Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

MobSF review

Free#12 of 26 in SAST ToolsStatic Application Security Testing Sast

A broad open-source framework for static and dynamic mobile application security analysis.

7.9/10Editor score
Visit MobSF
MobSF7.9 Visit MobSF

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

MobSF is an open-source security research platform for teams assessing Android, iOS, and Windows applications. It combines static analysis of source code and binaries with dynamic analysis for Android and iOS, making it suitable for mobile application security teams, penetration testers, malware analysts, and privacy-focused review workflows. Source scanning covers Java, Kotlin, Android XML, Info.plist, Swift, and Objective-C. The platform also supports runtime inspection, network traffic analysis, REST API and CLI workflows, and pull request scans.

MobSF fits development and security pipelines through GitHub Actions, GitLab CI/CD, Travis CI, CircleCI, and Bitrise examples. Docker-based deployment supports self-hosted operation across web, Windows, macOS, and Linux environments, while API access supports automated workflows. Reports can be produced in JSON, SARIF, GitLab SAST, SonarQube, and HTML formats, with rule severity overrides and finding suppression for workflow control. SonarQube, SonarCloud, and Docker are also listed among its integrations. Teams seeking a security tool that spans source code, app packages, dynamic mobile analysis, and CI outputs will find the scope well aligned.

MobSF itself is available as open-source software with a free plan. OpenSecurity also publishes separate annual packages: Professional Support adds live troubleshooting, priority email or Slack support, e-learning for 5 accounts, one minor feature request, and priority bug fixes; Enterprise Support adds e-learning for 15 accounts and two major feature requests; Training includes live onsite or online training, CTF challenges, CI/CD setup assistance, e-learning for 50 accounts, and expert email consultation. Choose MobSF for broad mobile security coverage and self-hosted automation. Teams needing dynamic analysis for Windows applications, AI features, or a narrower commercial subscription model should consider alternatives.

MobSF pros and cons

  • Where it wins
    • Static analysis covers Android, iOS, Windows packages, and source code.
    • Dynamic analysis includes Android, iOS, runtime data, and network traffic.
    • REST API, CLI, Docker, reports, and CI/CD examples support automation.
  • Where it doesn't
    • Dynamic analysis is focused on Android and iOS applications.
    • No AI features are included.
    • Support and training are separate packages, not software subscription tiers.

MobSF fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update