  "markdown": "# Argus\n\nEnglish · [繁體中文](docs/i18n/README.zh-TW.md) · [简体中文](docs/i18n/README.zh-CN.md) · [日本語](docs/i18n/README.ja.md) · [한국어](docs/i18n/README.ko.md)\n\n**An MCP server that gives AI agents evidence from a *running* process.**\n\nEvery reverse-engineering MCP server so far bridges a *static* analyzer — Ghidra, IDA,\napktool. They hand your agent the file on disk. None of them can tell the agent what the\nprogram is actually doing right now: what got decrypted into that buffer, which address\nthe vtable slot resolved to at runtime, which call site sent that packet.\n\nArgus is the other half. It attaches to a live Windows process and returns runtime\nevidence: real bytes at real addresses, disassembly of the code that actually executed,\nresolved IAT thunks, caller chains walked from live memory, and a hypothesis ledger that\ntracks what has been proven versus what is still a guess.\n\nIt does not draw conclusions for the model. It returns addresses, module/RVA context,\ninstructions, callers, callees, and local evidence, then gets out of the way.\n\n---\n\n## Why this exists\n\nGames die. The publisher shuts the servers down, the studio folds, the genre moves\non. What survives is a client sitting on somebody's hard drive that can no longer\nconnect to anything — no source, no protocol documentation, no server left to talk\nto. Just an executable that still remembers how to speak a language nobody is\nlistening to anymore.\n\nArgus was built to bring those back.\n\nReconstructing a server for a dead game means recovering its protocol: packet\nlayouts, encryption, opcode dispatch, the state machine on the other side of the\nwire. The only surviving specification is the client binary itself. Nobody wrote\nthe document you need, and the people who knew have long since moved on.\n\nStatic analysis gets you partway. But a twenty-year-old client is packed, its\nstrings are encrypted, its handlers dispatch through tables that only exist once\nthe process is up. So you run it, and you watch it work — which is where the next\nsection comes in.\n\nThat is what this tool is for: not breaking into something alive, but getting\nsomething dead to speak again.\n\n---\n\n## Why go to the running process at all\n\n**A CPU cannot execute ciphertext.**\n\nWhatever a program does to protect itself on disk — packing, string encryption,\nvirtualized instructions, imports resolved at load time — all of it has to be undone\nbefore the processor can run the code. At the instant of execution, the real\ninstructions and the real data are sitting in memory in the clear. They have to be.\nThat is not a flaw in any particular protector; it is a consequence of how processors\nwork, and no amount of obfuscation gets around it.\n\nSo the two approaches are reading different things:\n\n- **Static analysis reads the file.** What the author shipped.\n- **Runtime analysis reads what the file turned into.** What the machine is actually running.\n\nWhen those two differ, the second one is the truth.\n\n| Situation | Static analyzer | Argus |\n|---|---|---|\n| Packed / self-decrypting code | sees the packer | disassembles the unpacked bytes in memory |\n| Indirect call through a vtable | sees `call [rax+0x18]` | resolves the slot to a concrete target |\n| Import resolved at runtime | sees a thunk stub | resolves the thunk to the real API |\n| Buffer contents after decryption | nothing | reads the plaintext |\n| Which of 40 call sites actually fires | guesses | records the one that ran |\n\n### Where static analysis wins\n\nThe trade runs the other way too, and it is worth being blunt about it: a static\nanalyzer sees *every* path, including the ones that never execute. Argus only sees\nwhat actually ran. A branch that was never taken leaves no runtime evidence at all,\nand a function nobody called may as well not exist.\n\nNeither view is complete on its own. That is what `correlate_addr` is for — map a\nruntime address back to a module and RVA, look it up in Ghidra or IDA, and work with\nboth halves. Argus is built to sit alongside a static analyzer, not to replace one.