Google Open-Sources Mantis: AI Security Toolkit for Coding Agents

Google has open-sourced Mantis, a modular toolkit of security skills designed to plug into an existing AI coding agent. Rather than acting as a standalone scanner, Mantis exposes a chain of slash commands that guide an agent through finding a potential flaw, filtering false positives, reproducing the bug in a sandbox, writing a fix, re-attacking that fix, and scoring residual risk. It works with Gemini CLI, Antigravity CLI, the Google ADK, and comparable agent frameworks. The code is available on GitHub today under the Apache 2.0 licence.

What happened

Detail	Fact
Licence	Apache 2.0
Supported agent runtimes	Gemini CLI, Antigravity CLI, Google ADK, comparable frameworks
Token overhead reduction	Over 85 percent, via hierarchical summary tree
Naive AI scanner true-positive rate	Sub-7 percent (cited by Google as the problem being solved)
Production readiness	Local and internal evaluation only; not yet recommended for production
Sandbox method	gVisor or a VM with networking disabled

Mantis is not a product you point at a codebase and walk away from. It is a collection of skill directories, each invoked as a slash command, designed to be loaded by an agent you already run. A supervisor command, /mantis-meta-agent, can drive the entire loop in a single long-lived session.

How the pipeline is structured

Mantis organises its commands into three phases. The early-stage skills build knowledge about the target. The middle-stage skills find and filter issues. The late-stage skills prove bugs, apply fixes, and score risk.

Early stage: understanding the target

• /mantis-history mines version control history for past security fixes.
• /mantis-summarize generates directory maps.
• /mantis-architecture builds a Markdown knowledge base of the codebase.
• /mantis-threat-model derives trust boundaries.
• /mantis-plan produces a targeted review roadmap.

Middle stage: finding and filtering

• /mantis-researcher sweeps files against the plan.
• /mantis-dedupe, /mantis-review, and /mantis-critic collapse duplicates, apply negative rules, and drop issues that cannot appear in a release build.

Late stage: proving, patching, and scoring

• /mantis-reproduce executes payloads in gVisor or a network-disabled VM.
• /mantis-chain assembles multi-step exploit chains from confirmed individual findings.
• /mantis-patch applies and verifies the fix.
• /mantis-calibrate assigns a risk score from 1 to 10.
• /mantis-reflect writes learnings back for the next pass.
• /mantis-report produces a human-readable review packet.

A newer skill, /mantis-advise, inverts the whole flow. It queries the accumulated threat model, past bug lineages, and verified patch patterns before code is written, so the same class of bug does not appear a second time.

Why it matters

Most agentic security tools stop at generating a list of findings. The signal-to-noise problem is severe: Google points to a sub-7 percent true-positive rate for naive AI code scanning. A long list of mostly-wrong alerts is worse than no list at all, because teams learn to ignore it.

Mantis addresses this in two concrete ways. First, it treats sandboxed reproduction as the trust boundary: a finding only advances if an agent can actually trigger it in a controlled environment. Second, it publishes the contracts between each stage, so teams can wrap the skills in a deterministic harness rather than trusting a large language model to orchestrate shell commands freehand. That distinction matters for anyone who has seen an LLM hallucinate a shell command in a sensitive environment.

The 85-percent token reduction from the hierarchical summary tree is also practical. Long-context scans of large codebases are expensive. Cutting token usage by that margin makes the economics of repeated sweeps more reasonable. If you are exploring AI integration for your development workflow, security tooling like this is one of the more concrete starting points.

Our take

Mantis is the right shape for agentic security tooling. Modular, auditable stages with published contracts between them beat a black-box “scan and report” tool precisely because you can see where the agent is allowed to act and where it is not. The sandboxed reproducer is the key feature: if a bug cannot be triggered in a controlled environment, it probably does not matter enough to ship an urgent fix.

That said, the sub-7 percent true-positive figure is doing a lot of work in Google’s framing. It is a strong critique of naive scanning, but Mantis’s own true-positive rate is not published in this release. The toolkit is still early-stage, and “not recommended for production” is an honest admission that you should treat it as a research-grade instrument for now. Clone it, run it on internal projects, and measure the noise yourself before trusting it on anything customer-facing. Our coverage of Claude Opus 4.6 breaching a real system during a hacking exercise is a useful reminder that AI agents operating in security contexts can produce unexpected outcomes.

What to do about it

1. Clone the google/mantis repository from GitHub and read the Agent Reference Guide before running anything.
2. Run Mantis on a non-production codebase or an internal project first to calibrate its noise level for your stack.
3. Use /mantis-meta-agent to run the full pipeline and review the /mantis-report output against findings from your existing scanner to compare signal quality.
4. Enable /mantis-advise in your agent session during active development on high-risk modules to catch patterns before they are committed.
5. Watch the repo for production-readiness signals before deploying to any customer-facing pipeline.

If you want help evaluating whether agentic security tooling fits your team’s workflow, the Lumien team is happy to talk through it.

Source: Marktechpost