Skip to content
SPECIFICTION
Get listed

Cacomi

cacomi-app.com

From $0.83/mo macOS
Visit cacomi-app.com
Spec score 8.4 #2 of 21 in Mobile Application Security Testing Software

What it is

Cacomi is a macOS, self-hosted static analysis tool for developers reviewing source code and application builds. It scans source and binaries for unused code, risky logs, hardcoded secrets, insecure URLs, weak cryptography, insecure storage, TLS problems, WebView misuse, injection and taint flows. It covers native iOS and Android, Flutter, and Python backends using Django, Flask or FastAPI. Binary checks accept IPA, APP and APK files, including permissions and privacy metadata. Cacomi also identifies AI service calls, possible data exposure to AI providers, prompt handling, and embedded AI or machine-learning models in an AI BOM. Analysis runs locally; the policy says code, binaries, results and reports are processed on-device and not intentionally uploaded. Reports export as PDF, SARIF and JSON for named CI systems, with findings mapped to OWASP mobile standards or ASVS. Plans include $2.99 a month for Security, $4.99 a month for Pro, $8.99, paid once Lifetime, $9.99 a year Security, and $39.99 a year Pro.

Spec sheet

Product
Cacomi scans source code and app binaries for unused code, risky logs, hardcoded secrets, insecure URLs and other security issues.Read 7 Oct 2026 · cacomi-app.com
Intended users
The privacy policy says Cacomi is intended for developers and professional users and is not directed to children.Read 7 Oct 2026 · cacomi-app.com
Privacy
The privacy policy says source code, app binaries, scan results and reports are processed on-device and are not intentionally uploaded by the app.Read 7 Oct 2026 · cacomi-app.com
AI detection
It identifies AI service calls, possible data exposure to AI providers, prompt handling and embedded AI or ML models, and collects findings in an AI BOM.Read 7 Oct 2026 · cacomi-app.com
AI inventory
It detects AI service calls, potential data exposure to AI providers and embedded AI or ML models, and collects findings in an AI BOM inventory.Read 7 Oct 2026 · cacomi-app.com
Automation
It exports findings as SARIF and JSON for GitHub Actions, GitLab CI, Bitrise, Azure DevOps and local pipelines.Read 7 Oct 2026 · cacomi-app.com
Backend support
Python backend checks cover Django, Flask and FastAPI and map findings to OWASP ASVS.Read 7 Oct 2026 · cacomi-app.com
Binary scanning
It scans .ipa, .app and .apk files, including iOS Mach-O and Android DEX and ELF details.Read 7 Oct 2026 · cacomi-app.com
Code cleanup
Unused-code detection uses per-language parsing, three-level reference counting and a confidence score for each finding.Read 7 Oct 2026 · cacomi-app.com
Limits
Cacomi is a pre-release static analysis tool that may produce false positives or miss issues and does not replace dynamic testing, penetration testing, manual review or certification.Read 7 Oct 2026 · cacomi-app.com
Local analysis
The maker says analysis runs locally on your Mac; its privacy policy says source code, binaries, scan results and reports are processed on-device and are not intentionally uploaded by the app.Read 7 Oct 2026 · cacomi-app.com
Local safety
The feature page says analysis runs locally, archive extraction is hardened against path traversal and zip bombs, and destructive actions show a preview before confirmation.Read 7 Oct 2026 · cacomi-app.com
Mobile and backend coverage
Cacomi analyzes native iOS and Android projects, Flutter projects and Python backends.Read 7 Oct 2026 · cacomi-app.com
Privacy and purchases
The privacy policy says Apple handles payment and subscription processing for purchases through the Mac App Store, and may provide limited transaction information to validate paid access.Read 7 Oct 2026 · cacomi-app.com
Reports
Cacomi exports PDF reports with severity, confidence, evidence and remediation per finding, with secrets masked.Read 7 Oct 2026 · cacomi-app.com
Reports and CI
Cacomi exports PDF reports and findings in SARIF and JSON for pipelines including GitHub Actions, GitLab CI, Bitrise and Azure DevOps.Read 7 Oct 2026 · cacomi-app.com
Secret handling
Secret detection covers source, configuration and binary strings, and the maker says detected values remain masked.Read 7 Oct 2026 · cacomi-app.com
Security limits
Cacomi is a pre-release static analysis tool; the maker says it does not replace dynamic testing, penetration testing, manual review or official certification.Read 7 Oct 2026 · cacomi-app.com
Standards mapping
Mobile findings map to OWASP MASVS, MASTG and related standards, while Python findings map to OWASP ASVS.Read 7 Oct 2026 · cacomi-app.com
Static security
Its mobile static checks cover weak cryptography, insecure storage, cleartext or disabled TLS, WebView misuse, injection and taint flows.Read 7 Oct 2026 · cacomi-app.com
Student offer
The homepage offers students Cacomi Pro free for one year after registering with a student email.Read 7 Oct 2026 · cacomi-app.com
Support contact
The privacy policy lists [email protected] for questions about privacy practices.Read 7 Oct 2026 · cacomi-app.com
Who it is for
The maker describes Cacomi as a local scanner for developers checking code and builds during development, alongside deeper testing tools.Read 7 Oct 2026 · cacomi-app.com

Plans and prices

Cacomi Security – Monthly $2.99 a month Monthly Security plan Read 7 Oct 2026 · apps.apple.com
Cacomi Pro – Monthly $4.99 a month Monthly Pro plan Read 7 Oct 2026 · apps.apple.com
Cacomi Lifetime $8.99, paid once Lifetime purchase Read 7 Oct 2026 · apps.apple.com
Cacomi Security – Annual $9.99 a year Annual Security plan Read 7 Oct 2026 · apps.apple.com
Cacomi Pro – Annual $39.99 a year Annual Pro plan Read 7 Oct 2026 · apps.apple.com

Every Cacomi plan and price →

Strong points and limits

Strong points

  • Local, on-device analysis
  • Scans mobile binaries and Python backends
  • AI findings collected in an AI BOM
  • Exports PDF, SARIF and JSON reports
  • Detected secrets remain masked

Limits

  • Pre-release tool may miss issues
  • False positives are possible
  • No dynamic app analysis
  • Does not replace penetration testing

Who it suits

It suits developers and professional users checking code and builds during development, especially teams working on mobile apps, Flutter projects or Python backends. Students can register with a student email for Cacomi Pro free for one year.

Verdict

Cacomi combines local code, binary, mobile and backend checks with AI-specific findings and pipeline exports. It is a development-stage scanner, so deeper testing and manual review remain necessary.

Where Specifiction places it

Alternatives to CacomiAll alternatives →