- Home
- SAST Tools
- MobSF
MobSF
Bangalore, India; Vancouver, Canada
What it is
MobSF is a mobile application security research platform for penetration testing, malware analysis, and privacy analysis. Its Static Analyzer supports APK, IPA, APPX, and source code, while its Dynamic Analyzer works with Android and iOS applications. Dynamic analysis includes interactive instrumented testing and runtime data and network traffic analysis. MobSF connects to DevSecOps and CI/CD pipelines through REST APIs and command-line tools, and pull request scans are supported. The project provides a Docker image and quick-start commands for local deployment and links to MobSF Static Analyzer Online. The framework is open source under GPL-3.0. The MobSF plan is free. Paid options include Professional at $2,999.99 a year, Enterprise at $6,999.99 a year, and Training at $10,999.99 a year; these plans list support, training, or consultation services. Limited free help is available through Slack, while GitHub issues are for bugs and feature requests. The project links to a security policy and describes MobSF as made in India.
For and against
For
- Static analysis supports APK, IPA, APPX, and source code.
- Dynamic analysis supports Android and iOS applications.
- Integrates with CI/CD through REST APIs and CLI tools.
- Local deployment options include a Docker image.
- The framework is open source under GPL-3.0.
Against
- Free support is limited.
- Professional costs $2,999.99 a year.
- Enterprise costs $6,999.99 a year.
- Training costs $10,999.99 a year.
The verdict
MobSF combines static and dynamic analysis with integration options for development pipelines. The framework is free, while its paid plans list support, training, or consultation at the stated annual prices.
Who it suits
MobSF suits developers and security teams assessing mobile applications, binaries, or source code. Its API and CLI integrations may suit teams incorporating analysis into DevSecOps or CI/CD workflows.
Plans and prices
Professional
Live support and troubleshooting · priority email or Slack support · e-learning for 5 accounts · 1 minor feature request
Read 21 Oct 2026 · opensecurity.in
Enterprise
Live support and troubleshooting · priority email or Slack support · e-learning for 15 accounts · 2 major feature requests
Read 21 Oct 2026 · opensecurity.in
Training
Onsite or online live training · CTF challenges
Read 21 Oct 2026 · opensecurity.in
MobSF
GPL-3.0 open-source framework
Read 8 Oct 2026 · github.com
On the record
- Android analysis
- The repository describes Android as one of the supported application platforms.github.com · read 21 Oct 2026
- API authentication
- Configuration options include a custom API key and reading the key from a mounted file such as a Docker secret.github.com · read 21 Oct 2026
- API-only mode
- Configuration documentation says MobSF can run in REST API-only mode with its web UI endpoints disabled.github.com · read 21 Oct 2026
- Commercial support
- OpenSecurity lists paid MobSF support packages with priority support, live troubleshooting, feature requests, and bug fixes.opensecurity.in · read 8 Oct 2026
- Company
- OpenSecurity describes itself as providing penetration testing, security engineering, training, and research, and lists MobSF among its tools.opensecurity.in · read 21 Oct 2026
- Company location
- OpenSecurity's homepage names Bangalore and Vancouver in its page title and describes its security services.opensecurity.in · read 21 Oct 2026
- Deployment
- The project provides a Docker image and quick-start commands for running MobSF locally.github.com · read 8 Oct 2026
- Documentation
- MobSF maintains a separate public documentation repository linked to its documentation site.github.com · read 21 Oct 2026
- Dynamic analysis
- The project provides dynamic analysis for mobile applications.github.com · read 21 Oct 2026
- Dynamic API
- The REST API includes endpoints for starting and stopping dynamic analysis and retrieving its report.github.com · read 21 Oct 2026
- Independent limitation
- A Reddit commenter described having trouble connecting some Android virtual devices to a Dockerized MobSF setup.reddit.com · read 21 Oct 2026
- Independent research
- A university research paper comparing mobile security tools discusses MobSF's detection results and notes that its severity classifications differed from another tool in some examples.cs.uno.edu · read 21 Oct 2026
- Independent research finding
- A research paper comparing MobSF with another analyzer reported that some findings were assigned different severity categories by the two tools.people.cs.vt.edu · read 21 Oct 2026
- Independent user discussion
- A Reddit commenter said MobSF and Burp were tools they would use for mobile security testing.reddit.com · read 21 Oct 2026
- Integrations
- MobSF integrates with DevSecOps and CI/CD pipelines through REST APIs and CLI tools.github.com · read 8 Oct 2026
- iOS analysis
- The repository describes iOS as one of the supported application platforms.github.com · read 21 Oct 2026
- Licence
- The MobSF repository identifies its licence as GPL-3.0.github.com · read 21 Oct 2026
- License
- The GitHub repository lists the project under the GPL-3.0 license.github.com · read 8 Oct 2026
