Google Mantis: An Agentic Vulnerability Scanning Harness for Reducing False Positives

Google has open-sourced Mantis, an AI-agent framework aimed at streamlining the software vulnerability lifecycle process. This framework, which includes automated identification, validation, reproduction, and fixing of vulnerabilities, aims to curb the high rate of false positives and hallucinated vulnerabilities observed in conventional AI-powered code scanning solutions.

Mantis stands apart from other systems by incorporating industry-standard agentic techniques, like critic and review agents, to sift out false positives and prioritize genuine findings. The system also has the capability to reproduce vulnerabilities in a sandboxed environment, offering concrete proof of a vulnerability's existence in a secure and controlled manner without solely relying on the LLM's judgment.

Mantis operates as a modular skill suite with more than 15 tools that function independently or in tandem. These tools, such as mantis-summarize, mantis-review, mantis-critic, and others, communicate with each other by reading and writing to a common state stored on disk. Mantis supports various models and allows for different models to be combined for different stages.

To enhance the speed and efficiency of automated vulnerability scanning pipelines, the framework recommends pairing the right AI model class with specific tasks. Heavier, more advanced models aren't necessary for all stages - lighter models like flash or lite work well for tasks like rapid classification, while more powerful models are better suited for deep contextual understanding and zero-shot problem solving.

Google explicitly notes that Mantis will still produce false positives, but it addresses this issue using the mantis-review stage, which applies rule-based negative filters to eliminate likely false positives. However, they caution against using the filter too broadly, as this could diminish the system's ability to detect genuine vulnerabilities.

Mantis is available on GitHub and includes a detailed agent reference guide outlining all available stages, their inter-stage contracts, and best practices for using the framework.