No. 17 of 25 ·Static Application Security Testing Software

MobSF

Web · Linux · Android · iPhone · Self-hosted · API

Freedom report

Two barsScore 5.2

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely4 of 6 device platforms
DocumentedThinly documented

MobSF is ranked #17 of 25 in static application security testing software on Freedom251. It runs on Android, API, iOS, Linux, Self-hosted, Web. There is a free plan.

MobSF plans and pricing

All plans

MobSF Community Edition Free Open source · GPL v3 mobsf.org · 5 Oct 2026

Compared on static application security testing software

Free plan: Yes
Analysis target: source and binary
CI/CD support: Yes
Deployment: self-hosted

Best MobSF alternatives

See all 20

Two bars Skylos Free tier No. 1Free6.7 Two bars Snyk Open Source Free tier No. 2$25/mo6.7 Two bars Horusec Free tier No. 3Free6.6 Two bars Puma Scan Free tier No. 4$24.92/mo6.6 Two bars Semgrep Code Free tier No. 5$30/mo6.6 Two bars Flawfinder Free tier No. 6Free6.5

The record

Purpose: MobSF is an open-source framework for automated mobile application security testing and penetration testing.
Static analysis: Static analysis examines source code and binaries for security flaws and misconfigurations before execution.
Dynamic analysis: Dynamic analysis runs an app in a controlled sandbox to monitor runtime behavior, data flow, and API interactions.
Malware analysis: MobSF detects suspicious code patterns, permissions, and behaviors that may compromise device or user security.
Supported app formats: MobSF supports Android, iOS, and Windows packages including APK, XAPK, IPA, and APPX, as well as zipped source code.
REST API: MobSF provides REST APIs for integration with CI/CD or DevSecOps pipelines.
CI/CD integrations: The site names Jenkins, GitHub Actions, and GitLab CI as integration examples.
Reports: MobSF reports include severity levels, affected files or functions, and remediation suggestions, with export options for HTML, PDF, or JSON.
Installation: MobSF can be installed from GitHub or with Docker and runs on Windows, Linux, or macOS.
Offline use: The FAQ states that MobSF can operate completely offline.
Analysis limitation: The FAQ says obfuscated apps can be partially analyzed, but code protection techniques may limit analysis depth.
Support: The project README lists limited free support through its Slack channel and enterprise support with priority feature requests, live support, and onsite training.
Dynamic analysis limit: MobSF documentation says dynamic analysis supports rooted Android versions 4.1 through 11.0, up to API 30.
Privacy: The official website privacy policy says comments collect the submitted form data, visitor IP address, and browser user agent string.
Price from: Free

Where it ranks on Freedom251

Best Static Application Security Testing Software in 2026#17 of 25

Is MobSF yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote MobSF

Sources

mobsf.org· checked 5 Oct 2026
github.com/MobSF/Mobile-Security-Framework-MobSF/b· checked 5 Oct 2026
github.com/MobSF/docs/blob/master/running_mobsf_do· checked 5 Oct 2026
mobsf.org/privacy-policy/· checked 5 Oct 2026