[! 주의] 사용은 본인 책임 하에 사용하세요. 매우 조심하세요. 이 스위트는 자율적으로 생성된 코드를 생성하고 실행하도록 설계되었습니다. 불안정하거나 예상치 못한 행동을 할 수 있습니다. 이 기능은 단독에서만 사용하십시오, 제한된 환경. 이 스위트는 다음 서버에 접근할 수 있는 기기에서 절대 실행하지 마세요. 운영 시스템, 민감한 데이터, 내부 네트워크 등이 포함됩니다.

[! 중요] 책임 있는 사용 AI 모델은 비결정적이며, 결과를 환각하거나 잘못된 패치를 생성할 수 있습니다. 모든 발견은 반드시 신고 전에 보안 전문가가 수동으로 검증합니다. 하지 마세요 검증되지 않은 AI 생성 보고서를 오픈 소스 유지보수자에게 대량 제출합니다. A 취약점을 자동으로 재현하지 못했다고 해서 > 거짓 양성이고, 성공적인 재생산자가 버그가 반드시 그렇다고 보장하지는 않습니다 모든 상황에서 악용될 수 있습니다. Mantis를 책임감 있게 사용하세요.

[! 경고] 풀 리퀘스트 스캔은 테스트되지 않았습니다. GitHub 행동 action/, mantis-pr-scan와 mantis-knowledge-refresh 워크플로우는 .github/workflows/와 reference/scripts/setup_github_action.sh는 초안 자료에 대해 검토 및 연습되었으나 아직 종합 진행은 이루어지지 않았습니다

Mantis: Portable Toolkit for Building Secure Software

[!CAUTION] USE AT YOUR OWN RISK. BE EXTREMELY CAREFUL. This suite is designed to generate and execute autonomously generated code that may be unstable or perform unexpected actions. USE THIS ONLY IN ISOLATED, RESTRICTED ENVIRONMENTS. Never run this suite on a machine with access to production systems, sensitive data, or internal networks.

[!IMPORTANT] RESPONSIBLE USE AI models are non-deterministic and can hallucinate findings or generate incorrect patches. All findings must be manually verified by a security expert before being reported. Do not mass-file unverified, AI-generated reports to open-source maintainers. A failure to automatically reproduce a vulnerability does not definitively mean it is a false positive, nor does a successful reproducer guarantee the bug is exploitable in all contexts. Use Mantis responsibly.

[!WARNING] The pull request scan is untested. The GitHub Action in action/, the mantis-pr-scan and mantis-knowledge-refresh workflows under .github/workflows/, and reference/scripts/setup_github_action.sh have been reviewed and exercised against stubs, but have not yet been run end-to-end against a live project. Do not use the action to gate merges. The status note at the top of reference/docs/github-action.md lists what execution has not verified and will be removed when it has.

Mantis is a set of skills along with an ADK reference harness for building secure software in the new AI era of software development.

• skills/ – the method: the skills an agent loads on demand, from threat modelling through research, review, patching and reporting.
• reference/ – an ADK harness that runs the method as a pipeline, with its own two skills to configure and launch it. Meant to be adapted; works as is.
• action/ – a GitHub Action that runs the harness over a pull request (see the warning above).

Getting Started

First, install python3-venv such as with sudo apt install python3-venv, then run the install script. Mantis comes with automated configuration and launcher tools (mantis-configure and mantis-launch):

cd reference && ./install.sh

# 0. Authenticate Google Cloud Application Default Credentials (ADC) if using Vertex AI
gcloud auth application-default login

# 1. Fast Configuration & Capability Auto-Detection (or --interactive wizard)
python3 scripts/configure.py --auto

# 2. Fast Preflight Validation (~1s) & Live Reachability Probe
python3 scripts/configure.py --test --probe

# 3. Launch Vulnerability Review Campaign (file or repository)
./run.sh path/to/code            # a file or a directory

# 4. (Optional) Tell the planner what to hunt for, in plain language (standard pipeline)
./run.sh path/to/code --focus "look for IDOR"

# 4b. (Optional) Leave vendored or generated code out of the scan