Google has open-sourced Mantis, a stack-agnostic toolkit of security review skills that lets an AI coding agent run the whole vulnerability lifecycle. It finds a suspected flaw, strips the false positives, reproduces the bug inside a sandbox, writes a minimal patch, re-attacks that patch, and scores the residual risk.
Mantis is not a scanner you aim at a repository and walk away from. It is a set of slash commands your existing coding agent loads, plus a strict set of rules about where that agent is allowed to execute code.
Is it deployable? Yes for local and internal evaluation, not yet for production. You can clone it today and run it with Gemini CLI, Antigravity CLI, the Google ADK, or any comparable agent framework.
The pipeline
Mantis publishes each stage as a separate skill directory, invoked as a slash command and chained sequentially. A supervisor skill, /mantis-meta-agent, can drive the whole loop in a long-lived session.
The early stages learn the target: /mantis-history mines version control history for past security fixes, /mantis-summarize writes the directory maps, /mantis-architecture builds a Markdown knowledge base, /mantis-threat-model derives trust boundaries, and /mantis-plan produces a targeted roadmap.
The middle stages find and filter: /mantis-researcher sweeps files against the plan, then /mantis-dedupe, /mantis-review and /mantis-critic collapse duplicates, apply negative rules, and drop issues that cannot occur in a release build.
The late stages prove and fix: /mantis-reproduce executes payloads in gVisor or a VM with networking disabled, /mantis-chain assembles multi-step exploit chains from individually confirmed findings, /mantis-patch applies and verifies the fix, /mantis-calibrate assigns a risk score from 1 to 10, /mantis-reflect writes learnings back for the next pass, and /mantis-report produces the human-readable review packet.
A newer skill, /mantis-advise, inverts the flow. It queries the accumulated threat model, past bug lineages and verified patch patterns before you write code, so the same class of bug does not land twice.
But why?
Most agentic security tooling stops at generating findings. Mantis is interesting because it treats the reproducer and the re-attack as the trust boundary, and because it publishes the inter-stage contracts so teams can wrap the skills in a deterministic harness instead of trusting an LLM to orchestrate shell commands.
Key Takeaways
- Mantis is a modular skills toolkit for coding agents, not a standalone scanner or a supported Google product.
- Its differentiator is grounding: sandboxed reproduction and patch re-attack, not model confidence.
- A hierarchical summary tree cuts token overhead by over 85 percent, per Google.
- Google cites sub-7 percent true-positive rates for naive AI code scanning as the problem Mantis targets.
- Deployable locally under Apache 2.0 but not recommended yet for production.