// agents · google/mantis

mantis

mantis é um projeto de agentes de IA de código aberto de google (google/mantis no GitHub). Tem 2.380 estrelas no GitHub e 201 forks, é publicado sob a licença Apache-2.0 e foi atualizado pela última vez no GitHub em 7 de outubro de 2026.

Google's modular toolkit that lets AI coding agents hunt, reproduce, and patch vulnerabilities autonomously.

★ 2,4 mil estrelas⑂ 201 forksApache-2.0atualizado out 2026
▦ visual: o README deste projeto não inclui nenhuma captura incorporável,
então aqui vai um marcador. O guia abaixo está completo mesmo assim.
// dados do projeto

Dados do projeto

Repositório
google/mantis
Estrelas no GitHub
2.380
Forks
201
Licença
Apache-2.0
Última atualização no GitHub
7 de outubro de 2026
Categoria
Agentes de IA
Tipo de ficha
Guia de instalação completo
Site oficial
Official site
// como funciona

Como funciona

  1. Clarify your goal

    Decide which codebase or file you want reviewed, and prepare an isolated, restricted environment with no production access, as the README strongly requires.

  2. Get the project

    Clone the repository and move into the reference harness directory.

  3. Install and configure

    Run the install script, authenticate Google Cloud Application Default Credentials if you use Vertex AI, then let the configuration tool auto-detect capabilities or use its interactive wizard.

  4. Run your first task

    Run the preflight validation, then launch a review campaign against a file or repository, optionally focusing it with a plain-language hint.

// recursos

Por que as pessoas gostam tanto

Threat modelling and code indexing

Mantis reviews codebase history for past vulnerabilities, builds a semantic index or summaries for navigation, and generates a threat model before scanning.

Hypothesis-driven agent research

Individual agents research hypotheses or scan files systematically, then deduplicate the findings they produce.

Triage and calibration against hallucination

Findings are critiqued, statically checked for production viability, and calibrated with a rubric so severity is not inflated.

Reproduction attempts

Suspected vulnerabilities are reproduced at whatever depth the environment allows, from a reasoned exploit sketch to a unit test or a mock server.

Adversarial patch verification

Mantis drafts patches and uses an adversarial loop to check the vulnerability is genuinely fixed.

Custom research graphs and focus hints

You can steer a run with --focus, remove spend limits for long unattended runs with parallel workers, or have it design a new agent-graph topology from an objective.

Advertisement
// execute você mesmo

Execute você mesmo

  1. Clone and install the reference harness

    Install the venv tooling first if needed, then run the bundled installer.

    git clone https://github.com/google/mantis.git
    cd mantis/reference && ./install.sh
  2. Configure and validate

    Authenticate ADC for Vertex AI, auto-configure, and run the fast preflight plus reachability probe.

    gcloud auth application-default login
    python3 scripts/configure.py --auto
    python3 scripts/configure.py --test --probe
  3. Launch a review campaign

    Point run.sh at a file or repository, optionally with a focus hint.

    ./run.sh path/to/code
    ./run.sh path/to/code --focus "look for IDOR"
// casos de uso

O que você pode criar

Advertisement
// perguntas frequentes

Perguntas frequentes

Who maintains it?

It is developed by Google and published under the google GitHub organisation, though the README notes it is not an officially supported Google product.

Is it free to use?

Yes, the code is Apache-2.0 licensed and free to use and adapt. Running it still costs whatever the underlying AI models charge.

Does it need a paid API key?

In practice yes: the reference harness is built around Google Cloud and Gemini/Vertex AI access, so you need Google Cloud credentials (ADC) and you pay for model usage, with budget controls in the tool.

How does it compare to a well-known alternative?

Traditional SAST tools like CodeQL or Semgrep match deterministic rules; Mantis uses agents to form hypotheses, attempt reproductions, and draft patches, so it explores behaviour rules cannot express, but its findings need human verification.

How do I get started?

Clone the repo, run reference/install.sh, configure with scripts/configure.py --auto, pass the preflight probe, then run ./run.sh on a target in an isolated environment.

// continue explorando

Ferramentas semelhantes

Agentes de IA

vocode-core

Build voice-based LLM agents with a modular, open-source toolkit.

★ 3,8 mil estrelasMIT
Ver o guia →
Agentes de IA

adk-python

Google's code-first toolkit for building real AI agents.

★ 21,7 mil estrelasApache-2.0
Ver o guia →
Agentes de IA

adk-js

Google's code-first TypeScript toolkit for building AI agents.

★ 1,4 mil estrelasApache-2.0
Ver o guia →
Agentes de IA

chrome-devtools-mcp

Chrome DevTools for coding agents: an MCP server that lets agents debug and inspect real Chrome

★ 53,1 mil estrelasApache-2.0
Ver o guia →
Agentes de IA

nodeterm

Manage parallel AI coding agents on an infinite tmux-backed canvas.

★ 1,9 mil estrelasNOASSERTION
Ver o guia →
Agentes de IA

babysitter

Babysitter enforces the process: deterministic, quality-gated orchestration for fleets of coding agents.

★ 1,8 mil estrelasMIT
Ver o guia →
// alternativas

Alternativas em Agentes de IA

Os outros projetos de Agentes de IA com mais estrelas no catálogo do LibreAI — a lista realista de alternativas se mantis não for o ideal para você.

// mais em agents

Mais em Agentes de IA

Projetos de Agentes de IA próximos no catálogo, os mais próximos em estrelas de mantis: continue explorando dos dois lados dele.

Baixe o mantis

Grátis e aberto: pegue o código-fonte, dê uma estrela no repositório e comece a criar.