{"id":51576466,"url":"https://github.com/google/mantis","last_synced_at":"2026-07-26T07:00:44.137Z","repository":{"id":365564531,"uuid":"1270567918","full_name":"google/mantis","owner":"google","description":"A modular, stack-agnostic toolkit of security review skills for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.","archived":false,"fork":false,"pushed_at":"2026-07-19T22:03:32.000Z","size":424,"stargazers_count":436,"open_issues_count":1,"forks_count":48,"subscribers_count":3,"default_branch":"main","last_synced_at":"2026-07-19T22:21:19.353Z","etag":null,"topics":["ai-agents","antigravity","antigravity-cli","application-security","application-security-tools","code-review","devsecops","gemini-api","gemini-cli","hardware-security","llm","multi-agent-systems","prompt-engineering","sast","security","static-analysis","threat-modeling","vulnerability-detection"],"latest_commit_sha":null,"homepage":"https://cloud.google.com/","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/google.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-06-15T20:58:00.000Z","updated_at":"2026-07-19T22:03:36.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/google/mantis","commit_stats":null,"previous_names":["google/mantis"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/google/mantis","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fmantis","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fmantis/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fmantis/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fmantis/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/google","download_url":"https://codeload.github.com/google/mantis/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fmantis/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35904303,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-26T02:00:06.503Z","response_time":89,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-agents","antigravity","antigravity-cli","application-security","application-security-tools","code-review","devsecops","gemini-api","gemini-cli","hardware-security","llm","multi-agent-systems","prompt-engineering","sast","security","static-analysis","threat-modeling","vulnerability-detection"],"created_at":"2026-07-11T01:00:25.296Z","updated_at":"2026-07-26T07:00:44.130Z","avatar_url":"https://github.com/google.png","language":null,"funding_links":[],"categories":["Others","Agentic AI Security Skills"],"sub_categories":["Data \u0026 Supply Chain Security"],"readme":"# Mantis Skills: Portable Toolkit for Building Security Review Harnesses\n\n\u003e [!CAUTION] **USE AT YOUR OWN RISK. BE EXTREMELY CAREFUL.** This suite is\n\u003e designed to generate and execute autonomously generated code that may be\n\u003e unstable or perform unexpected actions. **USE THIS ONLY IN ISOLATED,\n\u003e RESTRICTED ENVIRONMENTS.** Never run this suite on a machine with access to\n\u003e production systems, sensitive data, or internal networks. See the \"Unattended\n\u003e Cloud Deployment\" section for mandatory hardening requirements.\n\n\u003e [!IMPORTANT] **RESPONSIBLE USE** AI models are non-deterministic and can\n\u003e hallucinate findings or generate incorrect patches. **All findings must be\n\u003e manually verified by a security expert before being reported.** Do not\n\u003e mass-file unverified, AI-generated reports to open-source maintainers. A\n\u003e failure to automatically reproduce a vulnerability does not definitively mean\n\u003e it is a false positive, nor does a successful reproducer guarantee the bug is\n\u003e exploitable in all contexts. Use these skills responsibly.\n\nMantis is a decoupled, sequential, and security-focused set of skills designed\nfor use with Coding Agents. It is intended to be a starting point rather than a\nrigid set of instructions. You should adapt, tune, and extend these skills to\nfit your organization's specific software or hardware stack.\n\nThe Mantis skills can be adapted to\n[specialized domains](README_AGENTS.md#adaptability--specialized-domains) (such\nas Hardware/RTL, Infrastructure as Code, ML pipelines, or compiled firmware).\n\nWe strongly recommend using AI to iterate on these skills and using your\ninternal documentation, coding standards, and build systems to augment the\nthreat model. We also strongly recommend adapting risk calibration to your\nenvironment and risk tolerance.