Getting started with Mantis, our open-source bug finding-and-fixing harness

The useful part

AI models have clearly proven their ability to discover and exploit vulnerabilities without much, if any, human assistance. To help defenders gain the advantage with AI, we built the Mantis harness to automate the discovery, triage, reproduction, and patching of software vulnerabilities. Available to all as an open-source framework, Mantis is part of Google's internal approach to find and fix vulnerabilities at machine-speed.

How it works

• It constructs a hierarchical security summary tree, condensing individual files into directory and root-level summaries.
• This technique reduced token overhead by over 85%, while preserving critical structural context across massive repositories.
• Mantis distills decades of cybersecurity expertise across a wide spectrum of codebases, and is available on GitHub.

What to take from it

It creates a more effective scalable, context-aware repository analysis.

Details worth keeping

While sloppiness in AI code scanning frequently leads to hallucinated bugs and weak true-positive rates under 7%, we designed Mantis to be effective by combining industry-standard agentic techniques like critic and review agents with sandboxed reproduction of vulnerabilities for grounding. First, clone the Mantis repo locally using: <div...