Mantis – AI‑Powered Toolkit for Secure Software Development

What it is Mantis is an open‑source collection of skills (prompt‑driven agents) and a reference harness (the ADK) that lets you run autonomous, LLM‑based security reviews of code. It stitches together several AI‑driven steps—historical vulnerability lookup, code indexing, threat‑model generation, hypothesis testing, exploit reproduction, and even automated patching—into a repeatable workflow.

Core capabilities

• Historical vulnerability audit – scans a repository’s commit history for patterns that previously led to bugs.
• Semantic code index – builds a searchable representation of the codebase to aid navigation and reasoning.
• Automated threat modeling – produces a high‑level model of attack surfaces based on the code structure.
• Hypothesis generation & research – creates focused research tasks (e.g., “look for IDOR”) that individual agents execute.
• Finding deduplication & hallucination filtering – cross‑checks results to reduce false positives from LLMs.
• Exploit reproduction – attempts to turn a reported issue into a unit test, mock server, or other reproducible artifact.
• Chained vulnerability discovery – links multiple findings to surface more impactful attack chains.
• Adversarial patch generation – proposes code fixes and validates them by re‑running the discovery loop.
• Risk calibration – scores findings against a configurable rubric to surface truly critical issues.
• Advice skill (/mantis-advise) – can be invoked during development to suggest safer coding patterns based on the accumulated knowledge.

Typical workflow

1. Install the Python environment (install.sh) and authenticate to Google Cloud if you want to use Vertex AI models.
2. Run the auto‑configuration script (configure.py --auto) which detects available models, budgets, and sandbox options.
3. Launch a review with ./run.sh <path>; optionally add --focus "look for IDOR" or an --objective to synthesize a custom agent graph.
4. Review the generated report, verify findings manually, and optionally let Mantis attempt automated patches.

Intended audience

• Security teams that want to augment manual code reviews with LLM‑driven analysis.
• Developers looking for an AI assistant that can warn about risky patterns before code lands in production.
• Organizations that need a sandboxed, extensible framework for research‑grade vulnerability discovery.

Safety & disclaimer Mantis runs autonomously generated code and may execute unstable or malicious payloads. The README stresses:

• Use only in isolated, restricted environments.
• All findings must be manually validated by a security expert.
• The project is not an officially supported Google product and is not covered by Google’s vulnerability‑rewards program.

How to get started

# Install venv tools
sudo apt install python3-venv

# Clone and install
git clone https://github.com/google/mantis.git
cd mantis/reference && ./install.sh

gcloud auth application-default login   # if using Vertex AI
python3 scripts/configure.py --auto      # auto‑detect models & limits
./run.sh path/to/your/code               # start a review

Extensibility The repository includes a reference/workflow.json that defines a graph of agentic steps. Users can modify this JSON or write new skills (prompt templates) to target specialized domains such as hardware description languages, IaC, ML pipelines, or firmware.

Bottom line Mantis is a proof‑of‑concept platform that demonstrates how large language models can be orchestrated into a full‑stack security audit pipeline. It is powerful but requires careful sandboxing and expert oversight before any findings are acted upon.