CLI reference
argus scan
The read-only command. scan tells you what is vulnerable and how it could be fixed, and writes a report, but it never modifies your project or talks to a forge.
Synopsis
argus scan --pom pom.xml --report report.jsonWhat it does
scan runs the first two stages of the pipeline. It asks Maven for an aggregate CycloneDX SBOM, parses it into a dependency graph, and queries every enabled advisory source (OSV.dev by default) for every component. The result is written to the path given by --report (report.json by default) as a structured JSON document listing each advisory, the affected coordinates, and the version that resolves it. See Output formats for the full schema, and SBOM & vulnerabilities for how the graph is built.
SARIF output
Add --sarif to also emit a SARIF 2.1.0 file, which GitLab’s security dashboard can ingest directly. Each finding is located against the line in your pom.xml where the affected dependency is declared, so the dashboard can point a reviewer at the right place:
argus scan --pom pom.xml --report report.json --sarif report.sarifCaching
The SBOM is produced by a real Maven build, so the first scan takes as long as your build does. Hydrated advisory records are then cached under .argus-cache/ for 24 hours, so subsequent scans within the day skip the network. Both the location and the lifetime are adjustable with --cache-dir and --cache-ttl; see Global flags.