mantis-dedupe

Merge redundant security findings into unique records with audit history.

731|84|Updated Jun 15, 2026
One-click install
npx skills add https://github.com/google/mantis --skill mantis-dedupe
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: mantis-dedupe
Source: https://github.com/google/mantis/tree/main/mantis-dedupe
Command: npx skills add https://github.com/google/mantis --skill mantis-dedupe

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This skill addresses the challenge of alert fatigue by automatically identifying and merging redundant security findings generated during automated code analysis, ensuring that security teams focus on unique, actionable issues.

Core Features & Use Cases

  • Intelligent Merging: Uses deterministic rules to cluster overlapping findings based on code paths and titles while preserving full audit history.
  • Snapshot-Gated Deduplication: Prevents false positives by verifying findings against historical snapshots and tracking regressions.
  • Use Case: When running a multi-pass security scan that generates hundreds of raw JSON reports, use this skill to collapse duplicates into a single, high-quality record per vulnerability.

Quick Start

Run the mantis-dedupe command to process all raw findings in the current workspace and merge duplicates into the primary records.

Frequently Asked Questions about mantis-dedupe

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deduplicate security findings to reduce alert fatigue in automated pipelines?

Deduplicating security findings to reduce alert fatigue involves identifying and merging redundant vulnerability records generated during automated code analysis. This skill consolidates raw findings into unique, descriptive records, ensuring security teams focus on actionable issues.

What is snapshot-gated deduplication for vulnerability tracking?

Snapshot-gated deduplication is a mechanism that verifies vulnerability findings against historical snapshots to prevent false positives. It tracks regressions across code paths while preserving full audit history, ensuring idempotent and traceable merging of security data.

How do I merge duplicate code review vulnerabilities from multi-pass security scans?

Merging duplicate code review vulnerabilities from multi-pass scans requires clustering overlapping findings based on deterministic rules. This skill processes raw JSON reports, collapsing duplicates into a single, high-quality record per vulnerability while maintaining lineage.

Do I need a structured workspace environment to automate security finding consolidation?

A structured workspace environment is required to automate security finding consolidation. You need defined finding directories and state-tracking files to ensure the merging process remains idempotent and traceable across historical snapshots.

Can I use this deduplication tool for large volumes of raw JSON vulnerability reports?

This deduplication tool is designed for large volumes of raw JSON vulnerability reports. It operates within automated security review pipelines to manage extensive vulnerability data, intelligently merging duplicates based on code paths and titles.

Why does security deduplication track lineage across historical code snapshots?

Security deduplication tracks lineage across historical code snapshots to prevent false positives and monitor vulnerability regressions. This approach preserves a full audit history, ensuring merged records maintain accurate context across multiple scan passes.