Mantis

Mantis is a modular toolkit for AI coding agents to find, reproduce, and patch software vulnerabilities.

Mantis is a set of skills and an ADK reference use designed to help AI coding agents build secure software. It reviews codebase history, builds semantic indexes, generates threat models, and executes research plans to find vulnerabilities. The tool deduplicates findings, triages and critiques results to combat hallucinations, and attempts to reproduce bugs through unit tests or mock servers. It also patches discovered vulnerabilities using an adversarial loop and calibrates findings based on an established rubric. Mantis is intended for security researchers and developers working in isolated environments to secure codebases.

Mantis at a glance

Best for: Software engineer
Runs on: open source
Pricing: Free
Released: June 2026
Category: AI coding tool
Website: github.com/google/mantis

Key features

Review codebase history for historical vulnerabilities
Build semantic indexes for efficient code navigation
Generate automated threat models
Reproduce vulnerabilities using unit tests or mock servers
Patch discovered vulnerabilities with adversarial verification
Calibrate findings to prevent severity inflation

Use it for

Find and patch security vulnerabilities in codebases
Generate automated threat models for software projects
Reproduce software bugs using AI agents
Review codebase history for repeating security issues

Alternatives to Mantis

ARTEX — Runs autonomous multi-agent penetration testing with a dual-graph architecture.
CodeGraph — It eliminates file crawling, reducing AI agent tool calls by 88% and cutting costs.
HackerOne — Combines AI agents with expert human researchers to prioritize and fix real risks.
jevgrep — Reduces coding agent costs by providing targeted, relevant repository context.
VulnClaw — It uses LLM agents to autonomously execute end-to-end security testing loops.
CodeScan Artex — It uses multiple parallel AI agents to read source code and verify vulnerabilities.
Pixee — Automates vulnerability triage and generates actionable code fixes.
DeepSource — Automated code reviews that combine static analysis with AI agents.
Agentic Bug Hunter — It drives the reconnaissance, triage and reporting loop an agent would run.
PentAGI — It autonomously manages penetration testing workflows within a secure Docker sandbox.
Open Kritt — Orchestrates parallel AI agents to find and verify high-impact code vulnerabilities.
AI Crimes — Practice catching real-world AI coding mistakes on anonymized snippets.

All Mantis alternatives