Mantis is an open-source framework from Google designed to automate the discovery, triage, reproduction, and patching of software vulnerabilities. It combines industry-standard agentic techniques—such as critic and review agents—with sandboxed reproduction of vulnerabilities to achieve high accuracy, addressing the common problem of AI code scanners producing hallucinated bugs and true-positive rates below 7%. Mantis examines repository commit history to learn from past security fixes and automatically builds architectural and threat model documentation. It constructs a hierarchical security summary tree that condenses individual files into directory and root-level summaries, reducing token overhead by over 85% while preserving critical structural context for large codebases.

To get started, clone the Mantis repo and prompt your coding agent with: “I would like to use Mantis framework in path/to/mantis to review my code in path/to/your/code, can you help me get started?” Google reports this exact prompt has been used internally to find real vulnerabilities. The repository includes sample sandboxing options, and users can implement their own sandbox. For advanced use, the mantis-advise skill lets coding agents write secure code proactively.

Google recommends two best practices for effective AI-driven vulnerability discovery: feed tools proper context (e.g., human-curated rules like not surfacing bugs where users can crash their own program), and build a cyber sandbox with clear vulnerability acceptance criteria to reproduce issues safely and confirm fixes are correct.