Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.ironclawdevs27/argus

NPM · ARGUSQA-OS · SCANNED SEP 24

Automated web QA via Chrome DevTools MCP — a11y, security, visual, env diff, CI; Aegis redaction.

Available components

0 this week 80 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security90
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects @opentelemetry/propagator-jaeger 2.8.0, reached via @opentelemetry/sdk-node > @opentelemetry/propagator-jaeger. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 62 of 219 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 67 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability67
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2317 tokens (~257/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
  • Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.ironclawdevs27/argus MCP server?

io.github.ironclawdevs27/argus runs locally as an npm package, launched with npx -y argusqa-os. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · argusqa-os

# add to Claude Code
claude mcp add ironclawdevs27-argus -- npx -y argusqa-os
// .cursor/mcp.json
{
  "mcpServers": {
    "ironclawdevs27-argus": {
      "command": "npx",
      "args": [
        "-y",
        "argusqa-os"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "ironclawdevs27-argus": {
      "command": "npx",
      "args": [
        "-y",
        "argusqa-os"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add ironclawdevs27-argus -- npx -y argusqa-os
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ironclawdevs27-argus": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "argusqa-os"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add ironclawdevs27-argus --command npx --arg -y --arg argusqa-os
# ~/.hermes/config.yaml
mcp_servers:
  ironclawdevs27-argus:
    command: "npx"
    args: ["-y", "argusqa-os"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "ironclawdevs27-argus": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "argusqa-os"
      ]
    }
  }
}
# add to Vellum
assistant mcp add ironclawdevs27-argus -t stdio -c npx -a -y argusqa-os
// mcp.json
{
  "mcpServers": {
    "ironclawdevs27-argus": {
      "command": "npx",
      "args": [
        "-y",
        "argusqa-os"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 23 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 21 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 20 Sept 26 −3
    • Stability: pass → 0.83 functional
  • 19 Sept 26 +1
    • Stability: 0.97 → pass security
  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 12 Sept 26 +1
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 24 Sept 2026 · Analysed npm/argusqa-os@10.0.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-45rx-2jwx-cxfr CVE-2026-59892 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 219 packages
Packages resolved 219
Stale 62
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 9 exposed · ~2,317 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
argus_audit ~345

Fast QA audit on a URL via Chrome DevTools Protocol. One-pass detection sweep: JS errors, unhandled rejections, network failures (4xx/5xx), CORS errors, API frequency loops, slow APIs and blocking third-party requests, API contract violations, sync XHR, document.write, long tasks, service worker failures, debugger statements, duplicate IDs, SEO violations, security header checks, content quality, Chrome DevTools Issues panel, and HTTPS enforcement. Returns { findings: [{severity, type, message, url}], summary: {critical, warning, info} }. Use for CI smoke tests and pre-deploy gates. Pass cache: true to skip re-crawl on repeat calls to the same URL within a session — useful in tight fix loops. For Lighthouse scoring, CSS analysis, responsive checks, and memory leak detection, use argus_audit_full. Requires Chrome running with --remote-debugging-port=9222.

NameTypeReqDescription
cachebooleanWhen true, returns the cached result for this URL if one exists (from a previous argus_audit call in this session) without re-crawling. Use in fix loops to cheaply re-read the last audit while iterat…
criticalbooleanWhen true, console.error calls are escalated to critical severity. Set true for business-critical routes (login, checkout, dashboard) where any error is a blocker.
urlstringyesFull URL to audit, including protocol and path (e.g. http://localhost:3000/checkout). Must be reachable by the running Chrome instance.

No output schema declared.

No examples provided.

argus_audit_full ~184

Deep QA audit — extends argus_audit with Lighthouse performance/accessibility scoring, responsive layout checks across 4 viewports (320/768/1280/1920px), memory leak detection via heap snapshot, hover-state regression detection, and accessibility tree snapshot. Returns full JSON report with findings by severity, Lighthouse scores, and layout overflow details. Use when argus_audit passes clean but visual or performance regressions are suspected. Requires Chrome running with --remote-debugging-port=9222.

NameTypeReqDescription
criticalbooleanWhen true, console.error calls are escalated to critical severity. Set true for business-critical routes (login, checkout, dashboard) where any error is a blocker.
urlstringyesFull URL to audit, including protocol and path (e.g. https://example.com/dashboard). Must be reachable by the running Chrome instance.

No output schema declared.

