Skip to content
SPECIFICTION
Get listed

MobSF

github.com

From $250/mo Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit github.com
Spec score 8.9 #1 of 24 in Static Application Security Testing Sast

What it is

MobSF is a mobile application security research platform for penetration testing, malware analysis and privacy analysis. Its Static Analyzer supports APK, IPA, APPX and source code; the Dynamic Analyzer works with Android and iOS applications and includes interactive instrumented testing, runtime data analysis and network traffic analysis. REST APIs and CLI tools connect MobSF to DevSecOps and CI/CD pipelines, and pull request scans are supported. The project provides a Docker image and quick-start commands for local use, and links to MobSF Static Analyzer Online. The framework is open source under GPL-3.0, with a free MobSF plan at free. Paid options are Professional at $2,999.99 a year, Enterprise at $6,999.99 a year, and Training at $10,999.99 a year. They list support, training or consultation services. Limited free help is available through Slack; GitHub issues are for bug reports and feature requests. The project links to a security policy and describes MobSF as made in India.

Spec sheet

Purpose
MobSF is a mobile application security research platform for penetration testing, malware analysis, and privacy analysis.Read 8 Oct 2026 · github.com
Product
MobSF is an automated framework for security assessment, penetration testing, malware analysis, and static and dynamic analysis of Android, iOS, and Windows mobile apps.Read 21 Oct 2026 · github.com
Deployment
The project provides a Docker image and quick-start commands for running MobSF locally.Read 8 Oct 2026 · github.com
Integrations
MobSF integrates with DevSecOps and CI/CD pipelines through REST APIs and CLI tools.Read 8 Oct 2026 · github.com
Support
Free limited support for questions, help, and discussions is offered through the Slack channel.Read 8 Oct 2026 · github.com
License
The GitHub repository lists the project under the GPL-3.0 license.Read 8 Oct 2026 · github.com
Headquarters
Bangalore, India; Vancouver, CanadaRead 28 Sep 2026 · github.com
Company
OpenSecurity describes itself as providing penetration testing, security engineering, training, and research, and lists MobSF among its tools.Read 21 Oct 2026 · opensecurity.in
Android analysis
The repository describes Android as one of the supported application platforms.Read 21 Oct 2026 · github.com
API authentication
Configuration options include a custom API key and reading the key from a mounted file such as a Docker secret.Read 21 Oct 2026 · github.com
API-only mode
Configuration documentation says MobSF can run in REST API-only mode with its web UI endpoints disabled.Read 21 Oct 2026 · github.com
Commercial support
OpenSecurity lists paid MobSF support packages with priority support, live troubleshooting, feature requests, and bug fixes.Read 8 Oct 2026 · opensecurity.in
Company location
OpenSecurity's homepage names Bangalore and Vancouver in its page title and describes its security services.Read 21 Oct 2026 · opensecurity.in
Documentation
MobSF maintains a separate public documentation repository linked to its documentation site.Read 21 Oct 2026 · github.com
Dynamic analysis
The project provides dynamic analysis for mobile applications.Read 21 Oct 2026 · github.com
Dynamic API
The REST API includes endpoints for starting and stopping dynamic analysis and retrieving its report.Read 21 Oct 2026 · github.com
Independent limitation
A Reddit commenter described having trouble connecting some Android virtual devices to a Dockerized MobSF setup.Read 21 Oct 2026 · reddit.com
Independent research
A university research paper comparing mobile security tools discusses MobSF's detection results and notes that its severity classifications differed from another tool in some examples.Read 21 Oct 2026 · cs.uno.edu
Independent research finding
A research paper comparing MobSF with another analyzer reported that some findings were assigned different severity categories by the two tools.Read 21 Oct 2026 · people.cs.vt.edu
Independent user discussion
A Reddit commenter said MobSF and Burp were tools they would use for mobile security testing.Read 21 Oct 2026 · reddit.com
iOS analysis
The repository describes iOS as one of the supported application platforms.Read 21 Oct 2026 · github.com
Licence
The MobSF repository identifies its licence as GPL-3.0.Read 21 Oct 2026 · github.com
Limit: app-store ratings
The opened project repository describes a mobile app analysis framework and does not list a MobSF consumer app-store rating.Read 21 Oct 2026 · github.com
Limit: dynamic analysis device support
The Docker guide says dynamic analysis supports rooted Android versions 4.1 through 11.0, up to API 30.Read 21 Oct 2026 · github.com
Limit: review-site ratings
The opened G2 and Capterra search results did not provide a MobSF rating or review count.Read 21 Oct 2026 · g2.com
Maker location
The project describes MobSF as made in India, and OpenSecurity lists offices in Bangalore, India and Vancouver, Canada.Read 8 Oct 2026 · opensecurity.in
Online access
The project links to MobSF Static Analyzer Online at mobsf.live.Read 8 Oct 2026 · github.com
Plan terms
OpenSecurity states that its listed rates are in USD, include taxes, and exclude withholding taxes and transaction fees.Read 21 Oct 2026 · opensecurity.in
Release
The repository's release page lists version 4.5.3 as the latest release in the page opened for this research.Read 21 Oct 2026 · github.com
REST API
MobSF exposes REST endpoints for uploading and scanning files, retrieving reports, comparing scans, and managing suppressions.Read 21 Oct 2026 · github.com
Security fixes
Version 4.5.3 release notes describe fixes for CSRF, SSRF, path traversal, and ZIP decompression denial-of-service issues.Read 21 Oct 2026 · github.com
Security policy
The project asks users to report vulnerabilities through its coordinated disclosure process and recommends keeping MobSF updated.Read 21 Oct 2026 · github.com
Security reporting
The repository links to a security policy.Read 8 Oct 2026 · github.com
Self-hosting
The project provides its source repository and Docker setup documentation for running MobSF in a user's environment.Read 21 Oct 2026 · github.com
Static analysis
The project provides static analysis for mobile application artifacts.Read 21 Oct 2026 · github.com
Support channels
GitHub issues are for bugs and feature requests; the project directs support and help queries to Slack.Read 8 Oct 2026 · github.com
Training plan
The paid training package includes live MobSF training and capture-the-flag challenges.Read 21 Oct 2026 · opensecurity.in
Windows analysis
The repository describes Windows mobile apps as a supported analysis target.Read 21 Oct 2026 · github.com