\n\nFor more information on securing AI systems, see Google's\n[Secure AI Framework (SAIF)](https://safety.google/safety/saif/).\n\nAbove all, while orchestrated vulnerability discovery is incredibly powerful and\nuseful, it is even more important to use this in a suitably isolated environment\nto prevent impacting production systems. See the notes on unattended cloud\ndeployment later in this guide.\n\n______________________________________________________________________\n\n## Architecture and Sequential Flow\n\nFor a detailed breakdown of the pipeline stages, sequential flow, and\ninter-stage contracts, please refer to the\n[Agent Reference Guide](README_AGENTS.md).\n\n______________________________________________________________________\n\n## Prerequisites and Setup\n\nBefore executing any skills, ensure your local CLI environment is fully\nconfigured. Because Mantis is intended to be platform agnostic we do not\nrecommend any specific software. We have used it with Gemini CLI and Antigravity\nCLI, among others. Any coding agent framework should work. We have used these\nskills successfully with both the Google ADK and Antigravity SDK. You might also\nconsider:\n\n1. **Docker** For testing containers.\n\n2. **gVisor (runsc)**: For enhanced security when executing untrusted\n   AI-generated crash reproducer code, register the `runsc` runtime in your\n   Docker daemon configuration (`/etc/docker/daemon.json`):\n\n   ```json\n   {\n     \"runtimes\": {\n       \"runsc\": {\n         \"path\": \"runsc\"\n       }\n     }\n   }\n   ```\n\n3. **Relevant Cloud SDKs**: If running remote cloud sandboxes instead of local\n   containers.\n\n### Installing the Skills\n\nYou can install these skills either globally (available across all projects) or\nlocally to a specific workspace. You can also ask your coding agent for help.\nClone this repo then tell your coding agent you want to use these skills to\nreview your codebase!\n\nTo install the skills via CLI:\n\n```shell\nnpx skills add google/mantis\n```\n\n______________________________________________________________________\n\n## Beginner's Guide \u0026 Best Practices\n\nIf you are new to automated AI-assisted defensive security reviews, keep these\nrecommendations in mind:\n\n### 1. \"Interactive Mode\" (Human-in-the-Loop)\n\nTo get started with Mantis, you should run the pipeline in an \"Interactive\nMode\".\n\nLaunch your coding agent in your usual software or hardware development\nworkflow. Then, type the slash commands (e.g., `/mantis-plan`) individually. Do\nnot use `--yolo` or `--dangerously-skip-permissions` flags or any kind of\nautomatic approval of actions without carefully considering the security\nimplications.\n\nYour coding agent should pause and prompt you for human approval before\nexecuting any sensitive command (especially when the `/mantis-reproduce` or\n`/mantis-patch` agents attempt write to files or run code). This allows you to\ninspect what the AI intends to run. To run without human approval you must\nimplemenent strong boundaries to keep the agents contained.\n\n### 2. Hardened Security \u0026 The \"No Host-Run\" Rule\n\nAI models can sometimes generate code payloads that break the host. Run scripts\nor generated code *only* inside a sandbox if you aren't reading them.\n\nThe `/mantis-reproduce` and `/mantis-patch` skills are explicitly instructed to\nexecute payloads inside isolated container environments with networking disabled\n(`--network none`, for example), but you still must take care to ensure that\nthey don't make mistakes and skip this step.\n\n**Disclaimer:** While these instructions are designed to maintain isolation,\n**AI agents are non-deterministic**. They may occasionally attempt unsafe\nactions or bypass intended constraints if the local environment allows it. These\ninstructions do NOT provide an absolute guarantee of safety. Always prioritize\nrunning this suite in a dedicated, isolated VM to provide a reasonable security\nboundary that the AI cannot escape.\n\n### 3. Model Choice \u0026 Tiered Efficiency\n\nTo maximize the speed and efficiency of your automated pipeline, you should\nstrategically pair the right\n[AI model class with the specific task](README_AGENTS.md#model-selection--efficiency-guidelines).\nYou do not need to use the heaviest, most advanced frontier models for every\nstage.