OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Agent Security & Sandboxing

Mantishack

Mantishack is an open-source, self-hosted Rust command-line AI agent that uses OpenAI’s Codex CLI to run a staged offensive-AppSec workflow over a codebase: reconnaissance, vulnerability detection, reachability analysis, attacker-simulation validation, chaining, gated exploitation, fixing, and reporting.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Mantishack — OpenViST project profile in Agent Security & Sandboxing.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use Mantishack when a security workflow needs more than initial scanner output and should connect detection with reachability analysis, validation, evidence, remediation, and reporting.

Who it is for

  • Security practitioners conducting authorized codebase assessments
  • Developers connecting vulnerability findings with reachability, evidence, and remediation
  • Builders creating staged vulnerability-triage or offensive-AppSec workflows

Documented uses

  • Scan code and dependencies for potential vulnerabilities, secrets, and security issues
  • Assess whether findings are reachable through program analysis
  • Validate findings through attacker-simulation stages
  • Maintain tool-owned finding state and reject unsupported confirmations
  • Create bounded HTTP evidence packs and produce reports
Before you choose

Requirements & limits

The repository is public and identified as open source under the Apache-2.0 license. The documented access model is a locally built CLI rather than a hosted application.

  • The main CLI is written in Rust and is built from source.
  • The agent is built on OpenAI’s Codex CLI.
  • Scanner coverage depends on separately installed tools; missing binaries are reported as unavailable.
  • The findings spine enforces “no proof -> no confirm” and requires a roadblock citation for rejected findings.
  • Gated exploitation is represented as a distinct pipeline role rather than an undifferentiated scanner step.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Build Mantishack and prepare its scanner capabilities

Compile the CLI and install the documented scanner binaries used by its MCP capability servers.

Before you start

  • A cloned Mantishack repository
  • The Rust toolchain identified by the project
  • Node.js for the MCP tool servers
  • The separately listed scanner tools where their capabilities are needed

Steps

  1. Clone the repository and enter its directory.

  2. Enter codex-rs and run cargo build --release -p codex-cli.

  3. Return to the repository root and run the built codex binary there so the project-scoped .codex/config.toml resolves.

  4. Install the documented scanner dependencies: Semgrep and Bandit with pip; TruffleHog, Trivy, Z3, and AST-grep with the platform package manager; OSV-Scanner with go install; and the CodeQL CLI from its published binaries.

Expected outcome

A locally built Mantishack CLI with the documented capability servers able to report installed scanner availability.

Guide limitations

  • The project states that missing scanner binaries leave the corresponding capabilities unavailable.
  • This setup recipe documents build and dependency preparation, not a completed security analysis or successful exploitation run.
Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
4 October 2026
Original website title
deonmenezes/mantishack · Official homepage title · retained in its source language
How we review sourcesSuggest a correction