Skip to content

Features

Static analysis

  • Android (APK): manifest inspection (permissions, exported components, debuggable flag, network security config, backup rules) via androguard · jadx decompilation · curated semgrep rules (the app's own rules + the vendored OWASP MASTG set) · gitleaks secrets scanning · dependency inventory (third-party packages, native lib/*.so, cross-platform runtime markers).
  • iOS (IPA): bundle unpacking · Info.plist inspection · Mach-O analysis via LIEF (PIE, stack canary, ARC, FairPlay encryption, exported symbols, linked dylibs, architectures) · entitlement carving from the embedded code-signature blob · import-table scanner for insecure crypto, WebView, and anti-debug APIs.

AI Agent

  • Chat with the decompiled code through your local LLM (Ollama / LM Studio) or any BYOK provider (OpenAI, Anthropic, Gemini, DeepSeek, OpenRouter, custom).
  • Layers 1-3 (no embeddings): full findings context, code search / file-read tools, and per-scan code-graph query/path/explain tools.
  • Tool-calling with live step streaming over SSE (token stream + tool start/end frames + a full trace), bounded tool loop, editable file reads, on-demand secrets re-scan, string/resource search.
  • Opt-in web research (per-scan toggle): web_search + web_fetch through the bundled SearXNG, SSRF-guarded, with citation links back into the decompiled tree.
  • Dev-only fake LLM (MOBARK_FAKE_MODEL=1) to demo the agent with zero Ollama.

Edit & recompile (Android)

  • On-demand apktool decode → smali tree.
  • Agent can propose edits (and you can hand-edit smali) with diff review, then rebuild a resigned test APK (apksigner/zipalign).
  • amd64-only in the prebuilt images: Google's Android build-tools (zipalign/apksigner) and apktool's aapt2 exist for Linux x86_64 alone, so on arm64 hosts (Apple Silicon) the rebuild pipeline fails loudly with a clear message — the rest of the app runs natively.
  • iOS stays read-only in v1: there's no apktool/ldid equivalent, edit support is very limited, and rebuilding an IPA would require an Apple Developer account and signing certificates.

Platform parity

Android and iOS get different capabilities today: analysis covers both platforms, but everything past that is Android-first and iOS stays read-only.

Capability Android (APK) iOS (IPA)
Static analysis Full: manifest, jadx decompile, MASTG semgrep rules, secrets, dependency inventory Read-only: Info.plist, Mach-O via LIEF, entitlements, import scan
AI Agent (chat + tools) Full, including the per-scan code graph Full, minus the code graph (iOS has no source files in v1)
Edit & recompile apktool decode, smali edits, resigned test APK Not in v1: rebuilding an IPA needs an Apple Developer account + signing certificates, and edit support is very limited

Reports

  • Deterministic assembly (no model needed) with a banded risk-index score (high | warning | info severities) and per-finding explanations.
  • Per-finding suppression with live re-scoring.
  • Markdown + branded PDF export.

Dashboard

  • Overview (security gauge, severity stats, AI summary, top findings), Findings (filter/suppress/AI explain), Dependencies, Decompiler (file tree + code viewer + annotation rail), Code maps (searchable per-scan graph), Report: plus a progress dialog during scans and a searchable Provider/Model picker in the top bar.

Multi-user auth

Username/password + GitHub/Google OAuth, per-user data isolation, per-user encrypted key vault, sliding sessions. See Authentication.