\n\n### 4. Understanding False Positives (The \"Negative Filter\" Rule)\n\nAI-based scanning will produce\n[false positives](README_AGENTS.md#understanding-false-positives-the-negative-filter-rule)\n(the review stage applies negative rules to filter them).\n\n- **Expect Noise**: Customize the negative validation filters in\n  `/mantis-review` to match your codebase.\n- **Iterate Small**: Start with narrow-scope scans to tune the pipeline rather\n  than running a repository-wide sweep on Day 1.\n\n______________________________________________________________________\n\n## Running the Pipeline (Manual Mode)\n\nYou can execute the reviewing stages sequentially from **inside** your active\nCLI terminal.\n\n1. Start your CLI from your terminal.\n\n2. Inside the interactive UI prompt, type the skills sequentially:\n\n   ```text\n   # 0. (Optional) Analyze repository's version control system (VCS) history and extract past vulnerabilities\n   /mantis-history\n\n   # 0.5. (Optional) Build content-addressed semantic-unit index (manifest + catalog + query helper)\n   /mantis-structural-index\n\n   # 1. (Optional) Generate mantis-summary.md directory maps\n   /mantis-summarize\n\n   # 2. Synthesize codebase structure and historical learnings into the Markdown Knowledge Base\n   /mantis-architecture\n\n   # 3. Iteratively develop the project's living threat model based on the KB\n   /mantis-threat-model\n\n   # 4. Map target external boundary and build scanning roadmap, injecting KB references\n   /mantis-plan\n\n   # 5. Run multi-threaded/sequential security flaw sweep using injected context\n   /mantis-researcher\n\n   # 6. Consolidate overlapping files and duplicate bugs\n   /mantis-dedupe\n\n   # 7. Verify code validity \u0026 filter false positives\n   /mantis-review\n\n   # 8. Eliminate non-viable production issues\n   /mantis-critic\n\n   # 9. Generate proof-of-concept crash reproducers and run them in sandboxes\n   /mantis-reproduce\n\n   # 10. Combine validated individual findings into multi-step exploit chains\n   /mantis-chain\n\n   # 11. Apply minimal fixes and verify they block the crash reproducer\n   /mantis-patch\n\n   # 12. Calculate final matrix risk ratings and append to individual findings\n   /mantis-calibrate\n\n   # 13. Extract insights from execution trajectories and append to the learnings inbox\n   /mantis-reflect\n\n   # 14. Generate human-readable security review packet report\n   /mantis-report\n\n   # 15. (Manual Step) Review the report. Optionally, apply \u0026 commit approved patches to your codebase. To continue analysis, archive workspace/findings/ so it is empty. To pick up upstream code changes for the next pass, OPTIONALLY sync the target NON-DESTRUCTIVELY at this boundary only (e.g. `git fetch \u0026\u0026 git merge --ff-only`; SKIP the sync if the tree is dirty, detached, or has no upstream; NEVER `git reset --hard` / `git checkout -- .` / `git clean`). If you synced, force-refresh the Knowledge Base by re-running /mantis-architecture (Step 2) so it reflects the new code, then loop back to Step 2. See README_AGENTS.md#the-snapshot-model.\n   ```\n\n\u003e [!NOTE] **Interactive / manual mode runs in MODE-OFF by default**\n\u003e (byte-for-byte today's behavior: a point-in-time review of the current\n\u003e directory with all verdicts permitted). Run this way, the stages receive no\n\u003e `--snapshot_root` / `--snapshot_id` / `--state_root` arguments and no\n\u003e orchestrator pins a snapshot, so mid-run edits are not frozen, but the\n\u003e pipeline does **not** deadlock waiting for a snapshot. Enable the opt-in\n\u003e [Snapshot Model](README_AGENTS.md#the-snapshot-model) — via\n\u003e `/mantis-meta-agent` with `--sync`, or a harness that implements the pass\n\u003e lifecycle — for pinned, authoritative passes on a living codebase. When using\n\u003e `--sync`, the default `state_root` is the current working directory (typically\n\u003e the target repo root); if this is inside the target, pass\n\u003e `--state_root=\u003cpath outside the target\u003e` to avoid the colocated-state hazard\n\u003e (see `mantis-pipeline-adapter` Scenario 1).\n\n______________________________________________________________________\n\n## Building Deterministic Pipelines \u0026 Non-Determinism\n\nFor information on how to build production-grade deterministic pipelines\nwrapping these skills, and how to manage LLM non-determinism, see the\n[Agent Reference Guide](README_AGENTS.md).