Google Mantis guides coding agents through security reviews

What this is about

Google Mantis is an open-source toolkit of instructions and workflows for AI coding agents. Instead of treating a security review as one opaque prompt, it breaks the work into separate stages: understand the architecture, model threats, search suspicious areas, review findings, reproduce bugs, create patches, and produce a report. Google published the repository in June 2026 under the Apache-2.0 license.

Mantis is not a conventional vulnerability scanner with its own detection engine. Its skills direct an existing coding agent and its model. The project names Gemini CLI and Antigravity CLI as tested examples while describing the approach as broadly agent-independent. Google explicitly labels Mantis a demonstration project, not an officially supported product and not intended for production environments.

What Mantis actually does

The pipeline consists of commands that build on one another. It can first analyze repository history and structure, turn that information into a knowledge base and threat model, and then derive a review plan. Later stages search for possible vulnerabilities, remove duplicates, filter false positives, and assess whether a finding might be practically relevant.

The later stages are especially sensitive: Mantis can generate code that reproduces a bug, execute it in an isolated environment, combine possible exploit chains, and propose minimal patches. It can then calibrate results and combine them into a readable review packet. The repository says the skills can be installed with npx skills add google/mantis; for reproduction and patch tests, its documentation recommends Docker plus gVisor with networking disabled.

Why it matters

Coding agents can search large codebases and pursue hypotheses quickly. Without a structured process, however, they may jump between assumptions, edit files too early, or report unverified problems. Mantis separates research, negative review, reproduction, and remediation. This creates a more inspectable process in which teams can examine intermediate results and adapt each stage to their architecture.

Its adaptability is also relevant to AppSec and DevSecOps teams. The documentation names hardware description, infrastructure as code, ML pipelines, and firmware alongside web software as possible domains. The value still depends entirely on the model, agent, sandbox, project knowledge, and added rules. Mantis replaces neither deterministic scanners nor manual expertise; it can add an agent-led investigation layer to both.

In plain language

Mantis works like a workshop with several inspection stations. A mechanic does not glance under the hood and immediately declare a defect. The design is documented first, a suspicion is tested next, the fault is recreated under safe conditions, and only then is a part replaced. Each station can stop a false suspicion.

A practical example

A team wants to review a web application containing 180,000 lines of code. It clones the repository into an isolated virtual machine with no access to production data and starts Mantis in interactive mode. First, it limits the review to file uploads and archive processing. The agent builds a threat model, examines input boundaries, and reports four possible issues.

After deduplication and negative review, two candidates remain. Only for those does the agent generate reproduction code, which runs in a networkless container. One finding cannot be confirmed; the other triggers a path error with a crafted archive. A security expert reviews the evidence, approves a minimal patch, and reruns the test. A sensible first trial is equally narrow: a small non-production code area, manual approval of every command, and comparison with existing SAST results.

Scope and limits

First, language models can hallucinate vulnerabilities, miss real problems, or misinterpret an apparently successful reproducer. Every finding requires review by a qualified person. Second, the reproduction and patch stages generate executable code. Mantis therefore warns against running on machines with production access, sensitive data, or internal networks and recommends a dedicated, restricted virtual machine.

Third, the skills are a workflow, not a security boundary. An agent can ignore instructions, misuse a sandbox, or be influenced by manipulated repository content. Unattended runs need additional isolation, network restrictions, immutable snapshots, and approval gates. Mantis is therefore a tool for experienced security teams, not automatic proof that software is secure.

SEO & GEO keywords

Google Mantis, Security Review Skills, coding agents, application security, DevSecOps, threat modeling, vulnerability review, gVisor, Docker sandbox, Gemini CLI, Apache-2.0, SAST