Cacomi vs Ostorlab

Cacomi is a macOS, self-hosted static analysis tool for developers reviewing source code and application builds. It scans source and binaries for unused code, risky logs, hardcoded secrets, insecure URLs, weak cryptography, insecure storage, TLS problems, WebView misuse, injection and taint flows. It covers native iOS and Android, Flutter, and Python backends using Django, Flask or FastAPI. Binary checks accept IPA, APP and APK files, including permissions and privacy metadata. Cacomi also identifies AI service calls, possible data exposure to AI providers, prompt handling, and embedded AI or machine-learning models in an AI BOM. Analysis runs locally; the policy says code, binaries, results and reports are processed on-device and not intentionally uploaded. Reports export as PDF, SARIF and JSON for named CI systems, with findings mapped to OWASP mobile standards or ASVS. Plans include $2.99 a month for Security, $4.99 a month for Pro, $8.99, paid once Lifetime, $9.99 a year Security, and $39.99 a year Pro.

Ostorlab provides agentic penetration testing for mobile apps, web apps, APIs, and connected source code. Its agents can work through authenticated workflows involving logins, one-time codes, and multi-factor authentication. Findings include replayable proof-of-concept exploits, and testing can trace attack paths across connected apps, APIs, back ends, and repositories. Analysis combines static, dynamic, runtime, and behavioral methods with dependency and source-repository scanning. Mobile testing supports Android, iOS, and HarmonyOS; scan inputs include Android APK, XAPK, and AAB files, non-encrypted iOS IPA files, and store or TestFlight scans. Integrations include GitHub Actions, GitLab CI, Bitbucket, Jenkins, CircleCI, Azure DevOps, Jira, ServiceNow, Slack, and SAML SSO. The free Community plan includes unlimited mobile app scans, attack-surface discovery, remediation, and ticketing. AppSec Web/API costs $299 a month billed yearly; AppSec Mobile is $599 a month billed annually. Both list 20 AI Security Credits per month. Routine workspace testing continues after credits run out, but advanced AI actions need more credits.