Mantis is an open-source, modular security-review toolkit with an ADK reference harness that structures AI-assisted code audits across threat modelling, triage, and patch verification.
AI security review needs more than a one-shot scan. Mantis is a modular set of security-review skills plus an ADK reference harness for builders evaluating code with AI agents. It helps you structure a deeper review by moving from codebase history and semantic navigation through threat modelling, research, triage, reproduction, and patch verification. Key features: • Historical context – reviews codebase history to look for vulnerabilities that should not be repeated • Semantic navigation – builds a semantic index and/or summaries to make codebases easier to explore • Threat-model generation – automatically generates a threat model before agents research individual hypotheses • Finding triage – deduplicates and critiques findings, with calibration intended to counter inflated severity • Reproduction and patch checks – can attempt reproductions and use an adversarial loop to verify a discovered vulnerability is fixed Important: the README says to use it only in isolated, restricted environments; manually verify findings; and treat it as demonstration software, not for production use. It’s open-source (Apache License 2.0). Link in the reply 👇
