Cacomi review
A Mac-based mobile SAST tool with source, binary, taint-flow, and AI analysis.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Cacomi is a self-hosted static application security testing tool for developers building mobile applications on macOS. It analyzes native iOS and Android projects, along with Flutter projects and Python backends. Source-code and binary scanning cover IPA, APP, and APK files, making it suitable for teams that want security checks during development or before release without sending analysis away from the local Mac environment.
Its strongest capability is the breadth of mobile-focused static checks. Cacomi looks for hardcoded secrets and credentials, sensitive log and debug statements, insecure storage, weak cryptography, insecure URLs, risky permissions, unused code, and other security patterns. Taint-flow analysis adds data-flow visibility, while AI and ML usage discovery produces an AI BOM inventory. Findings align with OWASP MASVS and MASTG, and reports can be exported as PDF, SARIF, or JSON for documentation and security workflows.
The platform fit is clear but narrow: macOS is the supported platform, and the deployment model is self-hosted. Cacomi focuses on static analysis rather than runtime behavior, so it does not provide dynamic testing and should not be treated as a replacement for penetration testing. The product is described as pre-release and work in progress, which matters for teams seeking a mature, broad testing suite. Choose Cacomi for local mobile source and binary analysis on a Mac, especially when taint flow, AI inventory, and standards-aligned reports matter. Choose an alternative if dynamic analysis, broader platform coverage, or a complete penetration-testing workflow is required.
Cacomi pros and cons
- Where it wins
- Scans mobile source code plus IPA, APP, and APK binaries
- Finds secrets, sensitive logs, insecure storage, and taint-flow risks
- Exports OWASP-aligned findings in PDF, SARIF, and JSON
- Where it doesn't
- Runs only on macOS
- Does not perform dynamic analysis
- Does not replace penetration testing
Cacomi fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update