Mantis: Portable Toolkit for Building Secure Software
A Google toolkit of skills and an ADK harness that let AI coding agents autonomously find, reproduce and patch vulnerabilities in a codebase, with human review built into the process.
Mantis is a set of skills paired with an Agent Development Kit reference harness for building secure software with AI agents. It reviews a codebase's history for vulnerabilities the team does not want to repeat, builds a semantic index for navigation, generates a threat model, and forms hypotheses that individual agents research, from scanning single files to broader sweeps.
Findings are deduplicated, triaged to reduce false positives, and reproduced to varying degrees, from a static guess at an exploit up to a unit test or a mock server. Verified vulnerabilities are then patched using an adversarial loop that checks the fix actually holds, and a rubric calibrates reported severity to counter model inflation of risk. The project requires isolated, restricted environments and manual verification of every finding by a security expert before it is reported. It is written in Python and licensed under Apache 2.0.