Google releases open-source toolkit for ai-powered vulnerability detection and repair

Google has released Mantis, an open-source toolkit designed to enable AI coding agents to identify, reproduce, and fix software vulnerabilities. The stack-agnostic tool allows agents to navigate the full vulnerability lifecycle, from detection to patching and risk assessment. Mantis is structured as a series of modular skills, each invoked as a slash command, and can be integrated with existing coding agents through frameworks like Gemini CLI and Google ADK. The toolkit operates in three phases: initial learning, discovery and filtering, and verification and remediation. Early stages gather historical data and build a knowledge base, while later stages execute payloads in isolated environments and assess residual risks. A new feature, /mantis-advise, helps prevent recurring vulnerabilities by analyzing past issues before code is written. Mantis is currently deployable for local and internal use but not yet for production environments. The project is available on GitHub, with additional resources including a reference guide and cloud security perspectives.