PhonePe · bl4ck574r · Jul 13, 2026 · Jul 13, 2026
diff --git a/.github/workflows/mantis-cli-release.yml b/.github/workflows/mantis-cli-release.yml
@@ -35,7 +35,7 @@ jobs:
           python-version: '3.9'
 
       - name: Install Poetry
-        run: pip install poetry==1.4.2
+        run: pip install poetry==1.8.4
 
       - name: Bump poetry version and add git tag
         uses: ./.github/actions/bump-version-and-git-tag
@@ -50,6 +50,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Set up QEMU (for multi-arch builds)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Log in to the Container registry
         uses: docker/login-action@v2
         with:
@@ -68,6 +74,7 @@ jobs:
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: |
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.LATEST_IMAGE_VERSION }}
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

diff --git a/Dockerfile b/Dockerfile
@@ -1,113 +1,40 @@
-FROM golang:1.22 as go-wayback-builder
-RUN git clone https://github.com/Abhinandan-Khurana/go-wayback.git
-WORKDIR go-wayback
-RUN GOOS=linux GOARCH=amd64 go build -o go-wayback v2/main.go
-RUN chmod +x go-wayback
-RUN cp go-wayback /usr/bin/
-
-FROM --platform=linux/amd64 python:3.9-slim
-
-# Install wget
-RUN apt-get update && apt-get install -y wget unzip tar gcc libpcap-dev dnsutils git dnstwist
-
-# Install git
-RUN apt-get update --fix-missing && apt install git -y
+# syntax=docker/dockerfile:1
+#
+# Multi-arch image. Build with buildx to target amd64 + arm64:
+#   docker buildx build --platform linux/amd64,linux/arm64 -t <tag> --push .
+# A plain `docker build` still works and targets the host arch.
+#
+# NOTE: go-wayback and go_virustotal are intentionally NOT installed here (they lack
+# multi-arch prebuilt binaries and need a dedicated source-build; tracked separately).
+# Their modules will be unavailable until re-added.
+
+FROM python:3.9-slim
+
+# System packages: build/runtime deps for the recon tools + installer prerequisites.
+# libpcap-dev -> naabu SYN scan; dnsutils -> dig; git/curl/unzip/tar -> installer.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        wget unzip tar gcc g++ libpcap-dev dnsutils git curl ca-certificates gnupg \
+    && rm -rf /var/lib/apt/lists/*
+
+# yq (mikefarah v4) — required by the tool manifest installer.
+# Detect arch at build time so this works on both amd64 and arm64.
+RUN ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') \
+    && curl -fsSL "https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_linux_${ARCH}" \
+        -o /usr/bin/yq \
+    && chmod +x /usr/bin/yq
 
