google/mantis

What it solves

Mantis addresses the challenge of building secure software by automating the discovery, verification, and patching of vulnerabilities. It aims to reduce the repetition of historical security mistakes and combat the "severity inflation" often seen in AI-generated security reports by calibrating findings against a rubric.

How it works

Mantis uses an agentic workflow to perform deep security reviews. It builds a semantic index of a codebase, generates threat models, and creates research hypotheses. Agents then execute these plans to find vulnerabilities, which are then triaged to remove hallucinations. The system attempts to reproduce bugs (ranging from static guesses to spinning up mock servers), chains vulnerabilities for higher impact, and applies patches using an adversarial loop to verify the fix.

Who it’s for

It is designed for security researchers and developers who want to automate vulnerability discovery and secure coding practices, provided they have a suitably isolated environment to run the autonomously generated code.

Highlights

• Agentic Workflows: Uses an ADK reference harness to build custom research graph topologies on the fly.
• End-to-End Remediation: Not only finds bugs but attempts to reproduce them and patch them using an adversarial verification loop.
• Risk Calibration: Uses a specific rubric to ensure critical risks are prioritized over a high volume of low-impact AI-generated alerts.
• Knowledge Integration: Reviews codebase history and provides a /mantis-advise skill to prevent the repetition of prior security mistakes during development.