Best for
- Security researchers with explicit authorization.
- AppSec teams combining automated detection with attacker-simulation validation.
- Technical users comfortable with an incomplete harness and external tool dependencies.
M
Mantishack
Community
An autonomous vulnerability-discovery agent for authorized security testing.
GitHub source repository ↗
49FMRS · D
The supplied material describes Mantishack as an experimental Apache-2.0 MCP security-testing harness with tool-owned findings, validation gates, and several analysis capabilities. It provides no evidence for a client configuration, transport, or client compatibility.
Mantishack is Mantis AI, built on OpenAI Codex CLI as an offensive-AppSec harness for staged vulnerability discovery and validation over a codebase. Its pipeline covers reconnaissance, detection, reachability, attacker-simulation validation, chaining, gated exploitation, fixing, and reporting. Its MCP capability layer wraps static-analysis, dependency, secrets-scanning, and program-analysis tools.
Tools
semgrep_scan
Scans code for security issues with Semgrep.
codeql_create_database
Creates a database for CodeQL analysis.
codeql_analyze
Analyzes a codebase with CodeQL.
osv_scan
Scans dependencies for known vulnerabilities.
trufflehog_scan
Scans for potential secrets and credentials.
bandit_scan
Scans Python code with Bandit.
trivy_scan
Scans a project for security issues with Trivy.
source_sink_scan
Performs heuristic source-to-sink analysis.
ast_grep_scan
Runs structural code searches.
smt_check_reachability
Uses Z3 to check path-condition satisfiability and reachability.
finding_create
Creates a tool-owned finding record.
finding_update
Updates a finding and its lifecycle state.
finding_get
Retrieves an individual finding.
finding_list
Lists findings.
Setup
Clone the repository, enter codex-rs, and run cargo build --release -p codex-cli. Return to the repository root and run ./codex-rs/target/release/codex. Optionally install semgrep, bandit, trufflehog, trivy, z3, ast-grep, osv-scanner, and the CodeQL CLI. When a wrapped binary is missing, the corresponding server reports available: false.
Fit and risk
Not for
- Testing targets without authorization.
- Users seeking a polished, complete commercial security platform.
- Users expecting fabricated results when external scanners are unavailable.
Required permissions
- Requires access to read and analyze the target codebase.
- Depending on enabled capabilities, may invoke local scanners, solvers, and the CodeQL CLI.
- Authorization must be established before active or exploit testing; otherwise restrict runs to read-only static analysis.
Risks and side effects
- Gated exploitation is off by default, but active testing can still affect a target.
- Missing underlying binaries make corresponding scanning capabilities unavailable.
- The project describes itself as rough, with known gaps and unfinished external toolchains.
- CodeQL in particular does not permit commercial use; licenses for all invoked components should be reviewed.
Troubleshooting
- Run from the repository root so the project-scoped .codex/config.toml resolves.
- Verify that the Rust toolchain is available and codex-cli builds successfully.
- Check that required scanners, z3, ast-grep, osv-scanner, and CodeQL CLI are installed.
- Treat available: false as an unavailable dependency, not as evidence that no vulnerabilities exist.
- Consult MANTIS.md for the wired capabilities and areas requiring external binaries or a running target.
Use cases
Run high-recall security detection followed by validation on a codebase.
Assess attack paths with source-to-sink analysis and SMT reachability checks.
Track findings from candidate through confirmation, rejection, fixing, and verification.
Create bounded, redacted HTTP evidence packs.
Supported clients
Supported clients have not been confirmed yet.