Quality

Code Review runs a final review on a pull request by delegating to other code-review subagents and collecting their findings. Use it to surface every issue with file paths and line numbers before merging.

Code Review Change Size sets limits for how many lines a change should touch and asks for staged delivery when a diff is too large. Use it to judge whether a change is reviewable in one pass or should be split.

Code Review Context defines constraints for building model context incrementally, with bounded fragments and hard caps. Use it when reviewing changes that inject visible context into Codex requests.

Code Review Testing gives guidance for authoring tests for agent changes, with a preference for integration tests in core/suite. It is used when changes affect agent logic and need readable, maintainable test coverage.

CodeQL Audit builds a CodeQL database and runs query suites through the mantis_codeql MCP server. Use it for dataflow-aware SAST when you need source-to-sink analysis beyond pattern matching tools.

Codex Bug diagnoses bug reports for openai/codex issues and decides whether to verify the problem, ask for more details, or explain why it is not a bug. Use it when given a Codex GitHub issue URL and asked for next steps.

Detection Breadth explains when to add bandit for Python-specific SAST and trivy for dependency, secret, and IaC coverage alongside the core scanner set. It helps you widen findings without double-counting or overstating confidence.

Findings Spine records vulnerability findings in the mantis_findings service instead of prose. Use it to create, confirm, reject, grade, and list findings with append-only evidence and lifecycle state.

Http Evidence turns a captured HTTP request and response into a bounded, redacted evidence pack with stable request and response refs. Use it before attaching traffic as finding evidence or cross-referencing duplicates.

OSV Dependency Scan runs osv-scanner through the mantis_osv_scanner MCP server to find known vulnerable dependencies in manifests and lockfiles. Use it during the Detect stage and verify whether flagged code is actually reached before rejecting or accepting a finding.

Program Analysis uses source-sink scanning, AST pattern search, and SMT reachability checks to narrow candidates and prove whether a path to a sink is reachable. Use it after finding a potential issue to confirm or reject exploitability.

Remote Tests exercises app-server and exec-server integration tests against local and remote execution environments. Use it when you need to run or adapt tests for Docker, Wine, or other remote executor setups.