Google Open-Sources Mantis: Toolkit for Coding Agents

Google has officially introduced Mantis, an open-source modular skills toolkit engineered to empower coding agents with end-to-end security capabilities. The framework is designed to help AI agents discover, analyze, reproduce, and patch vulnerabilities within source code repositories. Rather than functioning as a standard automated scanner that runs independently, Mantis operates as a collection of specialized slash commands integrated with strict execution boundary rules for existing coding agents.

Regarding deployment feasibility, development teams can clone the repository today and run it locally or for internal evaluation using the Gemini CLI, Antigravity CLI, Google ADK, or any equivalent agent framework, though it is not yet production-ready.

Stock photo for illustration only, not from the actual event

Mantis structures its workflow by publishing individual stages as discrete skill directories. These are invoked sequentially via slash commands, while a supervisor skill known as /mantis-meta-agent can orchestrate the entire loop during a continuous session. The workflow pipeline is categorized into distinct phases:

• Early Stages (Target Discovery): Includes /mantis-history for mining past security fixes from version control, /mantis-summarize for directory mapping, /mantis-architecture for constructing Markdown knowledge bases, /mantis-threat-model for establishing trust boundaries, and /mantis-plan to generate a targeted roadmap.
• Middle Stages (Filtering): Utilizes /mantis-researcher to sweep files against the active plan, followed by /mantis-dedupe, /mantis-review, and /mantis-critic to eliminate duplicate findings and discard issues irrelevant to production releases.
• Late Stages (Reproduction and Remediation): Employs /mantis-reproduce to execute payloads securely inside gVisor or a network-isolated VM, /mantis-chain to assemble multi-step exploit chains, /mantis-patch to apply and verify fixes, /mantis-calibrate to assign a risk score from 1 to 10, /mantis-reflect to log insights for future passes, and /mantis-report to generate human-readable review packets.

Additionally, a newer skill designated as /mantis-advise reverses the traditional workflow. It queries accumulated threat models, historical bug lineages, and verified patch patterns prior to code authoring, ensuring developers do not introduce identical vulnerability classes twice.

Source: MarkTechPost