 # Setup work directory
 WORKDIR /home/mantis
 
-# Install subfinder 
-RUN echo "Installing subfinder"
-RUN wget https://github.com/projectdiscovery/subfinder/releases/download/v2.6.6/subfinder_2.6.6_linux_amd64.zip
-RUN unzip subfinder_2.6.6_linux_amd64.zip
-RUN mv subfinder /usr/bin
-RUN rm -rf *
-
-# Install Go_Virustotal
-RUN echo "Installing Go_Virustotal"
-RUN wget https://github.com/Abhinandan-Khurana/go_virustotal/releases/download/v1.0.1/go_virustotal-linux-v1.0.1
-RUN mv go_virustotal-linux-v1.0.1 go_virustotal
-RUN chmod +x go_virustotal
-RUN mv go_virustotal /usr/bin/
-
-# Install Go_Wayback
-COPY --from=go-wayback-builder /usr/bin/go-wayback /usr/bin
-
-# Install HTTPX
-RUN echo "Installing HTTPX"
-RUN wget https://github.com/projectdiscovery/httpx/releases/download/v1.6.8/httpx_1.6.8_linux_amd64.zip
-RUN unzip httpx_1.6.8_linux_amd64.zip
-RUN mv httpx /usr/bin
-RUN rm -rf *
-
-# Install Findcdn
-RUN echo "Installing Findcdn"
-RUN pip install git+https://github.com/cisagov/findcdn.git
-
-# Install Ipinfo
-RUN echo "Installing Ipinfo"
-RUN wget https://github.com/ipinfo/cli/releases/download/ipinfo-3.3.1/ipinfo_3.3.1_linux_amd64.tar.gz
-RUN tar -xvf ipinfo_3.3.1_linux_amd64.tar.gz
-RUN mv ipinfo_3.3.1_linux_amd64 ipinfo
-RUN mv ipinfo /usr/bin
-RUN rm -rf *
-
-# Install naabu
-RUN echo "Installing naabu"
-RUN wget https://github.com/projectdiscovery/naabu/releases/download/v2.1.9/naabu_2.1.9_linux_amd64.zip
-RUN unzip naabu_2.1.9_linux_amd64.zip
-RUN mv naabu /usr/bin
-RUN rm -rf *
-
-# Install nuclei
-RUN echo "Installing nuclei"
-RUN wget https://github.com/projectdiscovery/nuclei/releases/download/v3.3.4/nuclei_3.3.4_linux_amd64.zip
-RUN unzip nuclei_3.3.4_linux_amd64.zip
-RUN mv nuclei /usr/bin
-RUN rm -rf *
-
-# Install gitleaks 
-RUN echo "Installing gitleaks"
-RUN wget https://github.com/gitleaks/gitleaks/releases/download/v8.18.1/gitleaks_8.18.1_linux_x64.tar.gz
-RUN tar -xvf gitleaks_8.18.1_linux_x64.tar.gz
-RUN mv gitleaks /usr/bin
-RUN rm -rf *
-
-# Install wafw00f
-RUN pip install wafw00f
-
-#Install gau
-RUN echo "Installing GAU"
-RUN wget https://github.com/lc/gau/releases/download/v2.2.1/gau_2.2.1_linux_amd64.tar.gz
-RUN tar -xvf gau_2.2.1_linux_amd64.tar.gz
-RUN mv gau /usr/bin
-RUN rm -rf *
-
-# Installing Corsy
-RUN echo "Installing Corsy"
-RUN wget https://github.com/s0md3v/Corsy/archive/refs/tags/1.0-rc.zip
-RUN unzip 1.0-rc.zip
-RUN mv Corsy-1.0-rc Corsy
-RUN mv Corsy /usr/bin
-RUN rm -rf *
-
-# Install Poetry
-RUN pip install poetry==1.4.2
-
-# Add Poetry to PATH
-ENV PATH="/root/.local/bin:$PATH"
-
-# Setup Poetry ENV variables
-ENV POETRY_NO_INTERACTION=1 \
-    POETRY_VIRTUALENVS_IN_PROJECT=0 \
-    POETRY_VIRTUALENVS_CREATE=0 \
-    POETRY_CACHE_DIR=/tmp/poetry_cache
-
-# Copy pyproject.toml and poetry.lock
-COPY pyproject.toml poetry.lock* /home/mantis/
+# Install external recon tools from the platform-aware manifest (single source of truth).
+COPY configs/tools.yml /home/mantis/configs/tools.yml
+COPY setup/install_tools.sh /home/mantis/setup/install_tools.sh
+RUN chmod +x /home/mantis/setup/install_tools.sh \
+    && /home/mantis/setup/install_tools.sh docker /home/mantis/configs/tools.yml
 
-# Install dependencies using Poetry
-RUN poetry install --without dev --no-root && rm -rf $POETRY_CACHE_DIR
+# Install Python dependencies
+COPY requirements.txt /home/mantis/
+RUN pip install --no-cache-dir -r /home/mantis/requirements.txt
 
