Google open-sources Mantis, a security skills toolkit for coding agents

Google has open-sourced Mantis, a stack-agnostic toolkit of security review skills that lets an AI coding agent run the entire vulnerability lifecycle: locate a suspected flaw, strip false positives, reproduce the bug in a sandbox, write a minimal patch, attack that patch again and score what risk remains.

Mantis is not a scanner you point at a repository and leave alone. It ships as a set of slash commands loaded by an existing coding agent, together with strict rules about where that agent may execute code. Google describes it as usable for local and internal evaluation but not yet for production. The repository can be cloned today and run with Gemini CLI, Antigravity CLI, the Google ADK or comparable agent frameworks.

Each stage is a separate skill

Every stage lives in its own skill directory and is chained sequentially. A supervisor skill, /mantis-meta-agent, can drive the whole loop in a long-lived session.

• Learning the target: /mantis-history mines version control history for past security fixes, /mantis-summarize writes directory maps, /mantis-architecture builds a Markdown knowledge base, /mantis-threat-model derives trust boundaries, /mantis-plan produces a targeted roadmap.
• Finding and filtering: /mantis-researcher sweeps files against the plan, then /mantis-dedupe, /mantis-review and /mantis-critic collapse duplicates, apply negative rules and drop issues that cannot occur in a release build.
• Proving and fixing: /mantis-reproduce executes payloads in gVisor or a VM with networking disabled, /mantis-chain assembles multi-step exploit chains from individually confirmed findings, /mantis-patch applies and verifies the fix, /mantis-calibrate assigns a risk score from 1 to 10, /mantis-reflect writes learnings back for the next pass, and /mantis-report produces the human-readable review packet.

A newer skill, /mantis-advise, inverts the flow. It queries the accumulated threat model, past bug lineages and verified patch patterns before code is written, so the same class of bug does not land twice.

According to MarkTechPost, most agentic security tooling stops at generating findings; what stands out about Mantis is that it treats the reproducer and the re-attack as the trust boundary and publishes the inter-stage contracts, letting teams wrap the skills in a deterministic harness instead of trusting a language model to orchestrate shell commands.

The project is published on GitHub as google/mantis. Full details are in the MarkTechPost report.