AI Harness That Forces Bugs to Prove Themselves

What it does

Mantishack is a Rust-based autonomous agent for offensive application security. It wraps OpenAI’s Codex CLI with a pipeline of MCP tool servers and role-based agents that scan a codebase for vulnerabilities, then subject every candidate to staged validation: reachability analysis, attacker-simulation reasoning, and even Z3 SMT path-condition checks. Only findings that survive the gauntlet and attach concrete evidence are promoted to confirmed; the rest are rejected with a cited roadblock.

The interesting bit

The project inverts the usual scanner workflow. Instead of flooding you with high-recall output and expecting a human to triage, it encodes a hard “no proof, no confirm” policy in a tool-owned findings spine. Rejection without a specific roadblock—auth gate, sanitizer, unreachable path—is literally not accepted. That shifts the burden of proof from the user to the machine.

Key highlights

• Staged pipeline from candidate to confirmed or rejected, with gated exploitation, fixing, and verification steps that follow only after confirmation.
• Z3-backed SMT reachability checks that return sat, unsat, or unknown for source-to-sink flows, turning path feasibility into a gate rather than a guess.
• MCP-based capability layer wrapping existing scanners like Semgrep, CodeQL, Bandit, and Trivy, plus canary decoy tools that tripwire prompt-injection or hallucinated tool use.
• Provider-agnostic model routing inherited from upstream Codex CLI, so the harness is not tied to a single LLM vendor.
• A clear architectural split: the Rust harness runs the loop, while all security logic lives in MCP servers, agent prompts, and skill playbooks.

Caveats

• The README calls it “not polished software” with “real gaps”; several scanner integrations silently degrade to available: false unless you already have underlying binaries like Semgrep, Z3, or CodeQL installed.
• CodeQL’s license does not permit commercial use, so corporate deployments need to audit their tooling stack before running it.

Verdict

Bug-bounty hunters and internal red teams who want an autonomous harness that suppresses false positives through evidence-based gating should take a look. If you need a polished, fully managed SaaS scanner that works out of the box, this is not it.