 # Creating Mantis alias
 RUN echo 'export PS1="🦗 Mantis > " && \

diff --git a/configs/tools.yml b/configs/tools.yml
@@ -0,0 +1,147 @@
+# Mantis external-tool manifest — single source of truth for recon tool versions.
+#
+# Consumed by setup/install_tools.sh (used by both the Dockerfile and native-setup.sh).
+# The installer detects the host platform ({linux|darwin}/{amd64|arm64}) and resolves
+# each tool's download using the per-tool os_tokens / arch_tokens maps below, because
+# every project names its release assets differently (amd64 vs x64, linux vs macOS, etc.).
+#
+# Fields per tool:
+#   name          final command name placed in install_dir (must match how mantis invokes it)
+#   method        binary | pip | source
+#   version       tool version (also substituted into url/bin_in_archive templates)
+#   targets        which install paths include this tool: [docker, native] (default both)
+#   archive        binary only: zip | tar.gz | none
+#   url            binary only: download template; {version}/{os}/{arch} are substituted
+#   os_tokens      binary only: map host OS (linux/darwin) -> the token this project uses
+#   arch_tokens    binary only: map host arch (amd64/arm64) -> the token this project uses
+#   bin_in_archive binary only: file name inside the archive (templatable); default = name
+#   sha256         binary only: optional per-platform checksum (see checksums: below). Empty = skip verify.
+#   go_module      binary only: optional `go install` fallback used when no prebuilt asset exists
+#                  and the Go toolchain is available (mainly for unusual arches / native installs)
+#   pip_spec       pip only: pip requirement (package name or VCS URL)
+#   extracted_dir  source only: directory name inside the archive after extraction
+#   dest           source only: absolute destination path
+#   runtime_deps   informational: OS packages the tool needs at runtime (used by `mantis doctor`)
+#
+# Checksums are intentionally left empty for now (filled in later by the upgrade-PR action).
+
+install_dir: /usr/bin
+
+tools:
+  # ---- ProjectDiscovery tools (linux/darwin x amd64/arm64 prebuilt binaries) ----
+  - name: subfinder
+    method: binary
+    version: "2.14.0"
+    archive: zip
+    bin_in_archive: subfinder
+    os_tokens: { linux: linux, darwin: macOS }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/projectdiscovery/subfinder/releases/download/v{version}/subfinder_{version}_{os}_{arch}.zip"
+    go_module: "github.com/projectdiscovery/subfinder/v2/cmd/subfinder@v{version}"
+    runtime_deps: []
+
+  - name: httpx
+    method: binary
+    version: "1.10.0"
+    archive: zip
+    bin_in_archive: httpx
+    os_tokens: { linux: linux, darwin: macOS }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/projectdiscovery/httpx/releases/download/v{version}/httpx_{version}_{os}_{arch}.zip"
+    go_module: "github.com/projectdiscovery/httpx/cmd/httpx@v{version}"
+    runtime_deps: []
+
+  - name: naabu
+    method: binary
+    version: "2.6.1"
+    archive: zip
+    bin_in_archive: naabu
+    os_tokens: { linux: linux, darwin: macOS }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/projectdiscovery/naabu/releases/download/v{version}/naabu_{version}_{os}_{arch}.zip"
+    go_module: "github.com/projectdiscovery/naabu/v2/cmd/naabu@v{version}"
+    runtime_deps: [libpcap]
+
+  - name: nuclei
+    method: binary
+    version: "3.11.0"
+    archive: zip
+    bin_in_archive: nuclei
+    os_tokens: { linux: linux, darwin: macOS }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/projectdiscovery/nuclei/releases/download/v{version}/nuclei_{version}_{os}_{arch}.zip"
+    go_module: "github.com/projectdiscovery/nuclei/v3/cmd/nuclei@v{version}"
+    runtime_deps: []
+
+  # ---- gitleaks: note arch token is x64 (not amd64) ----
+  - name: gitleaks
+    method: binary
+    version: "8.30.1"
+    archive: tar.gz
+    bin_in_archive: gitleaks
+    os_tokens: { linux: linux, darwin: darwin }
+    arch_tokens: { amd64: x64, arm64: arm64 }
+    url: "https://github.com/gitleaks/gitleaks/releases/download/v{version}/gitleaks_{version}_{os}_{arch}.tar.gz"
+    go_module: "github.com/gitleaks/gitleaks/v8@v{version}"
+    runtime_deps: []
+
+  - name: gau
+    method: binary
+    version: "2.2.4"
+    archive: tar.gz
+    bin_in_archive: gau
+    os_tokens: { linux: linux, darwin: darwin }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/lc/gau/releases/download/v{version}/gau_{version}_{os}_{arch}.tar.gz"
+    go_module: "github.com/lc/gau/v2/cmd/gau@v{version}"
+    runtime_deps: []
+
+  # ---- ipinfo: extracted binary is named ipinfo_{version}_{os}_{arch} ----
+  - name: ipinfo
+    method: binary
+    version: "3.3.2"
+    archive: tar.gz
+    bin_in_archive: "ipinfo_{version}_{os}_{arch}"
+    os_tokens: { linux: linux, darwin: darwin }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/ipinfo/cli/releases/download/ipinfo-{version}/ipinfo_{version}_{os}_{arch}.tar.gz"
+    runtime_deps: []
+
+  # ---- amass: native path only (not currently shipped in the Docker image) ----
+  - name: amass
+    method: binary
+    version: "4.1.0"
+    targets: [native]
+    archive: zip
+    bin_in_archive: amass
+    os_tokens: { linux: Linux, darwin: Darwin }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/owasp-amass/amass/releases/download/v{version}/amass_{os}_{arch}.zip"
+    go_module: "github.com/owasp-amass/amass/v4/...@v{version}"
+    runtime_deps: []
+
+  # ---- Python tools (architecture-independent) ----
+  - name: findcdn
+    method: pip
+    pip_spec: "git+https://github.com/cisagov/findcdn.git"
+    runtime_deps: []
+
+  - name: wafw00f
+    method: pip
+    pip_spec: "wafw00f"
+    runtime_deps: []
+
+  - name: dnstwist
+    method: pip
+    pip_spec: "dnstwist[full]"
+    runtime_deps: []
+
+  # ---- Corsy: cloned to a directory; mantis calls python3 /usr/bin/Corsy/corsy.py ----
+  - name: Corsy
+    method: source
+    version: "1.0-rc"
+    archive: zip
+    extracted_dir: "Corsy-{version}"
+    dest: "/usr/bin/Corsy"
+    url: "https://github.com/s0md3v/Corsy/archive/refs/tags/{version}.zip"
+    runtime_deps: []
diff --git a/pyproject.toml b/pyproject.toml
@@ -37,7 +37,7 @@ typing_extensions = "4.4.0"
 validators = "0.20.0"
 tldextract = "3.4.0"
 pytz = "2022.6"
-ray = {version = "2.8.0", extras = ["default"]}
+ray = {version = "2.31.0", extras = ["default"]}
 retry = "0.9.2"
 slack-sdk = "3.21.3"
 rocketry = "2.5.1"

