Freedom251 › Static Application Security Testing Sast
MobSF
What MobSF is
MobSF is a mobile application security research platform for penetration testing, malware analysis, and privacy analysis. Its Static Analyzer supports APK, IPA, APPX, and source code, while its Dynamic Analyzer works with Android and iOS applications. Dynamic analysis includes interactive instrumented testing and runtime data and network traffic analysis. MobSF can connect to DevSecOps and CI/CD pipelines through REST APIs and command-line tools, and pull request scans are supported. The project offers a Docker image and quick-start commands for running it locally, as well as a link to MobSF Static Analyzer Online. The open-source framework is licensed under GPL-3.0. Its MobSF plan costs nothing. Paid options include Professional at $2,999.99 a year, Enterprise at $6,999.99 a year, and Training at $10,999.99 a year. Those plans list support, training, or consultation services. Limited free help is available through Slack; GitHub issues are for bugs and feature requests. The repository links to a security policy, and the project describes MobSF as made in India.
Who it suits
MobSF suits teams and researchers analyzing mobile apps for security and privacy, including those integrating scans into DevSecOps or CI/CD workflows. Organizations seeking paid support, training, or consultation can consider its paid plans.
What it does well
- Static analysis supports APK, IPA, APPX, and source code
- Dynamic analysis covers Android and iOS apps
- Integrates with CI/CD through REST APIs and CLI tools
- Docker image and local quick-start commands are provided
What to know first
- Free support is limited and offered through Slack
- Professional support costs $2,999.99 a year
- Enterprise support costs $6,999.99 a year
- Training costs $10,999.99 a year
Limits
The free MobSF plan is the GPL-3.0 open-source framework at no cost, with limited Slack support for questions, help and discussions. Live troubleshooting, priority support, training and consultation services are offered in paid packages.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| MobSF | GPL-3.0 open-source framework | Free |
| Training | $ 10999.99 / year · Onsite or online live training · CTF challenges | $10,999.99 a year |
| Professional | $ 2999.99 / year · Live support and troubleshooting · priority email or Slack support · e-learning for 5 accounts · 1 minor feature request · priority bug fixes | $2,999.99 a year |
| Enterprise | $ 6999.99 / year · Live support and troubleshooting · priority email or Slack support · e-learning for 15 accounts · 2 major feature requests · priority bug fixes | $6,999.99 a year |
As github.com lists them, read 8 Oct 2026. The maker's own page has the final word.
Getting started
- Open the MobSF GitHub project website.
- Run MobSF locally using the provided Docker image or quick-start commands.
- Use MobSF Static Analyzer Online at mobsf.live.
- Connect REST APIs or CLI tools to a DevSecOps or CI/CD pipeline if needed.
- Use Slack for questions and help, or GitHub issues for bugs and feature requests.
Verdict
MobSF covers static and dynamic mobile-app analysis and offers pipeline integration. The free framework is available under GPL-3.0, while paid plans add services such as support and training.
Questions
Is MobSF free?
Yes. The MobSF plan is free and is described as a GPL-3.0 open-source framework.
What does the Dynamic Analyzer support?
It supports Android and iOS applications, including interactive instrumented testing and runtime data and network traffic analysis.
Can MobSF connect to CI/CD pipelines?
Yes. It integrates with DevSecOps and CI/CD pipelines through REST APIs and CLI tools, and pull request scans are supported.
How can I get help?
Limited free help for questions and discussions is offered through Slack. GitHub issues are for bugs and feature requests; paid packages add support services.
What are the paid package prices?
Professional costs $2,999.99 a year, Enterprise costs $6,999.99 a year, and Training costs $10,999.99 a year.
What license does MobSF use?
The GitHub repository lists MobSF under the GPL-3.0 license.
Facts from MobSF's own pages
- Android analysis
- The repository describes Android as one of the supported application platforms. · github.com, 21 Oct 2026
- API authentication
- Configuration options include a custom API key and reading the key from a mounted file such as a Docker secret. · github.com, 21 Oct 2026
- API-only mode
- Configuration documentation says MobSF can run in REST API-only mode with its web UI endpoints disabled. · github.com, 21 Oct 2026
- Commercial support
- OpenSecurity lists paid MobSF support packages with priority support, live troubleshooting, feature requests, and bug fixes. · opensecurity.in, 8 Oct 2026
- Company
- OpenSecurity describes itself as providing penetration testing, security engineering, training, and research, and lists MobSF among its tools. · opensecurity.in, 21 Oct 2026
- Company location
- OpenSecurity's homepage names Bangalore and Vancouver in its page title and describes its security services. · opensecurity.in, 21 Oct 2026
- Deployment
- The project provides a Docker image and quick-start commands for running MobSF locally. · github.com, 8 Oct 2026
- Documentation
- MobSF maintains a separate public documentation repository linked to its documentation site. · github.com, 21 Oct 2026
- Dynamic analysis
- The project provides dynamic analysis for mobile applications. · github.com, 21 Oct 2026
- Dynamic API
- The REST API includes endpoints for starting and stopping dynamic analysis and retrieving its report. · github.com, 21 Oct 2026
- Headquarters
- Bangalore, India; Vancouver, Canada · github.com, 28 Sept 2026
- Independent limitation
- A Reddit commenter said MobSF's results cover only part of mobile penetration testing and that dynamic testing still requires interacting with the app. · reddit.com, 21 Oct 2026
- Independent research
- A university research paper comparing mobile security tools discusses MobSF's detection results and notes that its severity classifications differed from another tool in some examples. · cs.uno.edu, 21 Oct 2026
- Independent research finding
- A research paper comparing MobSF with another analyzer reported that some findings were assigned different severity categories by the two tools. · people.cs.vt.edu, 21 Oct 2026
- Independent user discussion
- A Reddit commenter said MobSF and Burp were tools they would use for mobile security testing. · reddit.com, 21 Oct 2026
- Integrations
- MobSF integrates with DevSecOps and CI/CD pipelines through REST APIs and CLI tools. · github.com, 8 Oct 2026
- iOS analysis
- The repository describes iOS as one of the supported application platforms. · github.com, 21 Oct 2026
- Licence
- The MobSF repository identifies its licence as GPL-3.0. · github.com, 21 Oct 2026
- License
- The GitHub repository lists the project under the GPL-3.0 license. · github.com, 8 Oct 2026
- Limit: app-store ratings
- The opened project repository describes a mobile app analysis framework and does not list a MobSF consumer app-store rating. · github.com, 21 Oct 2026
- Limit: dynamic analysis device support
- The Docker guide says dynamic analysis supports rooted Android versions 4.1 through 11.0, up to API 30. · github.com, 21 Oct 2026
- Limit: review-site ratings
- The opened G2 and Capterra search results did not provide a MobSF rating or review count. · g2.com, 21 Oct 2026
- Maker location
- The project describes MobSF as made in India, and OpenSecurity lists offices in Bangalore, India and Vancouver, Canada. · opensecurity.in, 8 Oct 2026
- Online access
- The project links to MobSF Static Analyzer Online at mobsf.live. · github.com, 8 Oct 2026
Where MobSF stands on Freedom251
- Static Application Security Testing Sast#2 of 24
- SAST Tools#3 of 26