Best for
- Security researchers with explicit authorization.
- AppSec teams combining automated detection with attacker-simulation validation.
- Technical users comfortable with an incomplete harness and external tool dependencies.
M
Mantishack
Community
An autonomous vulnerability-discovery agent for authorized security testing.
- Category
- Other #158 of 230
- Stars
- ★ 503 Very popular
- Runtime
- Rust · Node.js · Python · Go · Prebuilt binary
- Credentials
- No credential needed
- License
- Apache-2.0
- Last commit
- Tools
- 14
49FMRS · D
The supplied material describes Mantishack as an experimental Apache-2.0 MCP security-testing harness with tool-owned findings, validation gates, and several analysis capabilities. It provides no evidence for a client configuration, transport, or client compatibility.
Strongest · Documentation 13/20 Weakest · Reliability 8/20
Why each score
- Reliability 8/20
- The supplied evidence is only the README; no manifest, CI, tests, or actual MCP initialization and tool-list handshake evidence is provided. Therefore startup reliability and agreement between declared and implemented tools cannot be verified. The README says several tools depend on external binaries and degrade to available:false when missing, which is diagnostically better than fabricating results but also leaves key paths unverified, so points are deducted.
- Security and permissions 10/20
- The README explicitly requires authorization before testing and says unclear authorization should restrict activity to read-only static analysis; exploitation is described as double-gated and off by default, and the findings service allegedly requires evidence before confirmation. These are positive controls. However, this is offensive-security tooling with attacker simulation, HTTP auditing, and gated exploitation, while no reviewable evidence is supplied for the manifest, permissions, credential handling, network boundaries, or confirmation implementation, so the score remains moderate.
- Maintenance 8/20
- The repository is not archived and provides Apache-2.0 plus additional licensing and attribution information; the README also identifies an issue channel and explains the current architecture. It provides no evidence of releases, commit cadence, CI, dependency-update practice, vulnerability-response process, or maintainer governance. Stars and open issues do not add points, so sustained maintenance is only weakly supported.
- Documentation 13/20
- The README covers architecture, capabilities, the findings lifecycle, authorization guidance, dependency installation, missing-binary behavior, licensing, and limitations, and it openly describes the project as rough and dependent on external tools and targets. Deductions apply because no actual MCP manifest, client configuration example, tool parameters or response schemas, authentication and credential guidance, platform matrix, cost limits, test results, or systematic troubleshooting are provided.
- Setup experience 10/20
- The README provides Rust build steps and installation commands for several scanners, explains that execution should occur from the repository root for project configuration resolution, and states that the Node MCP servers need no separate installation. However, it lacks mainstream MCP-client configuration examples, manifest contents, runtime version requirements, authentication steps, and end-to-end connection evidence. The need for Rust, Python, Homebrew or Go, and possibly CodeQL creates a manual and fragile setup path.
Static review · not runListed 2026-08-14
Read the FMRS scoring method →Fit and risk
What it can accessReads local filesRuns commands or code
Not for
- Testing targets without authorization.
- Users seeking a polished, complete commercial security platform.
- Users expecting fabricated results when external scanners are unavailable.
Required permissions
- Requires access to read and analyze the target codebase.
- Depending on enabled capabilities, may invoke local scanners, solvers, and the CodeQL CLI.
- Authorization must be established before active or exploit testing; otherwise restrict runs to read-only static analysis.
Risks and side effects
- Gated exploitation is off by default, but active testing can still affect a target.
- Missing underlying binaries make corresponding scanning capabilities unavailable.
- The project describes itself as rough, with known gaps and unfinished external toolchains.
- CodeQL in particular does not permit commercial use; licenses for all invoked components should be reviewed.
Setup
Before you start
Runtime：Rust · Node.js · Python · Go · Prebuilt binary
Clone the repository, enter codex-rs, and run cargo build --release -p codex-cli. Return to the repository root and run ./codex-rs/target/release/codex. Optionally install semgrep, bandit, trufflehog, trivy, z3, ast-grep, osv-scanner, and the CodeQL CLI. When a wrapped binary is missing, the corresponding server reports available: false.
Check that it works
Build codex-rs from source and run ./codex-rs/target/release/codex from the repo root; if the MCP servers under .codex/config.toml registered, tools like semgrep_scan and finding_list should appear in the client's tool list, with uninstalled scanners reporting available: false instead of erroring.
Troubleshooting
- Run from the repository root so the project-scoped .codex/config.toml resolves.
- Verify that the Rust toolchain is available and codex-cli builds successfully.
- Check that required scanners, z3, ast-grep, osv-scanner, and CodeQL CLI are installed.
- Treat available: false as an unavailable dependency, not as evidence that no vulnerabilities exist.
- Consult MANTIS.md for the wired capabilities and areas requiring external binaries or a running target.
Things to try
Once connected, you can ask your AI assistant things like:
- Scan this repository with semgrep_scan and bandit_scan, then record the results as candidate findings
- Run smt_check_reachability on this source-to-sink flow and tell me whether the path is reachable
- Use osv_scan to check the dependency manifest for known vulnerabilities, then create findings for confirmed ones
- List all current findings and show which were rejected and the cited roadblock
Tools 14
semgrep_scan read-only
Scans code for security issues with Semgrep.
codeql_create_database writes
Creates a database for CodeQL analysis.
codeql_analyze read-only
Analyzes a codebase with CodeQL.
osv_scan read-only
Scans dependencies for known vulnerabilities.
trufflehog_scan read-only
Scans for potential secrets and credentials.
bandit_scan read-only
Scans Python code with Bandit.
trivy_scan read-only
Scans a project for security issues with Trivy.
source_sink_scan read-only
Performs heuristic source-to-sink analysis.
Show 6 more tools
ast_grep_scan read-only
Runs structural code searches.
smt_check_reachability read-only
Uses Z3 to check path-condition satisfiability and reachability.
finding_create writes
Creates a tool-owned finding record.
finding_update writes
Updates a finding and its lifecycle state.
finding_get read-only
Retrieves an individual finding.
finding_list read-only
Lists findings.
No matching tools
Use cases
Run high-recall security detection followed by validation on a codebase.
Assess attack paths with source-to-sink analysis and SMT reachability checks.
Track findings from candidate through confirmation, rejection, fixing, and verification.
Create bounded, redacted HTTP evidence packs.
Overview
Mantishack is Mantis AI, built on OpenAI Codex CLI as an offensive-AppSec harness for staged vulnerability discovery and validation over a codebase. Its pipeline covers reconnaissance, detection, reachability, attacker-simulation validation, chaining, gated exploitation, fixing, and reporting. Its MCP capability layer wraps static-analysis, dependency, secrets-scanning, and program-analysis tools.
Similar servers
Hevy MCP
77 · B
Manage your Hevy workout data from AI assistants via MCP.
Firecrawl MCP Server
75 · B
Firecrawl's official MCP server for web search, scraping, and structured extraction for AI agents
BioMCP
75 · B
One binary. One grammar. Evidence from the biomedical sources you already trust.
Compartment
75 · B
Encrypted, fully offline long-term memory for AI agents
Source revision c3a2e68e5790 Data synced 2026-10-19 Read the FMRS scoring method