mobsfscan

What it is and what it does

mobsfscan is a command-line static analysis tool designed to scan Android and iOS source code for security vulnerabilities and insecure coding patterns. It works by applying pattern-matching rules from the MobSF (Mobile Security Framework) project, powered by semgrep and libsast engines. The tool supports multiple languages—Java, Kotlin, Swift, Objective-C, Android XML, and iOS Info.plist—making it useful for teams developing cross-platform mobile applications.

The tool outputs findings in multiple formats (JSON, SARIF, SonarQube, GitLab SAST, HTML) and integrates with CI/CD pipelines through command-line options. It can be configured to treat warnings as failures, supports multiprocessing for faster scans, and includes detailed rule metadata (CVSS scores, CWE references, OWASP-MOBILE mappings, MASVS links). The package is actively maintained, supports modern Python versions, and has no known security vulnerabilities.

Use it for:

• Scan Android Java/Kotlin codebases for insecure WebView implementations, hardcoded credentials, and certificate validation bypasses.
• Integrate into CI/CD pipelines to automatically detect mobile security issues before code merges using JSON or SARIF output formats.
• Audit iOS Swift/Objective-C projects for common security misconfigurations and insecure API usage patterns.
• Generate compliance reports in SonarQube or GitLab SAST formats for security teams and auditors.
• Enforce security standards across teams by running mobsfscan as a pre-commit or build-time check with configurable exit codes.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

mobsfscan is a static analysis tool that detects insecure code patterns in Android and iOS source code, supporting Java, Kotlin, Swift, Objective-C, and Android XML files.

Yes. mobsfscan is a mature, actively maintained security scanner with low install friction, no known vulnerabilities, and broad language support for Android and iOS development. The copyleft license (LGPLv3+) is standard for security tools and poses no barrier to internal use. Install it if you develop mobile apps and want automated pattern-based vulnerability detection integrated into your workflow.

Install

mobsfscan on PyPI

pip install mobsfscan

uv add mobsfscan

poetry add mobsfscan

Installing mobsfscan

Before you install

Low install friction with a pure Python wheel and seven runtime dependencies. Actively maintained with a recent release (4 days old) and steady repository activity; supports Python 3.10–3.14.

License in practice

Licensed under LGPLv3+, a copyleft license requiring derivative works to be distributed under the same terms; acceptable for internal security tooling but constrains commercial redistribution.

Quickstart

pip install mobsfscan
mobsfscan /path/to/android/or/ios/source
mobsfscan --json --output results.json /path/to/source

Requires Python 3.10 or later; semgrep and libsast are runtime dependencies that may require system libraries.

Verify before relying

• Whether semgrep and libsast system dependencies are automatically resolved on all platforms or require manual setup.
• Performance characteristics when scanning large codebases or the effectiveness of multiprocessing strategies (default, billiard, thread).
• Accuracy and false-positive rates compared to other mobile security static analysis tools.

Package facts

Evidence: mobsfscan-1.0.0-py3-none-any.whl

Tags

More Quality Assurance packages