{"slug": "google-open-sources-mantis-a-modular-skills-toolkit-that-lets-coding-agents-find", "title": "Google Open-Sources Mantis: A Modular Skills Toolkit That Lets Coding Agents Find, Reproduce and Patch Vulnerabilities", "summary": "Google has open-sourced Mantis, a modular skills toolkit that lets AI coding agents find, reproduce, and patch software vulnerabilities, available under Apache 2.0 on GitHub. The toolkit chains slash commands such as /mantis-reproduce and /mantis-patch to sandbox bug reproduction and verify fixes, and Google reports it cuts token overhead by over 85 percent while targeting sub-7 percent true-positive rates in naive AI code scanning. Mantis is deployable locally with Gemini CLI or other agent frameworks but is not yet recommended for production.", "body_md": "Google has open-sourced [Mantis](https://github.com/google/mantis), a stack-agnostic toolkit of security review skills that lets an AI coding agent run the whole vulnerability lifecycle. It finds a suspected flaw, strips the false positives, reproduces the bug inside a sandbox, writes a minimal patch, re-attacks that patch, and scores the residual risk. \n\nMantis is not a scanner you aim at a repository and walk away from. It is a set of slash commands your existing coding agent loads, plus a strict set of rules about where that agent is allowed to execute code.\n\n**Is it deployable?** Yes for local and internal evaluation, not yet for production. You can clone it today and run it with [Gemini CLI](https://github.com/google-gemini/gemini-cli), Antigravity CLI, the Google ADK, or any comparable agent framework. \n\n## **The pipeline**\n\nMantis publishes each stage as a separate skill directory, invoked as a slash command and chained sequentially. A supervisor skill, `/mantis-meta-agent`, can drive the whole loop in a long-lived session.\n\nThe early stages learn the target: `/mantis-history` mines version control history for past security fixes, `/mantis-summarize` writes the directory maps, `/mantis-architecture` builds a Markdown knowledge base, `/mantis-threat-model` derives trust boundaries, and `/mantis-plan` produces a targeted roadmap.\n\nThe middle stages find and filter: `/mantis-researcher` sweeps files against the plan, then `/mantis-dedupe`, `/mantis-review` and `/mantis-critic` collapse duplicates, apply negative rules, and drop issues that cannot occur in a release build.\n\nThe late stages prove and fix: `/mantis-reproduce` executes payloads in gVisor or a VM with networking disabled, `/mantis-chain` assembles multi-step exploit chains from individually confirmed findings, `/mantis-patch` applies and verifies the fix, `/mantis-calibrate` assigns a risk score from 1 to 10, `/mantis-reflect` writes learnings back for the next pass, and `/mantis-report` produces the human-readable review packet.\n\nA newer skill, [`/mantis-advise`](https://github.com/google/mantis/blob/main/mantis-advise/SKILL.md), inverts the flow. It queries the accumulated threat model, past bug lineages and verified patch patterns before you write code, so the same class of bug does not land twice.\n\n## **But why?**\n\nMost agentic security tooling stops at generating findings. Mantis is interesting because it treats the reproducer and the re-attack as the trust boundary, and because it publishes the inter-stage contracts so teams can wrap the skills in a deterministic harness instead of trusting an LLM to orchestrate shell commands.\n\n## **Key Takeaways**\n\n- Mantis is a modular skills toolkit for coding agents, not a standalone scanner or a supported Google product.\n- Its differentiator is grounding: sandboxed reproduction and patch re-attack, not model confidence.\n- A hierarchical summary tree cuts token overhead by over 85 percent, per Google.\n- Google cites sub-7 percent true-positive rates for naive AI code scanning as the problem Mantis targets.\n- Deployable locally under Apache 2.0 but not recommended yet for production.\n\nCheck out the [**google/mantis on GitHub**](https://github.com/google/mantis), [** Agent Reference Guide**](https://github.com/google/mantis/blob/main/README_AGENTS.md), [** Cloud CISO Perspectives**,](https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-how-google-cloud-security-uses-ai-internally) and [**Getting started with Mantis**](https://cloud.google.com/blog/products/identity-security/getting-started-with-the-mantis-harness-to-find-and-fix-bugs). Also, feel free to follow us on **[Twitter](https://x.com/intent/follow?screen_name=marktechpost)** and don’t forget to join our **[150k+ML SubReddit](https://www.reddit.com/r/machinelearningnews/)** and Subscribe to **[our Newsletter](https://magic.beehiiv.com/v1/f5e63dd4-5653-4f09-83e2-321a8b1ba526?email={{email}})**. Wait! are you on telegram? [now you can join us on telegram as well.](https://t.me/machinelearningresearchnews)\n\nNeed to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? [Connect with us](https://forms.gle/wbash1wF6efRj8G58)\n\nMichal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.", "url": "https://wpnews.pro/news/google-open-sources-mantis-a-modular-skills-toolkit-that-lets-coding-agents-find", "canonical_source": "https://www.marktechpost.com/2026/09/09/google-open-sources-mantis-a-modular-skills-toolkit-that-lets-coding-agents-find-reproduce-and-patch-vulnerabilities/", "published_at": "2026-09-09 22:58:29+00:00", "updated_at": "2026-09-09 23:14:50.321672+00:00", "lang": "en", "topics": ["ai-tools", "ai-agents", "ai-safety", "ai-research"], "entities": ["Google", "Mantis", "Gemini CLI", "Antigravity CLI", "Google ADK", "Apache 2.0", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/google-open-sources-mantis-a-modular-skills-toolkit-that-lets-coding-agents-find", "markdown": "https://wpnews.pro/news/google-open-sources-mantis-a-modular-skills-toolkit-that-lets-coding-agents-find.md", "text": "https://wpnews.pro/news/google-open-sources-mantis-a-modular-skills-toolkit-that-lets-coding-agents-find.txt", "jsonld": "https://wpnews.pro/news/google-open-sources-mantis-a-modular-skills-toolkit-that-lets-coding-agents-find.jsonld"}}