\n\n______________________________________________________________________\n\n## Advanced / Unattended Cloud Deployment (GCE)\n\nRunning the continuous review loop 24/7 in an unattended state requires a\nhardened environment to mitigate security risks (such as prompt injection). For\nthe step-by-step hardened Google Compute Engine (GCE) deployment guide, see the\n[Agent Reference Guide](README_AGENTS.md#advanced--unattended-cloud-deployment-gce).\n\n______________________________________________________________________\n\n## Meta-Agent Orchestration \u0026 Evaluation\n\nFor details on autonomous Meta-Agent execution and how to evaluate/optimize\nskill performance, see the [Agent Reference Guide](README_AGENTS.md).\n\n______________________________________________________________________\n\n## Roadmap / Future Work\n\n- **Continuous Pipeline (now supported, opt-in):** The pipeline can run as a\n  continuous review of a **living** codebase via the **snapshot-per-pass**\n  model: each pass pins its own immutable snapshot, every finding is stamped\n  with the snapshot it was discovered against, and the target is synced\n  **non-destructively at pass boundaries** only. This is **opt-in and default\n  off** — without `--sync` / snapshot arguments the pipeline behaves exactly\n  like a point-in-time review. Still future work: line/AST re-anchoring of\n  carried findings across code changes (rebasing reproducers/patches instead of\n  re-discovering them). See\n  [The Snapshot Model](README_AGENTS.md#the-snapshot-model).\n- **Skill Self-Improvement (Meta-Learning):** The current\n  `workspace/learnings.jsonl` and Knowledge Base (KB) architecture tracks\n  codebase-specific empirical outcomes to adapt the `THREAT_MODEL.md` and\n  context pointers. Future iterations of the pipeline could take this a step\n  further and use this historical data to reflect on and automatically rewrite\n  its own `SKILL.md` prompts. For example, if a certain type of hallucination is\n  repeatedly caught by the Critic, a self-improvement meta-agent could update\n  the Researcher's `SKILL.md` instructions to explicitly filter out that\n  specific pattern before it even reaches the Review stage. **Security Note:**\n  Committing automated changes to `SKILL.md` files must always be human-gated to\n  prevent an attacker from using prompt injection (e.g., via a malicious payload\n  in a target file) to trick the meta-agent into ignoring a vulnerability class\n  globally.\n- **Software Dark Factory:** Integrate this pipeline into an entirely AI driven\n  software development. Instead of vulnerable discovery for action by humans,\n  Mantis would become the autonomous vulnerability research and release gating\n  component of the dark factory. Before the dark factory can push to production,\n  it must have had N hours of adversarial vulnerability research or \"red\n  teaming\" by a pipeline like Mantis.\n\n______________________________________________________________________\n\n## Troubleshooting Guide\n\n### 1. Loop Iterations are Re-Evaluating the Same Code\n\n- **Symptom:** The loop keeps reviewing the same files and reporting identical\n  bugs.\n- **Solution:** Ensure `/mantis-architecture` completes successfully and writes\n  its synthesized knowledge to the `workspace/kb/` directory. The `/mantis-plan`\n  strategist checks this Knowledge Base to dynamically skip already analyzed\n  areas. Check that file permissions allow writing to `workspace/kb/`.\n\n### 2. Other Issues\n\n- **Symptom:** Something isn't working.\n- **Solution:** Ask an AI coding tool to review your pipeline and the\n  conversations or trajectories that are leading to the unexpected behavior.\n  They will often give you useful insights.\n\nThis is not an officially supported Google product. This project is not eligible\nfor the\n[Google Open Source Software Vulnerability Rewards Program](https://bughunters.google.com/open-source-security).\n\nThis project is intended for demonstration purposes only. It is not intended for\nuse in a production environment.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoogle%2Fmantis","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgoogle%2Fmantis","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoogle%2Fmantis/lists"}