Naive AI code scanners are drowning developers in noise, boasting true-positive rates below 7 percent. Google is trying to fix this with Mantis, an open-source toolkit that doesn’t just flag vulnerabilities but proves them. Released under the Apache 2.0 license, Mantis isn’t a standalone product you buy. It’s a stack-agnostic set of skills your existing coding agent loads via slash commands. The goal is simple: move from probabilistic guessing to deterministic proof.
The workflow is rigorous. Mantis starts by mining version control history and mapping architecture to build a threat model. It then filters findings aggressively, dropping duplicates and issues that can’t occur in release builds. The real differentiator lies in the execution phase. Mantis reproduces suspected bugs inside a gVisor sandbox or a disconnected VM. It doesn’t stop there. After writing a minimal patch, the agent re-attacks the fixed code to verify the vulnerability is actually gone. Only then does it assign a risk score from 1 to 10.
This approach tackles the orchestration problem head-on. Instead of trusting an LLM to randomly execute shell commands, Mantis publishes strict inter-stage contracts. A supervisor skill, /mantis-meta-agent, drives the loop, while other skills handle specific tasks like /mantis-reproduce or /mantis-patch. Google claims this modular design, combined with a hierarchical summary tree, cuts token overhead by over 85 percent. That efficiency makes long-lived security sessions financially viable for teams running local evaluations.
There is a proactive angle too. The new /mantis-advise skill queries past bug lineages before you even write code, preventing repeat offenses. However, temper your enthusiasm. Google explicitly states Mantis is not yet ready for production deployment. It’s a framework for internal evaluation and local testing, compatible with Gemini CLI or Antigravity CLI. For now, it serves as a blueprint for how agentic security should work: grounded in reproduction, not just prediction. Whether other vendors will adopt this strict contract-based approach remains to be seen, but the bar for AI security tooling just got higher.
