Summary

Mantis is a modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch software vulnerabilities. It provides a portable set of security review skills, enabling automated vulnerability analysis and remediation.

How It Works

Mantis operates as a decoupled, sequential pipeline of specialized skills orchestrated by AI coding agents. Its core approach iteratively synthesizes codebase understanding, develops threat models, plans scans, researches flaws, and generates/verifies patches. This modular design allows adaptation to diverse stacks (RTL, IaC, ML) by leveraging AI to refine skills based on internal documentation.

Quick Start & Requirements

Setup involves cloning the repository and integrating with a compatible AI coding agent framework (e.g., Gemini CLI). Key prerequisites include a configured local CLI, Docker for containerized execution, and optionally gVisor (runsc) for enhanced security. Cloud SDKs are needed for remote sandbox execution. Detailed guides, including unattended cloud deployment, are in the "Agent Reference Guide."

Highlighted Details

• Autonomous Vulnerability Lifecycle: Covers discovery, reproduction, and automated patching.
• Modular Skill Pipeline: Features a 15-stage sequential workflow (e.g., /mantis-plan, /mantis-researcher, /mantis-reproduce, /mantis-patch) adaptable to specific needs.
• Stack Agnostic & Extensible: Adaptable for specialized domains like Hardware/RTL, IaC, ML pipelines, and firmware.
• AI-Driven Iteration: Employs AI for skill refinement and potential self-improvement based on empirical outcomes.

Maintenance & Community

This project is explicitly "not an officially supported Google product" and is not eligible for the Vulnerability Rewards Program. No specific community channels or active maintenance signals are detailed in the provided README.

Licensing & Compatibility

The README does not specify a license. The project is intended strictly for demonstration purposes and is not suitable for production environments. Commercial use or linking with closed-source projects is not addressed and likely restricted.

Limitations & Caveats

Mantis carries significant warnings: it generates and executes potentially unstable, autonomously generated code, requiring extreme caution and isolated, restricted environments. AI models are non-deterministic, prone to hallucinations, and findings/patches require manual verification. The instructions do not guarantee absolute safety, and the project is explicitly not for production use.