Plans and prices

MobSF Free GPL-3.0 open-source framework Read 8 Oct 2026 · github.com
Professional $2,999.99 a year $ 2999.99 / year Live support and troubleshooting · priority email or Slack support · e-learning for 5 accounts · 1 minor feature request · priority bug fixes Read 21 Oct 2026 · opensecurity.in
Enterprise $6,999.99 a year $ 6999.99 / year Live support and troubleshooting · priority email or Slack support · e-learning for 15 accounts · 2 major feature requests · priority bug fixes Read 21 Oct 2026 · opensecurity.in
Training $10,999.99 a year $ 10999.99 / year Onsite or online live training · CTF challenges Read 21 Oct 2026 · opensecurity.in

Every MobSF plan and price →

Strong points and limits

Strong points

  • Static analysis supports APK, IPA, APPX and source code.
  • Dynamic analysis supports Android and iOS apps.
  • REST APIs and CLI tools support CI/CD integration.
  • Docker image and quick-start commands support local deployment.

Limits

  • Free support is limited to Slack discussions.
  • Paid support plans start at $2,999.99 a year.
  • GitHub issues are for bugs and feature requests, not help.

Who it suits

MobSF suits teams and individuals analyzing mobile apps for security and privacy, including those integrating scans into CI/CD workflows. Its local deployment options also suit users who want to run the framework themselves.

MobSF in depth

Read the full write-up

Overview

MobSF is a mobile-app security research framework for penetration testing, malware analysis and privacy analysis. It is best suited to researchers and development teams assessing Android or iOS apps, particularly when they want analysis in their own workflow.