No examples provided.

argus_compare ~113

Diffs dev vs staging environments side-by-side. Navigates both URLs, captures screenshots, and runs the full analyzer suite on each, then surfaces regressions — findings present in staging but not dev, or with changed severity. Returns { regressions: [{type, devSeverity, stagingSeverity}], screenshots, summary }. Run before promoting a build to staging to catch environment-specific bugs. Set TARGET_DEV_URL and TARGET_STAGING_URL env vars before starting the server; omit TARGET_STAGING_URL to run CSS-analysis-only mode.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

argus_design_audit ~261

Full design-to-implementation fidelity audit against a Figma frame. 13 mismatch finding types: CSS token values, component presence, fill/text color (RGB delta), typography (fontSize/fontWeight/lineHeight/fontFamily/letterSpacing), Auto Layout padding and gap, border-radius (per-corner), bounding-box overflow, absolute position drift (scroll-corrected x/y, 20px threshold), border stroke (color+weight), box-shadow (offset+blur+spread+color), opacity, and text content. Selector fallback: tries [data-testid], [aria-label], #id, .class per node. Requires FIGMA_API_TOKEN env var and Chrome on --remote-debugging-port=9222. Returns { findings, summary } where summary includes 13 mismatch-type counts.

NameTypeReqDescription
figmaFrameUrlstringyesFigma frame URL to fetch design tokens from (e.g. https://www.figma.com/file/ABC123/Name?node-id=42%3A0). Must include the node-id query parameter pointing to the specific frame.
urlstringyesFull URL of the page to audit (e.g. http://localhost:3000/dashboard). Must be reachable by the running Chrome instance.

No output schema declared.

No examples provided.

argus_get_context ~348

Captures everything currently broken on the open Chrome tab and formats it as a diagnostic context for Claude to read and suggest fixes. Does NOT navigate — reads the live tab state after user interactions, in authenticated sessions, or mid-flow. Returns { snapshot_id, summary, url, timestamp, critical_issues, warnings, js_errors, network_failures, console_errors, recent_requests, open_tabs }. Fix loop: pass the snapshot_id from a previous call as snapshot_id to get a diff — the response will include resolved (cleared since last snapshot), new_issues (appeared since last snapshot), and persisting (unchanged). Multi-tab: pass tabId to inspect a specific tab, or omit to read the active tab. The open_tabs array always lists all currently open Chrome tabs. Workflow: call argus_get_context → Claude suggests fix → apply fix → call argus_get_context with snapshot_id → verify resolved array is non-empty. Requires Chrome on --remote-debugging-port=9222.

NameTypeReqDescription
snapshot_idstringOptional snapshot_id from a previous argus_get_context call. When provided, the response includes resolved/new_issues/persisting arrays showing what changed since that snapshot.
tabIdstringOptional Chrome page/tab ID. When provided, switches focus to that specific tab before capturing context — useful for SPAs that spawn new windows (e.g. OAuth popups, checkout flows). Get tab IDs from…
urlstringOptional base URL to attribute findings to (default: TARGET_DEV_URL env var). Does not navigate — inspects the currently open Chrome tab.

No output schema declared.

No examples provided.

argus_last_report ~80

Returns the most recent Argus JSON report from the reports/ directory. Report includes a findings array and severity summary (critical/warning/info counts). Returns { "error": "No reports found in reports/" } when no audits have been run yet. Use to retrieve prior results without re-running a scan, or to pipe findings into another analysis tool.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

argus_pr_validate ~543

Runs a targeted Argus audit on the routes affected by a GitHub pull request. Fetches the PR diff, maps changed files to routes in your target config using path-slug heuristics (infrastructure changes trigger a full audit; targeted otherwise) — or, when ARGUS_SOURCE_DIR points at the checked-out app source, framework-aware import-graph mapping that narrows a changed component or stylesheet to only the routes whose pages import it (Next.js + monorepo-aware, conservative-fallback on any ambiguity) — and audits only those routes — faster than a full scan and focused on what the PR actually touched. The audit target is resolved per-PR: an explicit targetUrl, else the PR's deploy-preview URL (ARGUS_PREVIEW_URL or opt-in GitHub-Deployments auto-detection), else TARGET_DEV_URL. Routes are audited with bounded concurrency (ARGUS_CONCURRENCY) and each route audit is timeout-bounded (ARGUS_ROUTE_TIMEOUT_MS) so a hung audit blocks rather than silently passing. Returns { findings, affectedRoutes, changedFiles, perRoute, summary, blocked, blockOn, baseline, reporting }. Blocking is baseline-aware: it gates on the findings the PR introduces vs a stored per-branch baseline (reports/baselines/<base-branch>.json, restored via actions/cache), failing safe to absolute counts when no baseline is available. When GITHUB_TOKEN and a resolvable PR are present it also posts/updates an Argus PR comment (surfacing new/persisting/resolved counts) and a GitHub Check Run (the same reporting the CI Action produces) — best-effort, never alters the block decision. Use in CI to gate merges: check blocked:true or pipe findings to an AI verdict step. Requires Chrome on --remote-debugging-port=9222. GITHUB_TOKEN env var recommended for private repos.

