Manta puts 20 review agents in your git workflow. Secrets, injection flaws and unsafe migrations are blocked before they land in your repo.
Three agents read every commit. The rest run at push, routed by what the change actually touches. Works with Claude Code, OpenAI Codex, Gemini CLI and GitHub Copilot — the hooks detect whichever you have installed.
$ git commit -m "feat: add referral payouts" Manta Pre-Commit Review Reviewing 5 staged file(s)… Running security-sentinel, code-quality, db-migration-guardian CRITICAL src/routes/payout.ts:42 Unparameterised SQL from req.query.userId · CWE-89 CRITICAL migrations/0042_payouts.sql:7 NOT NULL on a 4.2M-row table, no rollback WARNING src/routes/payout.ts:19 Validation duplicated from refund.ts:31 ✗ COMMIT BLOCKED · 2 critical findings Run /fix for AI-generated fix suggestions.
What runs, and when
The split is not arbitrary. Three agents run at commit — the checks where committing is itself the harm, because a secret in the history stays in the history. Everything else waits for push, where catching something late costs a rebase rather than a rotated credential.
git commit · 3 agentssecurity-sentinel — secrets, API keys, SQL injection, XSS, auth bypass,
OWASP Top 10.
code-quality — DRY, complexity, dead code, naming, missing error handling.
db-migration-guardian — table locks, missing rollbacks, unsafe
NOT NULL — only when a migration is staged.
git push · broader scopeThe same checks across the whole branch, plus perf-analyzer — N+1
queries, memory leaks, blocking operations, bundle bloat. A CRITICAL blocks
the commit; a WARNING blocks the push.
/audit, /security-scan, /write,
/scaffold, /ui, /blueprint,
/wiki, /explain, /debt,
/generate-tests — and the RPI workflow below.
MANTA_MODEL and
--depth are the two dials that decide how much you spend on each pass.
What's included
Security, code generation, quality enforcement and documentation, in one install. Any language — TypeScript, Python, Go, Rust, Ruby, Java, Kotlin, C/C#/C++, PHP, Swift.
OWASP Top 10, hardcoded secrets, API keys, SQL injection, XSS and auth bypass — caught and blocked before they reach your repo.
/write "feature" produces production-ready code — rate limiting, auth
wiring, validation, pagination and transactions included. No TODOs, no stubs.
DRY violations, cyclomatic complexity, N+1 queries, memory leaks and unsafe migrations, caught before they compound into something harder to fix.
/update-docs keeps README and CHANGELOG in step with your commits;
/blueprint maps an unfamiliar codebase in one pass.
Before you write a line
For anything non-trivial, the cheapest bug to fix is the one you decide not to build. Six agents evaluate the feature first, and the gate will tell you not to proceed.
Write rpi/{slug}/REQUEST.md in plain language.
/rpi-research — six agents, ending in GO / CONDITIONAL GO / DEFER / NO-GO.
/rpi-plan — product requirements, UX, engineering spec, phased roadmap.
/rpi-implement — phase by phase, with a validation gate after each.
Free edition and Enterprise
Manta stays free and open source — that is not a trial. Enterprise adds the governance layer: the agents a regulated team needs, and a hosted record of what the gate decided.
| Manta | Manta Enterprise | |
|---|---|---|
| Agents | 20 | 33 |
| Commands | 21 | 32 |
Review at git commit | 3 agents | 3 agents |
Review at git push | 3–4 agents, trigger-routed | up to 9 agents, trigger-routed |
| A warning at push | blocks | blocks only when two agents agree |
Code generation — /write, /scaffold, /ui | ✓ | ✓ |
| Research → Plan → Implement, with a GO/NO-GO gate | ✓ | ✓ |
| Security scan | OWASP + secrets | + dependency CVEs, licence conflicts, dead deps |
Spec governance — spec-guardian | — | ✓ |
| Compliance — GDPR, HIPAA, PCI-DSS, SOC 2 | — | ✓ |
| Zero-trust — IAM, mTLS, RBAC, token TTLs | — | ✓ |
| Observability checks on new endpoints | — | ✓ |
| Test-coverage enforcement | — | ✓ |
| Health scoring and trends across audits | — | ✓ |
Penetration testing — /pentest | — | on demand |
Log analysis — /log-analysis | — | ✓ |
| Hosted enforcement record and evidence bundles | — | ✓ |
| Licence | Apache 2.0, free forever | Commercial subscription |
Enterprise adds 13 agents; 11 of them are served from the control plane while a subscription is active. Counts are generated from the shipped rosters, not typed by hand.
Get started
Install into an existing repo or start fresh. The next git commit triggers the
pipeline — no account, no service to run, nothing sent anywhere.
Then open your AI tool and run /init for a new project, or /audit
to get a health report on an existing one. Codex and Gemini take the same prompts directly:
codex "$(cat .claude/commands/audit.md)".
Questions or feedback? ray@mantacron.com