--- title: Getting started with the Mantis harness to find and fix bugs description: Google introduces Mantis, an open-source AI harness for discovering, triaging, reproducing, and patching software vulnerabilities at scale. It builds... canonical: https://daily.dev/posts/getting-started-with-the-mantis-harness-to-find-and-fix-bugs-mumebab3x twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Getting started with the Mantis harness to find and fix bugs | daily.dev og:description: Google introduces Mantis, an open-source AI harness for discovering, triaging, reproducing, and patching software vulnerabilities at scale. It builds... og:url: https://daily.dev/posts/getting-started-with-the-mantis-harness-to-find-and-fix-bugs-mumebab3x og:image: https://api.daily.dev/og/posts/muMEBaB3x.png og:image:alt: Getting started with the Mantis harness to find and fix bugs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Getting started with the Mantis harness to find and fix bugs **[Google Cloud](https://daily.dev/sources/gcp)** · 3 min read · 1 upvotes · 0 comments ## Summary Google introduces Mantis, an open-source AI harness for discovering, triaging, reproducing, and patching software vulnerabilities at scale. It builds hierarchical security summaries of repositories to reduce token overhead by over 85% while retaining structural context, and uses critic/review agents plus sandboxed reproduction to keep false positives low compared to typical AI code scanning (which the team notes often has true-positive rates under 7%). The post walks through cloning the GitHub repo and using a coding agent prompt to get started, plus a new mantis-advise skill for feeding accumulated knowledge back into secure code generation. Recommends feeding tools curated context and building sandboxes with clear vulnerability acceptance criteria. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Google's Mantis harness and how do I start using it to find vulnerabilities in my code? Mantis is an open-source AI harness from Google that automates vulnerability discovery, triage, reproduction, and patching across codebases. To use it, clone the repository from GitHub with git clone https://github.com/google/mantis.git, then open a coding agent and prompt it to use the Mantis framework located at path/to/mantis to review code at path/to/your/code. _Developers exploring AI-assisted vulnerability scanning can track tools like Mantis through daily.dev._ ### How does Mantis reduce false positives in AI-based vulnerability scanning? Mantis combines agentic techniques like critic and review agents with sandboxed reproduction of vulnerabilities to ground its findings, addressing the weak true-positive rates common in AI code scanning, which often fall below 7%. It also builds a hierarchical security summary tree that condenses files into directory and root-level summaries, cutting token overhead by over 85% while preserving structural context across large repositories. _Teams weighing AI vulnerability scanners against false-positive rates can follow this space on daily.dev._ ### What is the mantis-advise skill used for? The mantis-advise skill lets coding agents apply accumulated vulnerability knowledge from Mantis so they write secure code the first time, rather than only fixing bugs after they are discovered. It is intended for use once a team has already gotten comfortable with AI-discovered vulnerability workflows using the core Mantis harness. _Developers building secure-by-default coding agent workflows can keep up with tools like this on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#google](https://daily.dev/tags/google), [#ai-agents](https://daily.dev/tags/ai-agents), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/getting-started-with-the-mantis-harness-to-find-and-fix-bugs-mumebab3x) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Getting started with the Mantis harness to find and fix bugs","url":"https://daily.dev/posts/getting-started-with-the-mantis-harness-to-find-and-fix-bugs-mumebab3x","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/getting-started-with-the-mantis-harness-to-find-and-fix-bugs-mumebab3x"},"datePublished":"2026-09-02T16:10:19.920Z","dateModified":"2026-09-14T08:27:04.917Z","description":"Google introduces Mantis, an open-source AI harness for discovering, triaging, reproducing, and patching software vulnerabilities at scale. It builds...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8190d17aa4580dfea277d0e08766ea60?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8190d17aa4580dfea277d0e08766ea60?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Google Cloud","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Google Cloud","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/gcp","url":"https://daily.dev/sources/gcp"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/getting-started-with-the-mantis-harness-to-find-and-fix-bugs-mumebab3x","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,google,ai-agents,appsec","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Google Cloud","item":"https://daily.dev/sources/gcp"},{"@type":"ListItem","position":3,"name":"Getting started with the Mantis harness to find and fix bugs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/getting-started-with-the-mantis-harness-to-find-and-fix-bugs-mumebab3x#faq","mainEntity":[{"@type":"Question","name":"What is Google's Mantis harness and how do I start using it to find vulnerabilities in my code?","acceptedAnswer":{"@type":"Answer","text":"Mantis is an open-source AI harness from Google that automates vulnerability discovery, triage, reproduction, and patching across codebases. To use it, clone the repository from GitHub with git clone https://github.com/google/mantis.git, then open a coding agent and prompt it to use the Mantis framework located at path/to/mantis to review code at path/to/your/code. Developers exploring AI-assisted vulnerability scanning can track tools like Mantis through daily.dev."}},{"@type":"Question","name":"How does Mantis reduce false positives in AI-based vulnerability scanning?","acceptedAnswer":{"@type":"Answer","text":"Mantis combines agentic techniques like critic and review agents with sandboxed reproduction of vulnerabilities to ground its findings, addressing the weak true-positive rates common in AI code scanning, which often fall below 7%. It also builds a hierarchical security summary tree that condenses files into directory and root-level summaries, cutting token overhead by over 85% while preserving structural context across large repositories. Teams weighing AI vulnerability scanners against false-positive rates can follow this space on daily.dev."}},{"@type":"Question","name":"What is the mantis-advise skill used for?","acceptedAnswer":{"@type":"Answer","text":"The mantis-advise skill lets coding agents apply accumulated vulnerability knowledge from Mantis so they write secure code the first time, rather than only fixing bugs after they are discovered. It is intended for use once a team has already gotten comfortable with AI-discovered vulnerability workflows using the core Mantis harness. Developers building secure-by-default coding agent workflows can keep up with tools like this on daily.dev."}}]} ```