google/mantis

What it solves

Mantis provides a structured, sequential set of skills for AI coding agents to perform automated defensive security reviews. It addresses the complexity of using non-deterministic LLMs for vulnerability discovery by providing a decoupled pipeline that can identify, verify, and attempt to patch security flaws.

How it works

The toolkit operates through a series of specialized, sequential stages (skills) that can be executed manually or orchestrated by an agent. The workflow includes analyzing version control history, building a semantic knowledge base of the architecture, developing a threat model, researching flaws, verifying findings to filter false positives, generating proof-of-concept crash reproducers in sandboxes, and applying minimal fixes.

Who it’s for

It is designed for security researchers and developers using AI coding agents who need a portable, extensible framework to automate vulnerability research and red-teaming within isolated, secure environments.

Highlights

• Sequential Pipeline: Offers a multi-step workflow from architectural analysis to final security report generation.
• Sandbox-Centric: Designed to run code execution and reproduction steps inside isolated environments like Docker or gVisor to mitigate risks from AI-generated payloads.
• Extensible Skills: Can be adapted for specialized domains such as hardware (RTL), infrastructure as code, or compiled firmware.
• Knowledge-Driven: Uses a persistent Knowledge Base (KB) to maintain context across different stages of the review process.