#1111th of 15 in Code review and testing
mantis
Agent skills and ADK pipeline that find, reproduce and patch code vulnerabilities
- Stars
- 2.5k
- License
- Apache-2.0
- Last commit
- Oct 2026
- Language
- Python
14 on 16 Jun 20262,508 on 20 Oct 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
Mantis is a set of agent skills plus a Google ADK reference harness that runs a security review pipeline over a file or repository: threat model, hypotheses, research, triage, reproduction, patching and severity calibration. It also includes a GitHub Action for pull request scans, which is untested. The README labels it demonstration-only and says to run it only in isolated environments.
Who it is for: Security engineers trying agentic vulnerability research in sandboxes
Strengths
- Covers the full loop: threat model, research, dedup, triage, reproduction, patch with adversarial check
- Severity calibration rubric aims to limit inflated critical findings
- Run options: --focus, --exclude, --max-tokens cap, --parallel, exportable knowledge base
- Skills are separate from the harness, so they can be ported to other frameworks
Weaknesses
- README states it is for demonstration, not production use
- Pull request GitHub Action has not been run end-to-end on a live project
- Executes model-generated code; user must provide strong isolation
- Findings need manual expert verification; hallucinated results are possible
What it needs
- no GPU
- Needs Python 3, python3-venv, Google ADK, Google Cloud ADC (Vertex AI), SQLite
- Models: Vertex AI
Also in Code review and testing
See all 15| Rank | Project | Score |
|---|---|---|
| 1 | open-code-reviewCLI that reviews Git diffs with an LLM agent and line-level comments | 80 out of 100 |
| 2 | react-doctorCLI that scans React codebases for state, performance, security and accessibility issues | 74 out of 100 |
| 3 | hunkTerminal diff viewer for reviewing code changes, with inline agent notes | 74 out of 100 |
| #4 | no-mistakesLocal git proxy that runs AI review, tests and lint before opening a PR | 73 out of 100 |
| #5 | pr-agentLLM pull request reviewer that comments via /review, /describe and /improve | 71 out of 100 |