Mantishack (Mantis AI)
An autonomous vulnerability-discovery agent rebuilt on OpenAI Codex CLI, using a detect-generously/validate-ruthlessly pipeline to turn scanner noise into provably reachable vulnerabilities.
README asserts double-gated exploitation (off by default), canary decoy tools for prompt injection, code-level enforcement of 'no proof -> no confirm' in the findings service, and scope/authorization-first guidance; however the actual MCP server code, agent TOMLs, and system prompts were not present in the supplied evidence, so least-privilege and confirmation are documented claims only — deducted accordingly. Sensitive-data handling rests on one phrase ('bounded, redacted evidence pack') with no shown implementation: 1. Dependency pinning is reasonably strict (resolutions/overrides), and missing external tools degrade to available:false rather than fabricated findings. No rollback story at all — the fixer modifies code with no revert/recovery path documented: 1. Attribution is excellent: upstream Codex, retired RAPTOR history, dual copyright, NOTICE, CITATION.cff.
Internally self-consistent: the layering (tool=code / agent=prompt / skill=knowledge) matches across README and described MANTIS.md; scanners report plainly when binaries are missing instead of inventing results — credible failure semantics. But the roadblock/rejection implementation in the findings service was not shown, so documentation is taken on trust, not full marks. SECURITY.md is the unmodified upstream OpenAI/Codex text and adds nothing project-specific.
Audience and scenario are explicit (authorized offensive-AppSec practitioners on owned/authorized targets), with a rule to fall back to read-only static analysis when authorization is unclear — good boundary awareness. Trigger precision cannot be assessed: the actual agent/skill trigger definitions and slash-command files were not provided: 1. Multi-ecosystem dependencies (pip/brew/go/CodeQL CLI) raise environment demands, though the report-until-installed pattern mitigates this.
Information architecture is clear (repo map, wired-layers table, lifecycle diagram); install notes are concrete and executable (build commands plus per-scanner installs); known limitations are candid ('not polished software', explicit roadmap) — a strength; dual license files plus NOTICE and CITATION.cff are complete, with an explicit CodeQL commercial-use warning. Deductions: no version number and no CHANGELOG — versioning scores 0; no example outputs or FAQ; maintenance responsibility is only an issue link with an unverified publisher: 1.
Output form is clear (tool-owned findings, rejections citing roadblocks, HTTP evidence packs with stable hashes) and more auditable than prose reports. The 'detection is commodity, validation precision is the product' positioning offers some marginal value, and the zero-dependency components (findings/canary/http-audit) work out of the box. But no effectiveness claim is backed by execution evidence or benchmarks, and cost (Rust build + 8+ external tools + LLM API) versus benefit is unquantified — no full marks.
Claims are traceable to concrete file paths (.codex/mcp-servers/, codex-rs/, etc.) and fact is separated from vision ('The core bet'). However the supplied file set cannot cross-corroborate the key claims — the core capability-layer code is absent, so cross-source corroboration scores 1; overall confidence stays low and documentation assertions were not treated as verified facts.
- All security mechanisms (exploit gating, canary tripwires, findings-enforced transitions) are documentation claims; the implementation code was not in evidence. Audit .codex/mcp-servers/ and the agent prompts yourself before use.
- The fixer modifies target code with no rollback/recovery mechanism documented — run only under version control in production settings.
- Evidence-pack 'redaction' is a single asserted phrase; captured HTTP exchanges may contain credentials or tokens — verify the redaction logic yourself.
- CodeQL CLI does not permit commercial use; review licenses of every invoked component before commercial deployment.
- Publisher identity is unverified; sensitive data (API keys, target-system details) flows through the model provider — assess exfiltration exposure.
- The repository has no version number or changelog; upgrades cannot be tracked against changes.
What does this agent do, and when should you use it?
Mantishack is a rebrand of OpenAI's Codex CLI (Rust, Apache-2.0) wired end-to-end as Mantis AI, an offensive-AppSec harness for autonomous vulnerability discovery. Its core is an MCP capability layer (.codex/mcp-servers/, wrapping semgrep, CodeQL, osv-scanner, trufflehog, bandit, trivy, ast-grep, and z3) plus a findings service that owns every finding as state in a lifecycle: candidate → confirmed/rejected → exploited → fixed → verified. Validation requires attacker-simulation reasoning and reachability evidence (e.g., z3-backed smt_check_reachability); candidates without evidence are rejected and must cite a specific roadblock. Detection follows a report-until-installed principle: when an underlying scanner binary is missing, the tool honestly degrades to available: false rather than fabricating results. The project self-describes as a working harness with real gaps, not polished software, and requires authorization-only use, with gated exploitation off by default.
