---
id: mobsfscan
version: "1.0.0"
license: unclear
license_treatment: copyleft
maintenance: active
---

# mobsfscan — mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code.

License: copyleft · Maintenance: active · Downloads: 140.0K/mo

## What it is and what it does

mobsfscan is a command-line static analysis tool designed to scan Android and iOS source code for security vulnerabilities and insecure coding patterns. It works by applying pattern-matching rules from the MobSF (Mobile Security Framework) project, powered by semgrep and libsast engines. The tool supports multiple languages—Java, Kotlin, Swift, Objective-C, Android XML, and iOS Info.plist—making it useful for teams developing cross-platform mobile applications.

The tool outputs findings in multiple formats (JSON, SARIF, SonarQube, GitLab SAST, HTML) and integrates with CI/CD pipelines through command-line options. It can be configured to treat warnings as failures, supports multiprocessing for faster scans, and includes detailed rule metadata (CVSS scores, CWE references, OWASP-MOBILE mappings, MASVS links). The package is actively maintained, supports modern Python versions, and has no known security vulnerabilities.

Use it for:

- Scan Android Java/Kotlin codebases for insecure WebView implementations, hardcoded credentials, and certificate validation bypasses.
- Integrate into CI/CD pipelines to automatically detect mobile security issues before code merges using JSON or SARIF output formats.
- Audit iOS Swift/Objective-C projects for common security misconfigurations and insecure API usage patterns.
- Generate compliance reports in SonarQube or GitLab SAST formats for security teams and auditors.
- Enforce security standards across teams by running mobsfscan as a pre-commit or build-time check with configurable exit codes.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

mobsfscan is a static analysis tool that detects insecure code patterns in Android and iOS source code, supporting Java, Kotlin, Swift, Objective-C, and Android XML files.

Yes. mobsfscan is a mature, actively maintained security scanner with low install friction, no known vulnerabilities, and broad language support for Android and iOS development. The copyleft license (LGPLv3+) is standard for security tools and poses no barrier to internal use. Install it if you develop mobile apps and want automated pattern-based vulnerability detection integrated into your workflow.

## Install

pip install mobsfscan
uv add mobsfscan
poetry add mobsfscan

## Installing mobsfscan

Before you install: Low install friction with a pure Python wheel and seven runtime dependencies. Actively maintained with a recent release (4 days old) and steady repository activity; supports Python 3.10–3.14.

License in practice: Licensed under LGPLv3+, a copyleft license requiring derivative works to be distributed under the same terms; acceptable for internal security tooling but constrains commercial redistribution.

Quickstart:

pip install mobsfscan
mobsfscan /path/to/android/or/ios/source
mobsfscan --json --output results.json /path/to/source

Requires Python 3.10 or later; semgrep and libsast are runtime dependencies that may require system libraries.

Verify before relying:

- Whether semgrep and libsast system dependencies are automatically resolved on all platforms or require manual setup.
- Performance characteristics when scanning large codebases or the effectiveness of multiprocessing strategies (default, billiard, thread).
- Accuracy and false-positive rates compared to other mobile security static analysis tools.

## Package facts

- License: not declared (copyleft)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 140.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

android ios static analysis security, mobile app code vulnerability scanner, insecure code pattern detection, java kotlin swift objective-c linter, mobile security static analysis, android webview ssl certificate check, semgrep libsast pattern matching, mobile-security, static-analysis, ci-cd-integration

[View on SkillFed](https://skillfed.io/packages/mobsfscan) · [View on PyPI](https://pypi.org/project/mobsfscan/)