hey have u guys seen Google Mantis
they open sourced it like 2 days ago. its an AI agent that scans your code for vulnerabilities but the twist is it actually validates them instead of just listing every possible issue
apparently it has like 15 or more tools that run in sequence. identifies, reproduces, and even generates fixes for real bugs. the whole point is cutting down false positives that normal AI scanners spit out
been dealing with this exact problem at work. our scanner throws 50 warnings and 45 are nothing. then u spend hours separating real issues from noise
if Mantis actually reproduces the bug before flagging it thats a different game. no more chasing ghost vulnerabilities
gonna try it on one of my side projects this week. anyone already tested it? does the false positive reduction hold up on real codebases or just benchmarks
Top comments (0)