Argus watches your whole fleet through one static agent: patch compliance it can prove, CVEs straight from Wazuh, Apple MDM that never wipes a machine, and backups only you hold the keys to. Open-source core, running on your own metal.
An empty panel in Argus says No data, because that is what Argus knows. Patch reconciliation trusts only the package managers the agent actually enumerated on this scan, so a Homebrew that failed to run can never impersonate a healthy Mac. When a scanner errors, the job fails loudly instead of reporting a clean sweep.
Your dashboard is evidence. If it glows green, a scanner earned it.
Every capability below is shipped and running in production against a live MSP fleet.
The agent runs softwareupdate, apt, dnf, winget and brew itself, reports which sources it enumerated, and the server reconciles only those. Severity, version and reboot flags come from the scanner output, never from a guess.
Wazuh agents map to devices automatically. Live CVEs with CVSS, alerts scoped per endpoint in the indexer, CIS benchmark scores on every device page.
Existing Macs enroll over UAMDM with no erase. New Macs arrive supervised through DEP zero-touch. Remote desktop rides macOS's own Screen Sharing, so there is no screen-recording permission chase, and privacy permissions push as a PPPC profile.
A single static Go binary, around 13 MB, CGO-free, no runtime dependencies. It enrolls, registers itself as a service and starts reporting in one command.