mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Android XML, iOS Info.plist, Swift and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.

Made with in India

Support mobsfscan

If you liked mobsfscan and find it useful, please consider donating.

e-Learning Courses & Certifications

Automated Mobile Application Security Assessment with MobSF -MAS

Android Security Tools Expert -ATX

Installation

pip install mobsfscan

Requires Python 3.10–3.14

Command Line Options

$ mobsfscan
usage: mobsfscan [-h] [--json] [--sarif] [--sonarqube] [--gitlab-sast] [--html]
                 [--type {android,ios,auto}] [-o OUTPUT] [-c CONFIG]
                 [-mp {default,billiard,thread}] [-w] [--no-fail] [-v]
                 [path ...]

positional arguments:
  path                  Path can be file(s) or directories with source code

options:
  -h, --help            show this help message and exit
  --json                set output format as JSON
  --sarif               set output format as SARIF 2.1.0
  --sonarqube           set output format as SonarQube generic issues (10.3+)
  --gitlab-sast         set output format as GitLab SAST report
  --html                set output format as HTML
  --type {android,ios,auto}
                        optional: force android or ios rules explicitly
  -o OUTPUT, --output OUTPUT
                        output filename to save the result
  -c CONFIG, --config CONFIG
                        location to .mobsf config file
  -mp {default,billiard,thread}, --multiprocessing {default,billiard,thread}
                        optional: specify multiprocessing strategy
  -w, --exit-warning    non zero exit code on warning
  --no-fail             force zero exit code, takes precedence over --exit-warning
  -v, --version         show mobsfscan version

Example Usage

$ mobsfscan tests/assets/src/
- Pattern Match ████████████████████████████████████████████████████████████ 3
- Semantic Grep ██████ 37