Reference
Network access
Argus is a single static binary that runs in your CI. It reaches a small, fixed set of public endpoints over HTTPS, and this page lists every one so a platform team can allowlist them for firewall and egress-proxy requests. A blocked endpoint typically shows up as a hang followed by a timeout, so check this list first.
Outbound connections
Everything Argus contacts falls into three groups: the advisory data it reasons about (OSV.dev, plus EPSS and the CISA KEV catalog for the report), the package registries it resolves versions from (Maven Central or your npm registry, reached through your existing build tooling), and your GitLab instance, where it opens merge requests. Beyond those, the only other outbound path is the opt-in OpenTelemetry exporter (ARGUS_OTEL=on), which sends run metrics to a collector endpoint that you choose. Argus has no always-on telemetry, no analytics, and no licensing call-home.
Every connection Argus initiates by default is outbound HTTPS on port 443. The optional rows are reached only when you turn the matching feature on, and two of them point at hosts you configure yourself: the OTLP collector endpoint and any registry mirror in your settings.xml or .npmrc — allowlist those alongside the fixed hosts if you enable them.
Domain allowlist
| Domain | Purpose | When contacted |
|---|---|---|
api.osv.dev | Advisory database: bulk vulnerability matching for the dependency graph and per-advisory hydration. First in the default advisory_sources list. | Every run |
repo.maven.apache.orgrepo1.maven.org | Maven Central: dependency, plugin and SBOM resolution performed by the Maven build (mvn) that Argus invokes. Honours your settings.xml mirrors and proxies, so a Nexus/Artifactory mirror replaces these hosts. | Maven projects |
registry.npmjs.org | npm package metadata and version resolution. Overridable to a private registry (GitHub Packages, Artifactory, Nexus) via .npmrc. See Registries. | npm projects |
Your GitLab hostgitlab.com or self-hosted | Branches, merge requests and report (PDF) uploads via the REST API. The host comes from --gitlab-url / CI_SERVER_URL, so a self-managed instance is contacted instead of gitlab.com. | Runs that publish an MR |
api.first.org | EPSS exploit-prediction scores for the findings in the security report. | Only with ARGUS_PDF_REPORT |
www.cisa.gov | CISA Known Exploited Vulnerabilities (KEV) catalog, to flag actively-exploited CVEs. | Only with ARGUS_PDF_REPORT |
secretsmanager.<region>.amazonaws.comsts.<region>.amazonaws.com | AWS Secrets Manager secret resolution (and STS when assuming a role). Region and endpoint are configurable; see Secrets. | Only with a ${{aws-secretsmanager:…}} reference |
Your OTLP collectorOTEL_EXPORTER_OTLP_ENDPOINT | Opt-in OpenTelemetry export of run metrics, logs and traces to a collector that you configure. Disabled by default; when off, no telemetry code path runs. | Only with ARGUS_OTEL=on |
Proxies, TLS & ports
Argus’ own requests honour the standard proxy environment variables (HTTPS_PROXY, HTTP_PROXY and NO_PROXY), so behind an egress proxy you point those at your gateway and allowlist the gateway. The Maven and npm steps use their own configuration: Maven follows the proxies and mirrors in your settings.xml, and npm follows .npmrc. TLS uses the host’s system trust store, so a proxy that performs TLS interception must have its CA already trusted on the runner.
Reducing outbound calls
Advisory responses are cached on disk under the --cache-dir (default .argus-cache/); persisting that directory between CI runs means repeat advisories are served without touching the network. To drop the two optional feeds (api.first.org and www.cisa.gov) while still producing the report, set ARGUS_EXPLOIT_INTEL=off, or leave the PDF report disabled entirely. Pointing Maven and npm at an internal mirror keeps registry traffic inside your network.