Google Mantis Explained: 2026 Open-Source Vulnerability Harness
Google open-sourced Mantis on 2 Sep; InfoQ covered it on 6 Sep. An agent harness from discovery to patch. Hierarchical summaries cut about 85% of tokens; sandbox repros ground the findings.
Google Cloud Blog open-sourced Mantis on 2 September 2026. Nick Galloway and Yulong Zhang frame it as an agent suite for discovery, triage, reproduction, and patches. InfoQ followed on 6 September.
Decide a trial by matching these names: Google Mantis, vulnerability scanning harness, and the stage mantis-reproduce.
Build context before the agents speak
Read history, skip the blind scan
Mantis reads commit history, old fixes, architecture, and threat models, then folds files into directory- and repo-level summaries instead of brute-forcing every file.
Critics plus a sandbox
Critic and review agents filter false positives. mantis-reproduce writes a runnable crash reproducer in a sandbox so the claim is grounded, not just narrated.
Critic and review agents plus sandboxed reproduction exist so scans land, rather than stacking another pile of hallucinated bugs. — Google Cloud Blog, restating the design
Where the numbers come from
| Look at | Typical AI scan | Mantis |
|---|---|---|
| Context | Brute-force files | History, old fixes, architecture, threat models |
| Hallucinations | True positives often under 7% | Critic agents + sandbox repros |
| Models | One heavy model throughout | Flash/lite for classify; heavier for repro and patch |
| Output | Unverified list items | Reproducers, candidate patches, on-disk shared state |
Clone it now?
- 01Match the work
Teams already asking a coding agent to review security, and drowning in invented findings, are the audience. A skill catalog is not a finished scanner.
- 02Read the filter note
mantis-review’s negative filter drops likely false positives. Google says low-risk findings should not be auto-classed as false; a wide filter misses real bugs.
- 03Do not treat a harness as a design review
After the agents run, module boundaries still sit on one drawing. Open sitdraw when the meeting is the diagram.
- Did Mantis start in September?
- No. 2 September is the open-source post. Google says a June write-up already covered reading history and auto-building architecture and threat-model docs. The repo was created in June 2026.
- Is this the same story as ToolHive?
- No. ToolHive is a container runtime for MCP servers. Mantis is a vulnerability-review skill suite for coding agents.
Split the hypothesis from the repro
A model can narrate a path that sounds like a vulnerability. Without a sandbox repro it is still a hypothesis. The patch stage emits a candidate fix; your tests still have to pass.
# Google Cloud Blog / GitHub
git clone https://github.com/google/mantis.git
# or: npx skills add google/mantis