OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Coding Agents

Mantis

Mantis is an open-source Python toolkit comprising skills and an ADK reference harness for building AI coding-agent workflows that find, investigate, reproduce and propose patches for software vulnerabilities.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Mantis — OpenViST project profile in Coding Agents.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use Mantis to explore an agent-assisted security review or to build an adaptable vulnerability-research workflow, when you can isolate execution from production systems and provide expert review of findings and patches.

Who it is for

  • Security experts evaluating agent-assisted vulnerability research.
  • Developer and security teams adapting coding-agent review workflows to their own software stack.
  • Researchers exploring agentic security-review workflows in isolated environments.

Documented uses

  • Review code and its history for potential vulnerabilities.
  • Build code indexes, threat models and investigation hypotheses to guide agent research.
  • Attempt to reproduce suspected vulnerabilities using available environments.
  • Deduplicate and critique findings, and generate candidate patches for human review.
  • Adapt agent skills and workflow designs to specialized software or hardware domains.
Before you choose

Requirements & limits

The project is publicly available on GitHub under the Apache-2.0 license. The repository identifies Python as its primary language.

  • The ADK harness is a reference implementation; the project presents Mantis as a toolkit to adapt, not a rigid workflow.
  • The README documents Python virtual-environment support and an install script; Vertex AI use requires Google Cloud Application Default Credentials.
  • Autonomously generated code may behave unexpectedly; the README calls for isolated, restricted environments with no production, sensitive-data or internal-network access.
  • Findings and patches require expert verification; reproduction outcomes do not by themselves settle whether a vulnerability is false or exploitable.
  • The project says it is for demonstration and not intended for production use, and is not an officially supported Google product.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Install and configure the reference harness

Prepare the Mantis reference harness and run its documented configuration and reachability checks.

Before you start

  • Python 3 virtual-environment support
  • The Mantis repository
  • Google Cloud Application Default Credentials if using Vertex AI

Steps

  1. From the repository, enter the reference directory and run ./install.sh.

  2. If using Vertex AI, authenticate with gcloud auth application-default login.

  3. Run the command below for automatic configuration, or use its interactive wizard.

    Documented command
    python3 scripts/configure.py --auto

  4. Run the command below for preflight validation and a live reachability probe.

    Documented command
    python3 scripts/configure.py --test --probe

Expected outcome

The reference harness is installed, configured and checked with its documented preflight and reachability commands.

Guide limitations

  • The README warns that Mantis can execute autonomously generated code and must be used only in isolated, restricted environments.
  • This setup guide does not establish that a vulnerability review has been run or that any result is correct.
  • The project describes itself as a demonstration project, not intended for production use.
Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
10 October 2026
Original website title
google/mantis · Official homepage title · retained in its source language
How we review sourcesSuggest a correction