Mantis: A Security Toolkit That Treats Its Own AI as Hostile

What it does

Mantis is a collection of decoupled, sequential skills (delivered as slash commands like /mantis-plan and /mantis-reproduce) for AI coding agents. It walks an agent through a full pipeline: analyzing repository history, indexing code structure, building a living threat model, scanning for flaws, deduplicating findings, filtering false positives, generating sandboxed crash reproducers, chaining exploits, and applying minimal patches. The toolkit is stack-agnostic and adaptable to domains beyond typical app code, including hardware/RTL, infrastructure-as-code, ML pipelines, and compiled firmware.

The interesting bit

The README spends as much time warning you about the dangers as explaining the features. Because the agents autonomously generate and execute code to reproduce vulnerabilities, the project treats its own AI orchestrators as inherently untrusted and non-deterministic. It mandates gVisor-sandboxed containers with disabled networking and explicitly tells you to never run this on a machine with production access. The paranoia is the product.

Key highlights

• Multi-stage sequential pipeline from reconnaissance to patched report
• Adaptable to specialized domains: hardware, IaC, ML pipelines, firmware
• Tiered model selection guidance to avoid burning frontier LLM tokens on trivial tasks
• Snapshot-per-pass model for continuous review of living codebases (opt-in)
• Built-in meta-learning loop that feeds empirical outcomes back into the threat model

Caveats

• AI agents are non-deterministic and may hallucinate findings, generate incorrect patches, or attempt unsafe actions despite instructions
• The authors explicitly warn against mass-filing unverified AI-generated reports to open-source maintainers
• Running unattended requires hardened GCE deployment; the default interactive mode demands human approval before sensitive actions

Verdict

Security teams with isolated sandbox environments and patience for false positives get a genuinely ambitious agentic security pipeline. If you were looking for a lightweight linter or a tool you can casually run on your laptop against production repos, this is explicitly not it.