MobSF vs Puma Scan
MobSF
mobsf.orgPuma Scan
pumasecurity.ioSide by side
| Figure | MobSF | Puma Scan |
|---|---|---|
| Price from | Free | $24.92/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| iOS | Yes | — |
| Android | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 5 |
| Spec score · Static Application Security Testing Software | 7.8 (#16) | 8.1 (#9) |
| Purpose | MobSF is an open-source framework for automated mobile application security testing and penetration testing. | Puma Scan is a static application security testing tool that scans C# code in Visual Studio and reports vulnerabilities as compiler warnings before code is committed. |
| Reports | MobSF reports include severity levels, affected files or functions, and remediation suggestions, with export options for HTML, PDF, or JSON. | The Server Edition can export findings in HTML, JSON, MSBuild, VSO, VSTest, and CSV formats. |
| Support | The project README lists limited free support through its Slack channel and enterprise support with priority feature requests, live support, and onsite training. | The Professional End User Edition includes email support and scheduled telephone support; the annual subscription includes product support and updates. |
Plans
Puma Scan
- CommunityFree
- End User$299 a year
- Server$4,999 a year
- Cloud CI Standard$5,999 a year
- Cloud CI Unlimited$10,999 a year
In their own words
MobSF
MobSF is an open-source framework for automated mobile application security testing and penetration testing. Its static analysis examines source code and binaries for security flaws and misconfigurations before execution. Dynamic analysis runs apps in a controlled sandbox to observe runtime behavior, data flow, and API interactions, while malware analysis looks for suspicious code, permissions, and behavior. Supported inputs include Android, iOS, and Windows packages such as APK, XAPK, IPA, and APPX, plus zipped source code. REST APIs connect MobSF with CI/CD or DevSecOps pipelines; named examples include Jenkins, GitHub Actions, and GitLab CI. Reports include severity, affected files or functions, and remediation suggestions, with HTML, PDF, and JSON export options. MobSF can be installed from GitHub or with Docker, runs on Windows, Linux, or macOS, and can operate offline. The Community Edition is open source under GPL v3 and costs nothing. Dynamic analysis is limited to rooted Android versions 4.1 through 11.0, up to API 30; obfuscation and code protection can limit analysis depth.
Puma Scan
Puma Scan is a static application security testing tool for C# code in Visual Studio. Its End User Edition scans code as developers write and reports vulnerabilities as compiler warnings before a commit. The extension supports C# in.NET Framework and.NET Core, including Web Forms and MVC; legacy website projects are unsupported. The product page says it also scans AI-generated code from GitHub Copilot, Cursor, Claude, ChatGPT, Amazon Q and Gemini Code Assist. For automated scanning, listed integrations include GitHub Actions, GitLab CI and Azure DevOps. CI editions can enforce configurable vulnerability severity thresholds and stop builds when requirements are not met. The Server Edition supports command-line scans, on-premises Azure DevOps build tasks and exports in HTML, JSON, MSBuild, VSO, VSTest and CSV formats. Community is free. End User costs $299 a year; Server is $4,999 a year, Cloud CI Standard $5,999 a year and Cloud CI Unlimited $10,999 a year. Trials last 30 days, require no credit card and do not include reporting. Community analyzers run locally and do not contact Puma Scan servers for rule updates.