mantis

Why we included this project

Mantis is aimed at security teams that want to automate vulnerability discovery while keeping a human reviewer in the loop. It bundles a set of review skills a coding agent can work through, from planning and scanning to reproducing and patching, and each stage is meant to be adapted to your own stack and threat model. The project is upfront about the risks: the agent can generate and execute unstable code, so it expects false positives, requires every finding to be checked by a security expert, and should only run in isolated, network-disabled environments. That makes it a fit for teams already doing AI-assisted code review and willing to tune the skills to their codebase, not a plug-and-play scanner. The same skills extend beyond application code to hardware/RTL, infrastructure-as-code, and ML pipelines.