{"id":116830,"date":"2026-09-10T01:34:28","date_gmt":"2026-09-10T01:34:28","guid":{"rendered":"https:\/\/youzum.net\/google-open-sources-mantis-a-modular-skills-toolkit-that-lets-coding-agents-find-reproduce-and-patch-vulnerabilities\/"},"modified":"2026-09-10T01:34:28","modified_gmt":"2026-09-10T01:34:28","slug":"google-open-sources-mantis-a-modular-skills-toolkit-that-lets-coding-agents-find-reproduce-and-patch-vulnerabilities","status":"publish","type":"post","link":"https:\/\/youzum.net\/de\/google-open-sources-mantis-a-modular-skills-toolkit-that-lets-coding-agents-find-reproduce-and-patch-vulnerabilities\/","title":{"rendered":"Google Open-Sources Mantis: A Modular Skills Toolkit That Lets Coding Agents Find, Reproduce and Patch Vulnerabilities"},"content":{"rendered":"

Google has open-sourced Mantis<\/a>, a stack-agnostic toolkit of security review skills that lets an AI coding agent run the whole vulnerability lifecycle. It finds a suspected flaw, strips the false positives, reproduces the bug inside a sandbox, writes a minimal patch, re-attacks that patch, and scores the residual risk. <\/p>\n

Mantis is not a scanner you aim at a repository and walk away from. It is a set of slash commands your existing coding agent loads, plus a strict set of rules about where that agent is allowed to execute code.<\/p>\n

Is it deployable?<\/strong> Yes for local and internal evaluation, not yet for production. You can clone it today and run it with Gemini CLI<\/a>, Antigravity CLI, the Google ADK, or any comparable agent framework. <\/p>\n

The pipeline<\/strong><\/h2>\n

Mantis publishes each stage as a separate skill directory, invoked as a slash command and chained sequentially. A supervisor skill, \/mantis-meta-agent<\/code>, can drive the whole loop in a long-lived session.<\/p>\n

The early stages learn the target: \/mantis-history<\/code> mines version control history for past security fixes, \/mantis-summarize<\/code> writes the directory maps, \/mantis-architecture<\/code> builds a Markdown knowledge base, \/mantis-threat-model<\/code> derives trust boundaries, and \/mantis-plan<\/code> produces a targeted roadmap.<\/p>\n

The middle stages find and filter: \/mantis-researcher<\/code> sweeps files against the plan, then \/mantis-dedupe<\/code>, \/mantis-review<\/code> and \/mantis-critic<\/code> collapse duplicates, apply negative rules, and drop issues that cannot occur in a release build.<\/p>\n

The late stages prove and fix: \/mantis-reproduce<\/code> executes payloads in gVisor or a VM with networking disabled, \/mantis-chain<\/code> assembles multi-step exploit chains from individually confirmed findings, \/mantis-patch<\/code> applies and verifies the fix, \/mantis-calibrate<\/code> assigns a risk score from 1 to 10, \/mantis-reflect<\/code> writes learnings back for the next pass, and \/mantis-report<\/code> produces the human-readable review packet.<\/p>\n

A newer skill, \/mantis-advise<\/code><\/a>, inverts the flow. It queries the accumulated threat model, past bug lineages and verified patch patterns before you write code, so the same class of bug does not land twice.<\/p>\n

<\/p>\n

\n<\/div>\n

\n

But why?<\/strong><\/h2>\n<\/p>

Most agentic security tooling stops at generating findings. Mantis is interesting because it treats the reproducer and the re-attack as the trust boundary, and because it publishes the inter-stage contracts so teams can wrap the skills in a deterministic harness instead of trusting an LLM to orchestrate shell commands. <\/p>\n

Key Takeaways<\/strong><\/h2>\n