suwasto/mobark repository overview

⁠MobARK

Self-hosted mobile application security testing — static analysis + AI agent for Android & iOS.

MobARK decompiles an APK or IPA, runs static analysis (jadx / apktool / Semgrep / Gitleaks / LIEF), scores findings with a plain severity-based risk index (high | warning | info), and gives you an AI agent that can chat with the decompiled code — all through your own local LLM (Ollama / LM Studio), with nothing leaving your infrastructure by default.

Source: github.com/suwasto/MobARK⁠ · Docs: suwasto.github.io/MobARK⁠ · License: Apache-2.0

⁠Supported tags

• suwasto/mobark:0.1.0
• suwasto/mobark:latest

Platform note: images in v0.1.0 are linux/amd64 only — the analysis toolchain (jadx/apktool/Semgrep etc.) is x86_64-only. See RELEASING.md⁠ before running on an arm64 host.

⁠Quick start

⁠Full stack (recommended — this is what actually runs analysis)

Scan uploads are RQ jobs that need Redis and a worker process, so pulling just the app image alone won't run real scans. Use Docker Compose to bring up the whole stack (app + worker + Redis + SearXNG):

curl -O https://raw.githubusercontent.com/suwasto/MobARK/main/docker-compose.yml
curl -O https://raw.githubusercontent.com/suwasto/MobARK/main/.env.example
mv .env.example .env

docker compose pull   # suwasto/mobark:0.1.0 + redis + searxng
docker compose up

Open http://localhost:8000⁠.

To pin a specific release instead of the default, set MOBARK_IMAGE_TAG=<version> in .env.

⁠First run

Auth is on by default — a fresh install lands on the register/login screen. There are no seeded accounts: the first account you register becomes the instance admin, and every account after that is a regular user who only sees their own scans. The first account also claims any unowned scans (e.g. data scanned while auth was off, or via the CLI without --user).

To skip auth entirely for local dev/CI, set MOBARK_AUTH_ENABLED=0 in .env.

⁠Configuration

Full configuration reference: Quickstart docs⁠

Volumes: mobark-data:/data — keeps the SQLite database and uploads across container recreates. Drop -v for a throwaway run.

Ports: 8000 (HTTP)

⁠What's inside

• Static analysis — Android (manifest, jadx decompile, curated + vendored OWASP MASTG Semgrep rules, secrets scanning, dependency inventory) and iOS (Mach-O via LIEF, entitlements, Info.plist, insecure-import scanning)
• AI agent — chat with the decompiled code: findings context, code search/read tools, and per-scan code-graph tools, with live step/token streaming and opt-in web research via a bundled SearXNG instance
• Edit & recompile (Android) — apktool decode, Smali edits, resigned test APK builds. iOS stays read-only (rebuilding an IPA needs an Apple Developer account and signing certs, so edit support there is intentionally limited)
• Reports — deterministic Markdown/PDF output with banded risk-index scoring, per-finding suppression, and AI (or no-model) explanations
• Multi-user auth — username/password + GitHub/Google OAuth, per-user data isolation, encrypted per-user key vault
• Self-hosted — app, worker, Redis, and the bundled search engine all run under docker compose on infrastructure you control

⁠Architecture

One Compose stack: a FastAPI backend, an RQ worker, Redis (job queue), and a bundled SearXNG instance, sharing a SQLite database and a data directory. The React SPA is served from the same FastAPI origin.

• Auth is the outer gate — every /api/v1 route except health and auth sits behind a session cookie, with per-user isolation resolved structurally from the request context
• Long-running work (scan analysis, apktool decode, code-graph builds, rebuilds) runs as RQ jobs shared between the API and the worker over Redis
• The agent is tool-using chat: findings context + file tools + graph tools + edit/recompile tools, streamed over SSE

Full module map and component diagram: ARCHITECTURE.md⁠

⁠License

Apache-2.0. GPL/LGPL tools in the stack (Semgrep, SearXNG) run subprocess-only or as separate containers — every directly imported library is permissive. Full dependency license audit: site licenses page⁠.

⁠Links

• 🐙 Source: github.com/suwasto/MobARK⁠
• 📖 Docs: suwasto.github.io/MobARK⁠
• 🐛 Issues: github.com/suwasto/MobARK/issues⁠
• 📋 Changelog: CHANGELOG.md⁠