diff --git a/requirements.txt b/requirements.txt
@@ -8,7 +8,7 @@ typing_extensions==4.4.0
 validators==0.20.0
 tldextract==3.4.0
 pytz==2022.6
-ray[default]==2.8.0
+ray[default]==2.31.0
 retry==0.9.2
 slack-sdk==3.21.3
 rocketry==2.5.1

diff --git a/setup/docker/docker-compose.yml b/setup/docker/docker-compose.yml
@@ -2,10 +2,10 @@ services:
   mantis:
     # When testing local changes, uncomment the following commented lines and comment out "image"
     # This will build the mantis container locally instead of pulling from GHRC
-    #build:
-    #  dockerfile: Dockerfile
-    #  context: ../../
-    image: ghcr.io/phonepe/mantis:latest
+    build:
+      dockerfile: Dockerfile
+      context: ../../
+    #image: ghcr.io/phonepe/mantis:latest
     container_name: mantis
     restart: on-failure
     command: sleep infinity
@@ -29,6 +29,7 @@ services:
     environment:
       MONGO_INITDB_ROOT_DATABASE: mantis
     volumes:
+      - mongodb_data:/data/db
       - ./configs/mongo-config.js:/docker-entrypoint-initdb.d/mongo-init.sh:ro
   appsmith:
     image: index.docker.io/appsmith/appsmith-ce
@@ -55,6 +56,10 @@ services:
         ipv4_address: 10.10.0.5
     extra_hosts:
       - "mantis.db:10.10.0.3"
+volumes:
+  mongodb_data:
+    name: mantis-mongodb-data
+
 networks:
   network:
     name: mantis-network