deonmenezes/mantishack

Canary Tripwire Response tells you how to react if a mantis_canary decoy tool is mentioned or called. It treats the event as a security incident, preserves evidence, and stops normal execution.

Code Breaking Changes searches external integration surfaces for breaking changes in app-server APIs, CLI parameters, configuration loading, and session resuming. Use it when reviewing changes for compatibility risks across these interfaces.

Code Review runs a final review on a pull request by delegating to other code-review subagents and collecting their findings. Use it to surface every issue with file paths and line numbers before merging.

Code Review Change Size sets limits for how many lines a change should touch and asks for staged delivery when a diff is too large. Use it to judge whether a change is reviewable in one pass or should be split.

Code Review Context defines constraints for building model context incrementally, with bounded fragments and hard caps. Use it when reviewing changes that inject visible context into Codex requests.

Code Review Testing gives guidance for authoring tests for agent changes, with a preference for integration tests in core/suite. It is used when changes affect agent logic and need readable, maintainable test coverage.

CodeQL Audit builds a CodeQL database and runs query suites through the mantis_codeql MCP server. Use it for dataflow-aware SAST when you need source-to-sink analysis beyond pattern matching tools.

Codex Bug diagnoses bug reports for openai/codex issues and decides whether to verify the problem, ask for more details, or explain why it is not a bug. Use it when given a Codex GitHub issue URL and asked for next steps.

Codex Issue Digest runs a GitHub issue digest for openai/codex by feature-area labels and time window. Use it to summarize recent bug reports or enhancement requests, especially for owner labels like tui, exec, or app.

Detection Breadth explains when to add bandit for Python-specific SAST and trivy for dependency, secret, and IaC coverage alongside the core scanner set. It helps you widen findings without double-counting or overstating confidence.

Findings Spine records vulnerability findings in the mantis_findings service instead of prose. Use it to create, confirm, reject, grade, and list findings with append-only evidence and lifecycle state.

Http Evidence turns a captured HTTP request and response into a bounded, redacted evidence pack with stable request and response refs. Use it before attaching traffic as finding evidence or cross-referencing duplicates.

Image Generation creates or edits raster images for tasks like photos, illustrations, mockups, textures, sprites, and transparent cutouts. Use it when you need a bitmap asset rather than code, SVG, or other native design output.

Mantis Pipeline runs an authorized, staged vulnerability-discovery workflow from recon through validation, verification, chaining, and reporting. Use it to coordinate tools, agents, and evidence handling across the finding lifecycle.

OSV Dependency Scan runs osv-scanner through the mantis_osv_scanner MCP server to find known vulnerable dependencies in manifests and lockfiles. Use it during the Detect stage and verify whether flagged code is actually reached before rejecting or accepting a finding.

PR Babysitter continuously watches a pull request for review comments, CI checks, and mergeability until it is merged, closed, or needs user help. It can diagnose failures, retry flaky checks, and surface new feedback on open PRs.

PR Body Editor updates the title and body of one or more pull requests. Use it when you need to preserve existing content while rewriting the PR summary, motivation, and verification details.

Path Types chooses Rust types for operating system paths across the repository. Use it when defining new path-bearing types or when explicitly migrating existing ones.

Program Analysis uses source-sink scanning, AST pattern search, and SMT reachability checks to narrow candidates and prove whether a path to a sink is reachable. Use it after finding a potential issue to confirm or reject exploitability.

Pushing CI Changes helps when updates to .github workflow files are rejected because approval is required. It tells you to request the temporary workflow access and retry after it propagates.

Remote Tests exercises app-server and exec-server integration tests against local and remote execution environments. Use it when you need to run or adapt tests for Docker, Wine, or other remote executor setups.

Secrets Scan runs TruffleHog through the mantis_trufflehog MCP server to find exposed credentials. Use it during secret audits and handle findings without ever revealing the raw secret.

Semgrep Triage runs Semgrep through the mantis_semgrep MCP server to detect potential issues in code. It is used to review candidates, verify reachability, and decide whether results should be confirmed or rejected.

Test TUI guides interactive use of Codex TUI to verify changes. It covers startup flags, logging, and how to send test messages for reliable debugging.

Update V8 Version updates Codex's pinned v8 and rusty_v8 versions, then validates the release-candidate path or investigates build failures. Use it when bumping V8, refreshing artifacts, or diagnosing why a version update no longer builds.