Google open-sources Mantis, a modular skill toolkit that lets coding agents run the full

vulnerability lifecycle Google has released Mantis, an open-source, modular skills toolkit that equips an existing coding agent to execute the entire vulnerability-handling loop — from initial suspicion through false-positive filtering, sandbox reproduction, minimal patch authoring, re-attack verification, and residual risk scoring. Unlike a static scanner pointed at a repository and forgotten, Mantis is structured as a set of slash commands the agent loads, plus strict guardrails on where code may execute. The code is available today for local use and internal evaluation under Apache 2.0, though Google stresses it is not yet recommended for production and is not an officially supported Google product.

The pipeline: stages as discrete commands

Mantis decomposes its pipeline into separate skill libraries, each invoked as a command and chainable in sequence; a supervisor skill, `/mantis-meta-agent`, can drive the full loop in a long-lived session. Early stages learn the target: `/mantis-history` mines version-control history for prior security fixes, `/mantis-summarize` writes library maps, `/mantis-architecture` builds a Markdown knowledge base, `/mantis-threat-model` derives trust boundaries, and `/mantis-plan` produces a focused roadmap. Middle stages hunt and filter: `/mantis-researcher` scans files against the plan, then `/mantis-dedupe`, `/mantis-review`, and `/mantis-critic` collapse duplicates, apply exclusion rules, and discard findings that cannot appear in a release build. Late stages prove and remediate: `/mantis-reproduce` runs payloads in gVisor or a VM with network disabled, `/mantis-chain` assembles multi-step exploit chains from verified findings, `/mantis-patch` applies and validates the fix, `/mantis-calibrate` assigns a 1-to-10 risk score, `/mantis-reflect` writes lessons for the next pass, and `/mantis-report` emits a human-readable review bundle.

The trust boundary: reproduction and re-attack

What makes Mantis notable is not a larger language model but the architectural choice to treat reproduction and re-attack as the trust boundary. Most agentic security tools stop at finding generation; Mantis demands proof the bug actually exists in an isolated environment, then verifies the fix blocks the exploit. Google also publishes the inter-stage contracts so teams can wrap the skills in a deterministic harness instead of relying on an LLM to orchestrate shell commands freely.

Numbers: token overhead cut and low true-positive rate

According to Google, a hierarchical summary tree reduces token overhead by more than 85 percent — a meaningful figure for large codebases. The company cites a true-positive rate below 7 percent in naive AI code scanning as the problem Mantis is designed to solve; that number illustrates why aggressive filtering and actual reproduction are critical before developers waste time on noise.

A preventive skill: advise before writing

A newer skill, `/mantis-advise`, inverts the flow: it queries the accumulated threat model, prior bug lineages, and verified patch patterns before a line of code is written, aiming to prevent the same bug class from landing twice. The approach shifts the tool from reactive to preventive, though its real-world effectiveness will only be proven once teams integrate it into daily workflows.

Availability and supported frameworks

The code lives at `google/mantis` on GitHub and runs with Gemini CLI, Antigravity CLI, Google's ADK, or any comparable agent framework. Documentation includes a quick-start guide, an agent reference guide, and a cloud CISO perspective. The bottom line: Mantis is not a one-click security fix, but modular infrastructure for building a verified, measurable process — provided you have the agent, the resources to run sandboxes, and the patience to tune the rules.