MobSF
MobSF is an open-source framework for checking mobile apps for security issues through static and dynamic analysis.
What MobSF is
MobSF is an open-source framework for checking mobile apps for security issues through static and dynamic analysis. Static analysis examines source code and binaries before an app runs, while dynamic analysis observes an app in a controlled sandbox, including its runtime behavior, data flow, and API interactions. It also looks for suspicious code patterns, permissions, and behaviors. Supported inputs include Android, iOS, and Windows packages such as APK, XAPK, IPA, and APPX, along with zipped source code. REST APIs support connection to CI/CD and DevSecOps pipelines, with Jenkins, GitHub Actions, and GitLab CI among the named examples. Reports include severity levels, affected files or functions, and remediation suggestions, and can be exported as HTML, PDF, or JSON. The Community Edition is open source under GPL v3 and costs nothing. MobSF can be installed from GitHub or Docker, runs on Windows, Linux, or macOS, and can operate offline. Dynamic analysis is limited to rooted Android versions 4.1 through 11.0, up to API 30; obfuscation and code protection can also limit analysis depth.
Good
- Analyzes source code and binaries.
- Supports Android, iOS, and Windows packages.
- REST APIs support CI/CD integration.
- Reports include remediation suggestions and export options.
- Can operate completely offline.
Watch out
- Dynamic analysis requires rooted Android.
- Dynamic analysis supports Android only through version 11.0.
- Obfuscation can limit analysis depth.
Who it suits
MobSF suits developers and security teams who need to inspect mobile app source or binaries and connect analysis to CI/CD pipelines. Its offline operation may also suit teams that need local analysis.
Verdict
MobSF combines static checks, sandboxed runtime analysis, malware-oriented checks, and pipeline integration in a free open-source package. Its dynamic-analysis version limit and reduced depth on protected apps are important constraints to consider.
Plans and prices
From MobSF's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| MobSF Community Edition | Free | Open source · GPL v3 |
The facts
Each one read from MobSF's own pages, with the date it was checked.
What it does
- Analysis limitation
- The FAQ says obfuscated apps can be partially analyzed, but code protection techniques may limit analysis depth.checked 5 Oct 2026
- CI/CD integrations
- The site names Jenkins, GitHub Actions, and GitLab CI as integration examples.checked 5 Oct 2026
- Dynamic analysis
- Dynamic analysis runs an app in a controlled sandbox to monitor runtime behavior, data flow, and API interactions.checked 5 Oct 2026
- Dynamic analysis limit
- MobSF documentation says dynamic analysis supports rooted Android versions 4.1 through 11.0, up to API 30.checked 5 Oct 2026
- Installation
- MobSF can be installed from GitHub or with Docker and runs on Windows, Linux, or macOS.checked 5 Oct 2026
- Malware analysis
- MobSF detects suspicious code patterns, permissions, and behaviors that may compromise device or user security.checked 5 Oct 2026
- Offline use
- The FAQ states that MobSF can operate completely offline.checked 5 Oct 2026
- Privacy
- The official website privacy policy says comments collect the submitted form data, visitor IP address, and browser user agent string.checked 5 Oct 2026
- Purpose
- MobSF is an open-source framework for automated mobile application security testing and penetration testing.checked 5 Oct 2026
- Reports
- MobSF reports include severity levels, affected files or functions, and remediation suggestions, with export options for HTML, PDF, or JSON.checked 5 Oct 2026
- REST API
- MobSF provides REST APIs for integration with CI/CD or DevSecOps pipelines.checked 5 Oct 2026
- Static analysis
- Static analysis examines source code and binaries for security flaws and misconfigurations before execution.checked 5 Oct 2026
- Support
- The project README lists limited free support through its Slack channel and enterprise support with priority feature requests, live support, and onsite training.checked 5 Oct 2026
Where it runs
- Supported app formats
- MobSF supports Android, iOS, and Windows packages including APK, XAPK, IPA, and APPX, as well as zipped source code.checked 5 Oct 2026
Alternatives to MobSF
- 1
Semgrep Code
Free planOpen sourceWebAPIExtensionLinux8.3From $15 a month - 2
GitHub CodeQL
Free planWebExtensionLinuxmacOS7.5From $30 a month - 3
OpenGrep
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 4
Bandit
Free planOpen sourceExtensionLinuxmacOSSelf-hosted7.2Free plan - 5
gosec
Free planOpen sourceAPILinuxmacOSSelf-hosted7.2Free plan - 6
Skylos
Free planWebAPIExtensionLinux7.0Free plan