[!注意] 使用は自己責任でお願いします。非常に注意してください。 このスイートは 自律的に生成されたコードを生成し実行するよう設計されています。 不安定だったり、予期せぬ行動をとる。これは単独でのみ使用してください。 制限された環境。 このスイートは、 本番システム、機密データ、内部ネットワークなどです。

[!重要] 責任ある使用 AIモデルは非決定的であり、 幻覚を生んだり、誤ったパッチを作成したりします。すべての所見は 報告前にセキュリティ専門家による手動検証が必要です。 絶対にしないでください 未検証のAI生成レポートをオープンソースの管理者に大量に提出します。A 脆弱性を自動的に再現できない>が、必ずしも それが偽陽性であり、成功した再現者が必ずしもバグがそうだと保証するわけではありません あらゆる文脈で悪用可能です。Mantisは責任を持って使いましょう。

[!警告] プルリクエストスキャンは未検証です。 GitHubのアクション action/、mantis-pr-scanおよびmantis-knowledge-refreshのワークフローは以下の通りです .github/workflows/およびreference/scripts/setup_github_action.shは スタブに対してレビューと演習が行われましたが、まだエンドツーエンドの実行は行われていません

Mantis: Portable Toolkit for Building Secure Software

[!CAUTION] USE AT YOUR OWN RISK. BE EXTREMELY CAREFUL. This suite is designed to generate and execute autonomously generated code that may be unstable or perform unexpected actions. USE THIS ONLY IN ISOLATED, RESTRICTED ENVIRONMENTS. Never run this suite on a machine with access to production systems, sensitive data, or internal networks.

[!IMPORTANT] RESPONSIBLE USE AI models are non-deterministic and can hallucinate findings or generate incorrect patches. All findings must be manually verified by a security expert before being reported. Do not mass-file unverified, AI-generated reports to open-source maintainers. A failure to automatically reproduce a vulnerability does not definitively mean it is a false positive, nor does a successful reproducer guarantee the bug is exploitable in all contexts. Use Mantis responsibly.

[!WARNING] The pull request scan is untested. The GitHub Action in action/, the mantis-pr-scan and mantis-knowledge-refresh workflows under .github/workflows/, and reference/scripts/setup_github_action.sh have been reviewed and exercised against stubs, but have not yet been run end-to-end against a live project. Do not use the action to gate merges. The status note at the top of reference/docs/github-action.md lists what execution has not verified and will be removed when it has.

Mantis is a set of skills along with an ADK reference harness for building secure software in the new AI era of software development.

• skills/ – the method: the skills an agent loads on demand, from threat modelling through research, review, patching and reporting.
• reference/ – an ADK harness that runs the method as a pipeline, with its own two skills to configure and launch it. Meant to be adapted; works as is.
• action/ – a GitHub Action that runs the harness over a pull request (see the warning above).

Getting Started

First, install python3-venv such as with sudo apt install python3-venv, then run the install script. Mantis comes with automated configuration and launcher tools (mantis-configure and mantis-launch):

cd reference && ./install.sh

# 0. Authenticate Google Cloud Application Default Credentials (ADC) if using Vertex AI
gcloud auth application-default login

# 1. Fast Configuration & Capability Auto-Detection (or --interactive wizard)
python3 scripts/configure.py --auto

# 2. Fast Preflight Validation (~1s) & Live Reachability Probe
python3 scripts/configure.py --test --probe

# 3. Launch Vulnerability Review Campaign (file or repository)
./run.sh path/to/code            # a file or a directory

# 4. (Optional) Tell the planner what to hunt for, in plain language (standard pipeline)
./run.sh path/to/code --focus "look for IDOR"

# 4b. (Optional) Leave vendored or generated code out of the scan