Key features

The Static Analyzer accepts APK, IPA and APPX binaries as well as source code, so teams can examine more than one stage of a mobile app’s lifecycle. The Dynamic Analyzer covers Android and iOS applications, with interactive instrumented testing and runtime data and network traffic analysis. Together, those capabilities suit investigations where both app artifacts and runtime behavior matter; MobSF is less appropriate when the primary need is a broad, general-purpose code security platform.

REST APIs and CLI tools connect MobSF to DevSecOps and CI/CD pipelines, including pull request scans. A Docker image and quick-start commands provide a local deployment route, while the project also links to MobSF Static Analyzer Online at mobsf.live. The repository is licensed under GPL-3.0 and links to a security policy.

Support has a clear division: Slack handles questions, help and discussion, while GitHub issues are for bugs and feature requests. Slack support is limited. OpenSecurity’s paid packages add priority support, live troubleshooting, feature requests and bug fixes, which matters for teams that cannot rely on community assistance.

Pricing

MobSF costs nothing and provides the GPL-3.0 open-source framework. It is the natural choice for individuals and teams able to operate the tool and manage support themselves; limited Slack help is the main concession.

Professional costs $2,999.99 a year, billed $ 2999.99 / year. It includes live support and troubleshooting, priority support by email or Slack, an e-learning course for 5 accounts, 1 minor feature request and priority bug fixes. This is the support tier for a team needing escalation and a modest customization allowance.

Enterprise costs $6,999.99 a year, billed $ 6999.99 / year. It raises the course allocation to 15 accounts and includes 2 major feature requests, alongside live troubleshooting, priority email or Slack support and priority bug fixes. Larger teams with more substantial change requests have a stronger reason to pay the premium.

Training costs $10,999.99 a year, billed $ 10999.99 / year. It includes onsite or online live training, CTF challenges, CI/CD setup assistance, an e-learning course for 50 accounts and expert email consultation. Choose it for structured team enablement and pipeline setup, not simply for priority support.

Platforms

MobSF supports API, Linux, macOS, self-hosted, web and Windows environments. The local Docker option and quick-start commands give self-hosting a practical route, while the online Static Analyzer offers a web-based alternative for static analysis.

Who it's for

MobSF is a good fit for mobile security researchers and teams that need to assess source code or binaries, inspect runtime behavior, and connect scans to development pipelines. It is less compelling for organizations seeking a managed support experience without purchasing a commercial package, or teams whose security needs extend beyond mobile apps.

Pros and cons

Pros: Static analysis spans common mobile binaries and source code, while dynamic analysis covers Android and iOS runtime behavior.

Pros: REST APIs, CLI tools and pull request scans support use within CI/CD workflows.

Pros: The free GPL-3.0 framework can be run locally, and an online static analyzer is also linked.

Cons: Free support is limited to Slack; teams requiring priority help, troubleshooting or fixes must consider paid packages.

Cons: The focus is mobile application security, so it is not a substitute for a broader code-security workflow.

Alternatives

For a wider set of static-analysis options, browse SAST Tools. Consider Semgrep Code if its free tier’s repository and contributor allowances fit your code-analysis needs. Snyk Open Source is a better fit when the priority is software-composition analysis, with a free plan covering five projects. Choose Veracode DAST when web applications and APIs, rather than mobile apps, are the focus and a live demo is useful.

Kiuwan Code Security is another paid alternative, with a Professional plan priced at $49 a year and a 10-user minimum. CodeSonar, Fluid Attacks, NaiveSystems Analyze and PVS-Studio are also options to compare.

Verdict

Choose MobSF if mobile-app security analysis is the core requirement and you want static and dynamic coverage with a route into CI/CD, especially if you can run the framework without dedicated support. Look elsewhere if you need a broader security platform or dependable priority assistance without paying for a support package.

Verdict

MobSF covers static and dynamic mobile-app analysis and can connect to development pipelines. The free framework and paid support options are distinct, so check which support level is needed.

Where Specifiction places it

Alternatives to MobSFAll alternatives →