After building the Codex CLI in codex-rs, the agent runs a staged pipeline of role agents (.codex/agents/*.toml): recon, context-enrich, detector, reachability, validator, chain-builder, exploiter (gated), fixer, reporter, and an orchestrator. It reads the target codebase and invokes MCP capability servers for SAST/SCA/secrets scanning (semgrep_scan, codeql_analyze, osv_scan, trufflehog_scan, bandit_scan, trivy_scan), structural search (ast_grep_scan), and reachability proving (smt_check_reachability, constructing SMT-LIB2 path conditions solved by z3 to sat/unsat/unknown). Findings are managed exclusively via the findings service's finding_create/update/get/list tools, which enforce "no proof -> no confirm" and "rejection must cite a roadblock"; the http-audit server turns captured HTTP exchanges into redacted evidence packs with stable request-ref hashes, and the canary server deploys decoy tools that alert on prompt injection or hallucinated tool use. Output is a fix-and-verify vulnerability report; a skills layer (.codex/skills/*/SKILL.md) provides playbooks such as mantis-pipeline.
- AppSec engineers running high-recall vulnerability detection on codebases they own or are explicitly authorized to test, with attacker-simulation filtering out false positives
- Security teams that need every confirmed finding backed by reachability evidence (a z3 solver verdict or an HTTP evidence pack) rather than raw scanner output
- Penetration testers doing static recon and vulnerability chaining within authorized scope, keeping exploitation double-gated off until active testing is authorized
- Researchers switching underlying models via Codex CLI's provider-agnostic routing without changing the framework
- Tool developers extending capability by adding MCP servers on the existing report-until-installed pattern (e.g., DAST, OOB, fuzzing), reusing the findings lifecycle and canary tripwire
What are this agent's strengths and limitations?
- Validation precision first: the findings service enforces "no proof -> no confirm" in code, and rejections must cite a specific roadblock (auth gate, sanitizer at sink, provably unreachable path), cutting scanner false-positive noise
- Z3 SMT reachability integration: smt_check_reachability drives the detect-to-validate transition with provable sat/unsat/unknown verdicts instead of LLM discretion
- Built-in injection defense: canary decoy tools alert on prompt injection or hallucinated tool use
- Honest degradation: every capability server reports available: false when its scanner binary is missing, never fabricating findings
- Provider-agnostic model routing inherited from Codex CLI lets you swap the underlying model
- Heavy external toolchain dependency: Rust build, Node.js, Python, z3, and multiple scanner binaries — missing any one degrades capability, and full power requires installing each
- CodeQL does not permit commercial use; all invoked component licenses must be reviewed before commercial deployment
- Self-described as not polished software: the README and MANTIS.md document real gaps, with some flows still requiring external binaries or a running target
- It is a rebrand of the Codex CLI framework, so keeping in sync with upstream updates is an adoption cost borne by the user
- As an autonomous offensive-security agent, it demands strict authorization discipline; misuse against unauthorized targets is a compliance risk on the operator
How do you install or deploy this agent?
Requires a Rust toolchain (version pinned in codex-rs/rust-toolchain.toml), Node.js (MCP servers are pure Node.js), Python, and optional scanner binaries. Steps:
bash
git clone https://github.com/deonmenezes/mantishack.git
cd mantishack/codex-rs
cargo build --release -p codex-clicd ..
# Install underlying scanner binaries (missing ones degrade honestly)
pip install semgrep bandit
brew install trufflehog trivy z3 ast-grep
go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
# CodeQL CLI installed separately: https://github.com/github/codeql-cli-binariesModel providers, API keys, and per-model settings are configured the same way as upstream Codex CLI (see codex-rs/config.md and codex-rs/model-provider/).
How do you use this agent?
Run from the repo root so the project-scoped .codex/config.toml resolves:
bash
./codex-rs/target/release/codexThe TUI plays the Mantis mascot boot animation. The agent follows the mantis-pipeline master playbook in .codex/skills/; establish scope and authorization with the target first, restricting runs to read-only static analysis if authorization is unclear. Run staged role agents (recon, detector, validator, etc.) via spawn_agent; only confirmed findings proceed to chain/exploit/fix/verify, and exploiter is double-gated and off by default.
How does this agent compare with similar options?
Compared with upstream OpenAI Codex CLI, Mantishack keeps the full framework (sessions, sandboxing, TUI, MCP client) but adds a vulnerability-discovery-specific MCP capability layer, role-agent catalog, findings lifecycle, and authorized-security contract. It historically also rebranded RAPTOR, a Claude Code-based framework, but that architecture is retired and no RAPTOR code ships in the current tree.