Skip to content
SPECIFICTION
Get listed

MobSF

mobsf.org

Free plan WebLinuxiOSAndroidAPISelf-hosted
Visit mobsf.org
Spec score 7.8 #16 of 25 in Static Application Security Testing Software

What it is

MobSF is an open-source framework for automated mobile application security testing and penetration testing. Its static analysis examines source code and binaries for security flaws and misconfigurations before execution. Dynamic analysis runs apps in a controlled sandbox to observe runtime behavior, data flow, and API interactions, while malware analysis looks for suspicious code, permissions, and behavior. Supported inputs include Android, iOS, and Windows packages such as APK, XAPK, IPA, and APPX, plus zipped source code. REST APIs connect MobSF with CI/CD or DevSecOps pipelines; named examples include Jenkins, GitHub Actions, and GitLab CI. Reports include severity, affected files or functions, and remediation suggestions, with HTML, PDF, and JSON export options. MobSF can be installed from GitHub or with Docker, runs on Windows, Linux, or macOS, and can operate offline. The Community Edition is open source under GPL v3 and costs nothing. Dynamic analysis is limited to rooted Android versions 4.1 through 11.0, up to API 30; obfuscation and code protection can limit analysis depth.

Spec sheet

Purpose
MobSF is an open-source framework for automated mobile application security testing and penetration testing.Read 5 Oct 2026 · mobsf.org
Privacy
The official website privacy policy says comments collect the submitted form data, visitor IP address, and browser user agent string.Read 5 Oct 2026 · mobsf.org
Support
The project README lists limited free support through its Slack channel and enterprise support with priority feature requests, live support, and onsite training.Read 5 Oct 2026 · github.com
Analysis limitation
The FAQ says obfuscated apps can be partially analyzed, but code protection techniques may limit analysis depth.Read 5 Oct 2026 · mobsf.org
CI/CD integrations
The site names Jenkins, GitHub Actions, and GitLab CI as integration examples.Read 5 Oct 2026 · mobsf.org
Dynamic analysis
Dynamic analysis runs an app in a controlled sandbox to monitor runtime behavior, data flow, and API interactions.Read 5 Oct 2026 · mobsf.org
Dynamic analysis limit
MobSF documentation says dynamic analysis supports rooted Android versions 4.1 through 11.0, up to API 30.Read 5 Oct 2026 · github.com
Installation
MobSF can be installed from GitHub or with Docker and runs on Windows, Linux, or macOS.Read 5 Oct 2026 · mobsf.org
Malware analysis
MobSF detects suspicious code patterns, permissions, and behaviors that may compromise device or user security.Read 5 Oct 2026 · mobsf.org
Offline use
The FAQ states that MobSF can operate completely offline.Read 5 Oct 2026 · mobsf.org
Reports
MobSF reports include severity levels, affected files or functions, and remediation suggestions, with export options for HTML, PDF, or JSON.Read 5 Oct 2026 · mobsf.org
REST API
MobSF provides REST APIs for integration with CI/CD or DevSecOps pipelines.Read 5 Oct 2026 · mobsf.org
Static analysis
Static analysis examines source code and binaries for security flaws and misconfigurations before execution.Read 5 Oct 2026 · mobsf.org
Supported app formats
MobSF supports Android, iOS, and Windows packages including APK, XAPK, IPA, and APPX, as well as zipped source code.Read 5 Oct 2026 · mobsf.org

Plans and prices

MobSF Community Edition Free Open source · GPL v3 Read 5 Oct 2026 · mobsf.org

Every MobSF plan and price →

Strong points and limits

Strong points

  • Analyzes source code and binary packages
  • Can operate completely offline
  • Reports include remediation suggestions
  • REST APIs support CI/CD pipeline integration

Limits

  • Dynamic analysis supports rooted Android only through version 11.0
  • Obfuscation can limit analysis depth
  • Free support is limited to the Slack channel

Who it suits

MobSF may suit mobile security teams and developers who need static or sandboxed analysis and CI/CD integration. Its offline capability may also suit teams that need to analyze apps without network access.

Verdict

MobSF covers static, dynamic, and malware analysis, with reporting and pipeline integration. Check the Android version and app-protection limits if dynamic analysis is central to your workflow.

Where Specifiction places it

Alternatives to MobSFAll alternatives →