Google has released Mantis, an open-source toolkit that allows coding agents to manage the full lifecycle of security flaws, from discovery to patching. The system identifies suspected errors, removes false alarms, reproduces bugs within a sandbox environment, generates minimal fixes, and re-tests those patches to assess remaining risk.
Mantis functions as a set of commands for existing coding agents rather than a standalone scanner. It operates alongside a strict rule set defining where code execution is permitted.
Is it ready for production? It is currently suitable for local and internal testing but not yet recommended for live environments. Developers can clone the repository and run it using Gemini CLI, Antigravity CLI, the Google ADK, or similar agent frameworks.
The pipeline
Mantis distributes each stage as a separate skill directory, triggered by slash commands and linked sequentially. A supervisor skill, /mantis-meta-agent, can manage the entire loop during a long-running session.
Early stages gather context: /mantis-history searches version control for past security fixes, /mantis-summarize creates directory maps, /mantis-architecture builds a Markdown knowledge base, /mantis-threat-model establishes trust boundaries, and /mantis-plan generates a targeted roadmap.
Mid-stage tools locate and filter issues: /mantis-researcher scans files against the plan, while /mantis-dedupe, /mantis-review and /mantis-critic remove duplicates, apply exclusion rules, and discard issues that cannot exist in a release build.
Final stages prove and fix problems: /mantis-reproduce runs payloads in gVisor or a VM with networking disabled, /mantis-chain assembles multi-step exploit chains, /mantis-patch applies and verifies the fix, /mantis-calibrate assigns a risk score from 1 to 10, /mantis-reflect saves learnings for future passes, and /mantis-report outputs the human-readable review packet.
A newer skill, /mantis-advise, reverses the workflow. It consults the accumulated threat model, historical bug lineages, and verified patch patterns before code is written to prevent the same class of bug from appearing twice.
Why this matters
Most agentic security tools stop at generating findings. Mantis differs by treating the reproducer and the re-attack as the trust boundary. It also publishes inter-stage contracts so teams can wrap the skills in a deterministic harness instead of relying on an LLM to orchestrate shell commands.
Key takeaways
- Mantis is a modular skills toolkit for coding agents, not a standalone scanner or a supported Google product.
- Its advantage lies in grounding: sandboxed reproduction and patch re-attack, rather than model confidence.
- A hierarchical summary tree reduces token overhead by over 85 percent, according to Google.
- Google cites sub-7 percent true-positive rates for naive AI code scanning as the problem Mantis targets.
- Deployable locally under Apache 2.0 but not recommended yet for production.
What it means
Developers building security workflows no longer need to trust an AI to orchestrate dangerous shell commands blindly. The toolkit offers a deterministic way to verify that a bug actually exists and that a fix actually works before moving forward.
