Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
Mantis provides a specialized set of skills for application security engineers to automate the vulnerability lifecycle. By coordinating modular agents, it transforms raw code analysis into a structured pipeline for identifying risks and implementing remediations.
The toolkit enables AI coding agents to move beyond simple detection by chaining vulnerabilities and calibrating risk, ensuring that patches are validated and architectural weaknesses are addressed systematically.
WHO IT'S FOR
Application Security Engineers
automating vulnerability detection and patching workflows
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Follow the documented setup, then try a first task.
Setup
Add the Mantis skills bundle with Skills CLI
Installs: Published Mantis skills bundle. The separate reference-harness skills are not established as part of this CLI bundle.
Before you start
Use only in an isolated, restricted environment without access to production systems, sensitive data, or internal networks
npx available in the terminal.
Platform: Platform agnostic; documented as working with Gemini CLI, Antigravity CLI, Google ADK, and other coding-agent frameworks, though the installation command is not presented as agent-specific.
In an isolated, restricted environment, run this terminal command to add the complete google/mantis skills bundle.
Installs: Mantis ADK reference implementation using the full suite of canonical Mantis skills and isolated sandboxed execution environments. The skillPaths list is a bounded selection of positively supported paths, not a complete suite inventory. · Google ADK
Before you start
Python 3.14 or newer
python3-venv installed
Use only in an isolated, restricted environment without access to production systems, sensitive data, or internal networks
Platform: Linux, including WSL2, and macOS. Native Windows is unsupported. On Intel macOS, microVM isolation is unsupported; use static-only analysis. Apple Silicon macOS supports microsandbox microVMs through Hypervisor.framework.
Run from: Repository root
From the repository root, run this complete terminal command to enter the reference directory and execute its installer.
cd reference && ./install.sh
After installation, source the generated reference/mantis-env.sh file before invoking Mantis skills. Add the installer-reported source line, which contains the authoritative absolute Mantis installation path, to your shell profile so MANTIS_HOME is available in future sessions.
Model/provider configuration and required credentials, if applicable
Use the mantis-configure skill to select the static-only sandbox for my installed Mantis environment and run a fast preflight validation without scanning source code. Report any credential or environment checks that fail. Required input: the path to the Mantis installation and any model/provider configuration the preflight should validate.
Use the mantis-launch skill in dry-run mode for the target path I provide. Show the launch plan and indexed files without calling AI models or starting a vulnerability-review campaign. Required input: a source file or repository path, such as /path/to/repo; treat that sample path as a placeholder.
Use the mantis-plan skill to inspect the codebase at the path I provide and create an initial targeted defensive security-review roadmap in workspace/plan.json. Use the existing threat model and historical learnings if present; do not execute reviews, write test scripts, or patch code. Required input: the codebase root, plus the Mantis state directory if it is stored elsewhere.
Claude
Gemini CLI
Antigravity