\n\n---\n\n## Tools\n\n**Process and memory**\n`processes_list` · `processes_find` · `mem_attach` · `mem_modules` · `memory_regions`\n`mem_read` · `mem_read_chain` · `mem_write`\n\n**Scanning**\n`scan_bytes` · `scan_string` · `scan_regex` · `scan_pointers_to` · `scan_callers`\n`scan_x86_call_sites` · `value_scan_start` · `value_scan_refine` · `value_explain` · `real_rate`\n\n**Disassembly and structure recovery**\n`disasm_at` · `analyze_function` · `find_vtable` · `extract_dispatch_tables`\n`analyze_send_call_sites` · `read_struct` · `diff_struct`\n\n**Import and API resolution**\n`runtime_imports` · `runtime_exports` · `resolve_iat_thunks` · `resolve_api_targets`\n\n**Tracing and correlation**\n`trace_call_chain` · `correlate_addr` · `locate`\n\n**Evidence ledger**\n`record_hypothesis` · `verify_hypothesis` · `query_hypotheses` · `add_evidence`\n\n---\n\n## Two design decisions worth knowing about\n\n### Automatic architecture routing\n\nAttaching a 64-bit analyzer to a 32-bit (WOW64) target is a classic source of silently\nwrong pointer arithmetic and garbage PE parsing. Argus ships a thin front-end,\n`argus-router`, which inspects the target process, determines whether it is x86 or x64,\nand dispatches to the matching `argus-rs` build. You configure one binary; the correct\nengine is selected per target.\n\n### The evidence ledger\n\nAgents are good at producing plausible explanations and bad at noticing when a plausible\nexplanation is unsupported. `record_hypothesis` / `verify_hypothesis` / `add_evidence`\nforce the distinction: a claim is stored as a hypothesis, and only becomes an established\nfact when evidence is attached and verification passes. `query_hypotheses` lets a later\nsession pick up where the previous one stopped without re-deriving everything.\n\n---\n\n## Install\n\n### Prebuilt binaries\n\nDownload the latest release and unpack it anywhere:\n\n**[Releases](https://github.com/r0ptik/argus/releases)**\n\nThe archive contains `argus-router.exe` plus both engine builds\n(`argus-rs-x64.exe`, `argus-rs-x86.exe`). Keep them in the same directory.\n\n### From source\n\nRequires a Rust toolchain with both Windows targets installed:\n\n```bash\nrustup target add x86_64-pc-windows-msvc i686-pc-windows-msvc\n\ngit clone https://github.com/r0ptik/argus\ncd argus\ncargo build --release --target x86_64-pc-windows-msvc\ncargo build --release --target i686-pc-windows-msvc\n```\n\n---\n\n## Configure\n\n### Claude Code\n\n```bash\nclaude mcp add argus -- C:\\path\\to\\argus-router.exe\n```\n\n### Any MCP client\n\n```json\n{\n  \"mcpServers\": {\n    \"argus\": {\n      \"command\": \"C:\\\\path\\\\to\\\\argus-router.exe\"\n    }\n  }\n}\n```\n\n---\n\n## Scope and intended use\n\nArgus is a reverse-engineering and program-analysis tool. It is built for work such as\ngame and server preservation, network protocol analysis, interoperability and\nclean-room reimplementation, malware analysis, crash and corruption debugging, and\nsecurity research.\n\nIt is explicitly **not** built for attacking live services. No cheat features are\naccepted into this repository — see [CONTRIBUTING.md](CONTRIBUTING.md).\n\nIt requires the ability to open and read another process, so use it only against\nprocesses you own or are authorized to analyze. Attaching to software you do not have\npermission to analyze may violate that software's terms or your local law. That is your\nresponsibility, not the tool's.\n\n---\n\n## Platform support\n\nWindows only. The memory access layer (`argus-winmem`) is built on the Win32 process\nand memory APIs; there is no Linux or macOS backend today.\n\nBoth x86 and x64 targets are supported, including 32-bit processes running under WOW64.\n\n---\n\n## Crates\n\n| Crate | Role |\n|---|---|\n| `argus-router` | front-end binary; architecture detection and dispatch |\n| `argus-rs` | MCP server; tool definitions and request handling |\n| `argus-engine` | analysis engine; disassembly, structure recovery, tracing |\n| `argus-winmem` | Win32 process and memory access |\n| `argus-scan` | pattern and value scanning primitives |\n| `evidence-core` | address, module, RVA and evidence data models |\n\n---\n\n## License\n\nMIT. See [LICENSE](LICENSE).\n",
  "bytes": 8111,
  "sha": "37c7bbb3ff347ab50701b57cbafcc6dd15476d0eee2f2180dc11683c05ff87a5",
  "repo_slug": "r0ptik/argus",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_r0ptik_argus_96aaca3f/readme"
}