- Published on
A Modular Skills Toolkit That Lets Coding Agents Find, Reproduce and Patch Vulnerabilities
- Authors
- Name
- DeepHorus
Google has open-sourced Mantis, a modular skills toolkit designed to enable AI coding agents to conduct end-to-end security reviews, from identifying vulnerabilities to generating and verifying patches. Unlike traditional scanners, Mantis operates as a set of slash commands that integrate with existing agent frameworks, providing a structured pipeline for vulnerability management.
The toolkit is released under the Apache 2.0 license, making it available for local and internal evaluation. However, Google states it is not yet recommended for production deployment. Developers can currently clone the repository and run it using compatible agents like Gemini CLI or the Google ADK.
Mantis structures its workflow into sequential stages, each represented by a specific skill. Early stages focus on learning the target codebase, with skills mining version control history and building a knowledge base. This foundational work informs the subsequent threat modeling and planning phases.
The middle stages handle vulnerability discovery and filtering. A researcher skill scans files, while others deduplicate findings and apply rules to drop false positives. Google highlights that naive AI code scanning can have true-positive rates below 7 percent, a problem Mantis aims to address through this rigorous filtering.
The final stages are dedicated to proof and remediation. Critically, Mantis reproduces confirmed vulnerabilities within a secure sandbox, such as gVisor or a disabled VM, before attempting to write and verify a patch. It then re-attacks the patched code to assess residual risk, scoring it from 1 to 10.
A key differentiator is this focus on grounded verification—reproduction and re-attack—rather than relying solely on model confidence. This approach provides a more reliable trust boundary for automated security analysis. The toolkit also incorporates a skill to learn from each review cycle for future passes.
Google reports that Mantis employs a hierarchical summary system that reduces token overhead by over 85 percent, optimizing efficiency. The project is positioned as a toolkit for augmenting coding agents, not as a standalone scanner or a directly supported Google product, offering a framework for teams to build deterministic security harnesses.
