Google Open-Sources Mantis, a Skills Toolkit That Lets Coding Agents Find, Reproduce and Patch Vulnerabilities
Google has released Mantis under Apache 2.0, a modular set of security review skills that lets a coding agent take a suspected flaw through reproduction, patching and re-attack. It is available for local and internal evaluation, but not yet recommended for production.
Mantis is not a scanner that is pointed at a repository and left to run on its own. It is a set of slash commands that an existing coding agent loads, paired with rules about where that agent is permitted to execute code. Google says it can be cloned and run with Gemini CLI, Antigravity CLI, the Google ADK or any comparable agent framework. The company lists it as neither a standalone scanner nor a supported Google product.
The pipeline is published as separate skill directories, each invoked as a slash command and chained in sequence. A supervisor skill, /mantis-meta-agent, can drive the whole loop in a long-lived session. The early stages build knowledge of the target: /mantis-history mines version control history for past security fixes, /mantis-summarize writes directory maps, /mantis-architecture builds a Markdown knowledge base, /mantis-threat-model derives trust boundaries, and /mantis-plan produces a targeted roadmap.
The middle stages find and filter. /mantis-researcher sweeps files against the plan, after which /mantis-dedupe, /mantis-review and /mantis-critic collapse duplicates, apply negative rules and drop issues that cannot occur in a release build. The late stages prove and fix: /mantis-reproduce executes payloads in gVisor or a virtual machine with networking disabled, /mantis-chain assembles multi-step exploit chains from individually confirmed findings, /mantis-patch applies and verifies the fix, /mantis-calibrate assigns a risk score from 1 to 10, /mantis-reflect writes learnings back for the next pass, and /mantis-report produces a human-readable review packet.
A newer skill, /mantis-advise, inverts the flow. It queries the accumulated threat model, past bug lineages and verified patch patterns before code is written, so the same class of bug does not land twice.
Google frames the design around grounding rather than model confidence. The company cites true-positive rates below 7 percent for naive AI code scanning as the problem Mantis targets, and says a hierarchical summary tree cuts token overhead by more than 85 percent. Because the reproducer and the re-attack act as the trust boundary, and because the inter-stage contracts are published, Google says teams can wrap the skills in a deterministic harness instead of trusting a language model to orchestrate shell commands.