Mantis: one command that chains discovery, recon and scanning into a report

The pipeline is the product, not any single tool in it

Mantis is described as a security framework that automates the workflow of discovery, reconnaissance and vulnerability scanning, and the README's summary is explicit about the shape. It takes top-level domains as input, progresses to discovering the corresponding assets including subdomains and certificates, performs reconnaissance on the active assets, and concludes with a scan for vulnerabilities, secrets, misconfigurations and phishing domains, all powered by a blend of open-source and custom tools. The value of the framework is therefore in the wiring rather than in any scanner. The README says the tool progresses seamlessly through those stages, and the feature list names automated discovery, recon and scan, super-easy scan customisation, distributed scanning, dashboard support, vulnerability management, advanced alerting and DNS service integration.

Three module groups, and recon is where the bulk of the work sits

The module breakdown shows the proportions. Discovery covers subdomains and certificates. Recon is the widest group, with open ports, technologies, CDN, WAF, web server, IP, ASN information and location. Scan covers domain level vulnerabilities and misconfigurations, secrets scanning and phishing domains. That split is also a rough guide to the runtime cost, since most of the network traffic is in the recon stage, where each discovered host is probed. The framework advertises the ability to integrate a new tool, existing or custom, in minutes, and the configs/ directory in the repository root is where the tool definitions live, which is the extension point to look at first if you want to add a scanner that is not bundled.

Two commands, and onboard has to come first

The command line interface is small, with two subparsers. The README marks onboard as the first-time scan, run it first, and shows it taking either a target or a file.

mantis onboard -o example_org -t example.org
mantis onboard -o example_org -f file.txt

The file form accepts any combination of TLD, subdomain, IP range and IP CIDR, which is how you onboard a range rather than a single domain. Once an organisation is onboarded, scanning it is the second command, optionally narrowed to a single application with the -a flag.

mantis scan -o example_org
mantis scan -o example_org -a example_app

Other flags cover passive port scanning with -p, marking stale domains with -s, ignoring stale domains with -i, deleting logs of previous scans with -d, verbose output with -v, and the AWS profiles used for Route53 with -aws. There is also a --sub option to onboard and scan a single subdomain.

Ray is how one scan becomes many machines

Distributed scanning is implemented with the Ray framework. The -r or --use_ray flag switches it on, and -n or --num_actors sets the number of Ray actors, defaulting to 10. The dependency list confirms it, with ray at version 2.8.0 in both pyproject.toml and requirements.txt. The motivation is in the README's warning, that the framework combines a number of open source and custom tools and runs them in parallel, hence it is CPU intensive and recommended to run on a dedicated VM, and the -tc option controls that parallel processing. The guidance is to set -tc to 1 or 2 on a low configuration machine and increase it on a higher one. So there are two levels of parallelism, the local thread count and the number of Ray actors, and they are not the same thing.

Docker is the recommended path, and it is not a small stack

The README says installing via Docker would be a good start to get a handle on the framework, and explains why the shell script exists: Mantis also includes MongoDB and AppSmith, so a script installs all the components. The procedure is a clone, a change into the setup directory, and the OS-specific setup script.

git clone https://github.com/PhonePe/mantis.git
cd mantis/setup/docker
./docker-setup-ubuntu.sh

A macOS variant, docker-setup-macos.sh, is provided, and uninstalling is a docker compose down in the same directory, which removes the resources created by the installation. The minimum system requirements for a single machine scan are stated as Ubuntu or macOS, 4 GB of RAM, 2 cores and 16 GB of storage, and the Docker image itself is substantial. The Dockerfile builds a Go helper from the go-wayback project in a first stage, then installs wget, unzip, tar, gcc, libpcap-dev, dnsutils, git and dnstwist, and then fetches individual binaries including subfinder, httpx and ipinfo at pinned versions, plus findcdn installed from git and naabu.

The dashboard is AppSmith, and it needs a scan to exist first

The dashboard is not a custom UI. It is AppSmith, running as a separate service on port 1337 alongside MongoDB on 27017 with the default database named mantis. The README is explicit that you must run at least one scan before setting up the dashboard, and the onboard command shown for that purpose is mantis onboard -o org_name -t example.in. After the scan you open http://mantis.dashboard:1337, create an AppSmith account, and import the dashboard template JSON from the dashboard_templates folder in the cloned repository. You then enter the MongoDB connection details, with host mantis.db, port 27017 and default database mantis, and finally press Deploy to view results rather than remaining in the template edit mode. The setup is a guided sequence rather than an automated one, which is the main friction for a Docker-based install.

A beta-phase tool with a stable-sounding version history

The README states the project is in the beta phase and asks users to report installation issues on Discord, and it separately lists beta support among the features. The packaging metadata complicates that reading, since the pyproject.toml carries a Development Status of Production/Stable and a version of 1.5.0, while the release list shows cli-1.6.0 from 2025-03-21, cli-1.5.0 from 2024-12-08 and cli-1.4.0 from 2024-11-17, so the published artefacts are tagged as cli releases. The last push was on 2026-07-07 and the repository is not archived. The licence is Apache-2.0, and the pyproject.toml classifies the intended audience as internal security teams and bug bounty hunters, with the topic listed as a recon framework. There is also a SECURITY.md and a CODE_OF_CONDUCT.md in the root.

Editorial conclusion

Mantis fits a security team that repeatedly runs the same external attack surface review across many domains, because the discovery to recon to scan chain is scripted and the results land in a dashboard rather than in a folder of tool output. It is a poor fit for a single target or a small team, since the Docker setup pulls in MongoDB, AppSmith and a pile of binaries, and the README warns that the framework is CPU intensive enough to want a dedicated VM. Verify first that you have a machine meeting the 4 GB, 2 core and 16 GB storage floor, and lower the -tc thread count on anything smaller, and confirm that the target domains are ones you are authorised to scan before running the first onboard.

Frequently asked questions

Official sources

1. License: Apache-2.0
2. PhonePe/mantis on GitHub
3. Project website
4. README
5. Releases