Mantis

What it is

Mantis is a set of skills plus an ADK reference harness for autonomous vulnerability discovery, reproduction, and patching. The page's value beyond the catalog summary is the concrete setup/run interface and a set of hard operational constraints the summary softens into "safeguards."

How it works

The pipeline (not fully spelled out in the summary) runs: review git history for past vulns → build a semantic index → auto-generate a threat model → form per-agent hypotheses (or "scan every file") → execute research plans → dedupe → triage/critique to fight hallucination and statically check viability → reproduce (from a static exploit guess up to a unit test or a spun-up mock server) → chain findings → patch via an adversarial fix-verification loop → calibrate severity against a rubric → reflect each iteration. reference/workflow.json defines the deep-review graph; --objective synthesizes custom graph topologies on the fly.

What to do

Install and run:

sudo apt install python3-venv
cd reference && ./install.sh
gcloud auth application-default login
python3 scripts/configure.py --auto
python3 scripts/configure.py --test --probe
./run.sh path/to/code

Targeted review against an objective:

./run.sh path/to/code --objective "Audit for Server-Side Request Forgery and SSRF in webhook handlers"

The harness works out of the box on ADK but is meant to be ported to your own agent framework and tuned to your stack (Hardware/RTL, IaC, ML pipelines, firmware), including adapting risk calibration to your own tolerance.

Caveats

These are the decision-relevant facts the summary omits:

• Not a supported product. Explicitly "not an officially supported Google product," "demonstration purposes only," "not intended for use in a production environment," and ineligible for Google's OSS VRP.
• The bundled sandbox is not sufficient for frontier models. The page says if you use the most advanced frontier models you must add a further sandboxing layer with strong monitoring for escape attempts — i.e. gVisor alone is treated as a floor, not the ceiling.
• Never run near anything real. "Never run this suite on a machine with access to production systems, sensitive data, or internal networks." It executes autonomously generated, possibly unstable code.
• Findings are unverified by default. All findings must be manually verified by a security expert; do not mass-file AI-generated reports to maintainers. A failed reproduction does not prove a false positive, and a successful reproducer does not prove exploitability in context.

flowchart LR
  A[Generated finding] --> B{Manual expert<br/>verification}
  B -->|verified| C[Report]
  B -->|unverified| D[Do NOT file]
  E[Frontier model] --> F{gVisor sandbox<br/>sufficient?}
  F -->|no| G[Add monitored<br/>sandbox layer]