NameTypeReqDescription
blockOnstring"critical" = block only when critical findings exist. "warning" = block on any warning or critical. "none" = never block. Defaults to ARGUS_BLOCK_ON env var, then "critical".
githubTokenstringGitHub Personal Access Token or workflow GITHUB_TOKEN. Optional for public repos. Falls back to GITHUB_TOKEN env var.
prUrlstringyesFull GitHub PR URL (e.g. https://github.com/owner/repo/pull/42). Used to fetch the list of changed files via the GitHub REST API.
targetUrlstringBase URL to audit (e.g. https://staging.example.com). Overrides TARGET_DEV_URL env var.

No output schema declared.

No examples provided.

argus_visual_diff ~232

Screenshot baseline comparison for a URL — captures a PNG screenshot and compares it pixel-by-pixel against a stored baseline using pixelmatch. First call: saves baseline, returns visual_baseline_created (info). Subsequent calls: returns visual_regression (warning ≥0.1% / critical ≥5% pixels changed) + visual_diff_summary (always). Baseline stored in reports/baselines/screenshots/. Use in CI or fix loops to detect unintended visual regressions without a full audit. Pass updateBaseline: true to force-refresh the stored baseline (e.g. after intentional UI changes). Requires Chrome on --remote-debugging-port=9222.

NameTypeReqDescription
baselineDirstringOptional override for the baseline storage directory. Defaults to reports/baselines/screenshots/.
updateBaselinebooleanWhen true, deletes the existing baseline PNG and saves a fresh one from the current screenshot. Use after intentional UI changes to reset the reference.
urlstringyesFull URL to capture and compare (e.g. http://localhost:3000/dashboard). Must be reachable by the running Chrome instance.

No output schema declared.

No examples provided.

argus_watch_snapshot ~211

Snapshots the currently open Chrome tab without navigating — captures console errors, network failures (4xx/5xx), CORS blocks, and auth failures in one poll. Returns { findings: [{severity, type, message, url}], newConsole, newNetwork }. Use during active development to inspect what is happening on the current page without running a full audit. Pass tabId to inspect a specific tab (get IDs from argus_get_context or list_pages). Without tabId, reads the active tab. Requires Chrome on --remote-debugging-port=9222 with a page already open.

NameTypeReqDescription
tabIdstringOptional Chrome page/tab ID (e.g. from a prior argus_get_context response). When provided, switches focus to that tab before snapshotting — useful for SPAs that spawn new windows or multi-tab flows.
urlstringOptional base URL to attribute findings to (default: TARGET_DEV_URL env var). Does not navigate — reads the currently open Chrome tab.

No output schema declared.

No examples provided.

Common questions

What is the io.github.ironclawdevs27/argus MCP server?

io.github.ironclawdevs27/argus is an MCP server listed in the public MCP registry as io.github.ironclawdevs27/argus. Automated web QA via Chrome DevTools MCP, a11y, security, visual, env diff, CI; Aegis redaction. This page covers its npm package (argusqa-os).

Is the io.github.ironclawdevs27/argus MCP server safe to use?

io.github.ironclawdevs27/argus scores 80 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 24 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.ironclawdevs27/argus MCP server expose?

io.github.ironclawdevs27/argus exposes 9 tools: argus_audit, argus_audit_full, argus_compare, argus_last_report, argus_watch_snapshot, and 4 more. Their descriptions and schemas cost roughly 2,317 tokens of context every time the server is loaded.

Is the io.github.ironclawdevs27/argus MCP server still maintained?

io.github.ironclawdevs27/argus is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.ironclawdevs27/argus MCP server under?

io.github.ironclawdevs27/argus declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.