# GoMobSec

> GoMobSec is an AI-powered mobile application security testing (MAST) platform. It scans Android (APK, XAPK) and iOS (IPA) apps with more than 25 security tools — static analysis, dynamic analysis on an Android test device, malware, network and privacy checks — has AI review every finding, maps each finding to OWASP MASVS, CWE and CVSS, and produces code-level fixes and pentest-style reports (DOCX, PDF, XLSX, JSON, SARIF).

GoMobSec is a web platform at https://gomobsec.ai with a free plan (no credit card), a REST API for CI/CD, an official MCP server for AI assistants, and an app for Discord. The whole user guide is also available as plain text at https://gomobsec.ai/llms-full.txt.

## Docs

- [User guide](https://gomobsec.ai/guide): step-by-step, with screenshots — sign up, scan an APK or IPA, follow progress, read findings (severity, CVSS, MASVS, AI analysis, attack chains), download reports, projects, API keys and CI/CD, billing, Discord and MCP. Ends with an FAQ.
- [User guide, full text](https://gomobsec.ai/llms-full.txt): the same guide and FAQ as one Markdown file.
- [Scan an app](https://gomobsec.ai/guide#start-scan): the five-step scan wizard and the scan modes (Quick, Static, Dynamic, Full, Custom).
- [Read the results](https://gomobsec.ai/guide#results): severity, a finding in detail, AI analysis, attack chains and the OWASP MASVS matrix.
- [API keys and CI/CD](https://gomobsec.ai/guide#api): the public REST API at https://api.gomobsec.ai/api/v1 and a GitHub Actions workflow that gates builds and uploads SARIF.
- [MCP server](https://github.com/UsamaSarwar121/gomobsec-mcp): `uvx gomobsec-mcp` — scan local APK/IPA files and read findings from Claude, Cursor, VS Code and other MCP clients. Also on PyPI as `gomobsec-mcp`.
- [GoMobSec for Discord](https://gomobsec.ai/guide#discord): link a Discord server, start scans and get finished-scan summaries.
- [FAQ](https://gomobsec.ai/guide#faq): what GoMobSec is, scanning an APK, iOS, the free plan, scan time, standards, false positives, CI/CD, MCP, report formats, data safety.

## Product

- [Home](https://gomobsec.ai/): what GoMobSec does.
- [Pricing](https://gomobsec.ai/pricing): current plans and prices.
- [Resources](https://gomobsec.ai/resources): articles on mobile application security.

## Who it is for

- Banks, fintechs and other regulated companies that must test their mobile apps before release and show compliance evidence.
- Penetration testers and security consultancies who need a pentest-style report for a client (engagement details, scope and methodology, findings with evidence and fixes).
- Mobile development teams that want security checks on every build in CI/CD, with results in GitHub code scanning (SARIF).
- Developers who want to scan an app from their AI assistant (MCP) or their team chat (Discord).

## What it finds

- Hard-coded secrets: API keys, tokens, passwords and private keys in code, resources and bundled config files.
- Insecure data storage: sensitive data in shared preferences, databases, files, logs and backups.
- Weak cryptography: broken algorithms and modes, hard-coded or string-derived keys, insecure random numbers.
- Network security: cleartext traffic, weak TLS configuration, disabled hostname or certificate verification, missing certificate pinning.
- Platform issues: exported activities, services, receivers and providers; risky WebView settings (JavaScript, file access); debuggable and backup flags; dangerous permissions.
- Code issues: SQL injection and other injection paths in first-party code.
- Vulnerable third-party libraries: dependencies with known CVEs.
- Privacy: tracker SDKs and personal data leaving the app.
- Malware: known malware signatures, suspicious behaviours, packers and obfuscators.
- Resilience: missing root, emulator, debugger and tamper detection.

Findings in third-party library code are filtered out or marked informational, a second AI agent validates each finding, and likely false positives are suppressed.

## How it works

- Pipeline: ingestion → decompilation → static analysis → dependency CVE check → threat intelligence → dynamic analysis → network analysis → malware analysis → privacy analysis → AI reasoning → report generation.
- Decompilation and static analysis: the app is decompiled and checked by rule-based and GoMobSec's own analyzers (manifest, secrets, cryptography, signing, certificate pinning), including the OWASP MASTG test cases.
- Dependency and threat intelligence: CVE lookups for third-party libraries, and reputation checks against public threat-intelligence sources.
- Malware: signature, packer and behaviour detection, including accessibility abuse, SMS fraud, keylogging and device-admin abuse.
- Dynamic analysis (Android): the app runs on an instrumented test device, with its network traffic captured and its logs and storage inspected.
- AI: every finding gets an expert analysis (exploitability, impact, attack chains) and a code-level fix; a second agent validates the result.

## Standards and compliance

- Every finding carries an OWASP MASVS v2 control, a CWE weakness and a CVSS score; results are grouped in an OWASP MASVS compliance matrix and tied to OWASP MASTG tests.
- Compliance assessments against: OWASP MASVS, PCI DSS, HIPAA, SOC 2, GDPR, ISO/IEC 27001, the SAMA Cyber Security Framework (Saudi Central Bank) and the SBP Mobile Application Security Guidelines (State Bank of Pakistan).

## Plans

- Community — free, no credit card: 3 scans a month, Quick and Static scans, rule-based analysis, PDF and JSON reports.
- Starter — $99 a month: 50 scans a month, dynamic analysis, AI analysis, every report format.
- Professional — $499 a month: 200 scans a month, all AI providers, API access, the Discord app, team collaboration, compliance frameworks, SSO.
- Enterprise — custom pricing: private cloud deployment, dedicated security engineers, priority support.
- Prices can change; https://gomobsec.ai/pricing is authoritative.

## Facts

- Platforms: Android (APK, XAPK; split APKS/APKM via the API and integrations) and iOS (IPA), up to 250 MB.
- Scan time: a quick or static scan takes a few minutes; a full scan of a large app up to about 30 minutes.
- Reports: DOCX (pentest-style, with executive summary, scope and methodology, MASVS matrix, attack chains, findings and a remediation roadmap), PDF, XLSX, JSON, SARIF.
- Integrations: REST API (Professional and Enterprise), CI/CD (GitHub Actions, GitLab CI, Azure DevOps, Jenkins, Bitrise), MCP server, Discord app.
- Data handling: uploads encrypted at rest (AES-256-GCM), decompiled code deleted after every scan, secrets and personal data redacted before any AI call.

## Optional

- [Privacy policy](https://gomobsec.ai/privacy)
- [Discord app terms](https://gomobsec.ai/discord/terms) and [privacy policy](https://gomobsec.ai/discord/privacy)
- Contact: support@gomobsec.ai