Analyses Android APKs using MobSF for static analysis, APKiD for packer/obfuscation detection, and Quark-Engine for behavioural malware-pattern matching, then passes the combined findings to an AI model to produce a plain-English security report — no pentesting background required.
Supports local AI models (Ollama, LM Studio) for fully offline use, and cloud AI (Claude, OpenAI, Gemini, and more) for maximum analysis quality.
Drop an APK file onto the app. Within a few minutes you get a structured report covering:
| Section | What it tells you |
|---|---|
| App context & reputation | Is this a known app? Who made it? Is its reputation trustworthy? |
| Executive summary | Plain-English risk verdict: LOW / MEDIUM / HIGH / CRITICAL |
| Top security findings | Prioritised issues — permissions, secrets, code vulnerabilities |
| Packer & obfuscation analysis | Did APKiD find packers, anti-VM, or obfuscators? Are they malware-grade? |
| Privacy concerns | What personal data can this app access or collect? |
| Network & data activity | Where does the app send data? Flagged domains, trackers |
| Geographic analysis | Which countries host the servers? Strong privacy laws or state surveillance risk? |
| Behavioural analysis | Did Quark-Engine match any known malware-family behaviour patterns? |
| Red flags | Unambiguous signs of malicious behaviour or spyware |
| Verdict & recommendations | Clear actions: Install / Avoid / Monitor / Restrict |
Reports are saved as HTML and Markdown and browsable in the app's Reports tab. Multiple analyses of the same app are grouped together so you can compare results across AI models.
TL;DR for experienced users: install Python 3.12 and Docker, run MobSF in Docker, clone this repo, double-click the launcher for your OS.
You need Python 3.10 or newer. Python 3.12 is recommended — it unlocks APKiD packer analysis.
Check if you have it:
python3 --version
If not, download from https://www.python.org/downloads/
Windows users: during installation, tick "Add Python to PATH"
The launcher will offer to install Python 3.12 via your system's package manager (Homebrew on Mac, winget on Windows, apt/dnf/pacman on Linux) if it can't find a compatible version.
MobSF runs locally in Docker — you don't need to know how Docker works, just have it installed.
Download from https://www.docker.com/products/docker-desktop and install it. Open Docker Desktop and leave it running in the background.
Windows: you may be prompted to install WSL 2 during setup — follow the on-screen instructions.
Mac / Linux:
mkdir -p ~/.mobsf
docker run -d --name mobsf -p 8000:8000 -v ~/.mobsf:/home/mobsf/.MobSF opensecurity/mobile-security-framework-mobsf:latest
Windows:
mkdir %USERPROFILE%\.mobsf
docker run -d --name mobsf -p 8000:8000 -v %USERPROFILE%\.mobsf:/home/mobsf/.MobSF opensecurity/mobile-security-framework-mobsf:latest
MobSF will download on first run (~1–2 GB) and start in the background. After 30–60 seconds, open http://localhost:8000 to confirm it's running.
Why the
-vflag? This mounts a local folder into the container so MobSF's database — including your API key and scan history — persists across restarts.
- Go to http://localhost:8000
- Click the menu icon (top-right)
- Select REST API
- Copy the API key — you'll paste it into the setup wizard
Your API key stays the same across restarts. You only need to copy it once.
After first setup, the launcher handles MobSF automatically — it starts the Docker container if it's not already running each time you launch the app.
Double-click the launcher for your operating system:
| OS | File |
|---|---|
| Mac | Start - Mac.command |
| Windows | Start - Windows.bat |
| Linux | Start - Linux.sh |
On first run, the launcher will:
- Check for Python 3.12 and offer to install it if needed
- Create an isolated Python environment and install dependencies
- Optionally install APKiD for packer analysis (Python 3.12 required)
- Install Quark-Engine for behavioural analysis and fetch its rule database (needs internet once)
- Start MobSF via Docker
- Open the app in your browser at
http://localhost:7842
Subsequent launches are fast — the setup only runs once.
Mac: first time only — right-click → Open → Open to bypass Gatekeeper. One-time step.
Linux: if double-clicking doesn't work, right-click → Properties → tick Allow executing as program.
On first visit, a 3-step wizard guides you through:
- MobSF — confirm the URL (
http://localhost:8000) and paste your API key - AI provider — choose offline (Ollama or LM Studio) or cloud
- Configure — enter your model name or API key
Settings are saved to your user data directory. After onboarding, the ⚙ icon opens a single Settings page instead — MobSF connection, AI provider, and configuration are all visible at once with one Save button, no step-by-step navigation needed for a quick change. The same page also has a Report Language field (default British English) controlling the language the AI writes reports in — type any language, not just the suggested shortcuts.
The Quick Start above needs internet for Python/Docker setup and to pull MobSF's image. For an air-gapped machine — e.g. a sandbox VM for testing a dodgy APK with no internet at all — see docs/OFFLINE.md for a pre-built bundle instead: vendored dependency wheels, a saved MobSF Docker image, and Quark-Engine's rule database, installing with zero network access. Mac and Linux are supported; Windows isn't yet (see that doc for the workaround).
| Provider | Setup | Recommended model |
|---|---|---|
| Ollama | Install from ollama.com, run ollama pull gemma4:12b |
gemma4:12b (7.6 GB) — the app's built-in default |
| LM Studio | Install from lmstudio.ai, load a model, start the server | Any GGUF model |
Ollama models by hardware tier:
| Tier | Model | Size | Why |
|---|---|---|---|
| 8–16 GB RAM | gemma4:12b |
7.6 GB, 256K context | Best hallucination rate in its class; this app's worst failure mode is a model inventing a developer or country for an app it doesn't recognise, not shallow reasoning. The app's default. |
| 16–24 GB | qwen3.5:9b |
6.6 GB, 256K context | Leaner and faster per token, slightly weaker on the knowledge/hallucination axis. |
| 24–32 GB | gemma4:26b |
18 GB, mixture-of-experts, 3.8B active parameters | The MoE design keeps it fast on unified memory despite its size. |
| 32 GB+ | qwen3.6:27b or gemma4:31b |
17 GB / 20 GB | Closest to cloud-tier judgement you can run locally. |
| 80 GB+ | gpt-oss:120b |
65 GB | Approaches frontier cloud quality, fully offline. |
Not recommended: Coder tunes like qwen2.5-coder or qwen3-coder are optimised for code completion and are weaker at hedged prose and at admitting they don't recognise an app. Sub-8B models are the ones most likely to invent developers, purposes, and countries — the exact failure mode the app's prompt design exists to prevent. gpt-oss:20b still works but is nine months old and no longer the obvious pick at 14 GB.
Local model rankings move fast — these are current as of mid-2026. Whatever you pick, check
ollama pull <model>works before relying on it for a scan.
| Provider | Where to get a key | Notes |
|---|---|---|
| Claude (recommended) | console.anthropic.com | Best analysis quality — defaults to Sonnet 5 |
| OpenAI | platform.openai.com/api-keys | GPT-5.5 and above |
| Gemini | aistudio.google.com/app/apikey | Free tier available — defaults to Gemini 2.5 Pro |
| Groq | console.groq.com | Very fast, free tier — defaults to openai/gpt-oss-120b |
| Mistral | console.mistral.ai | Strong EU-based option |
| OpenRouter | openrouter.ai/keys | One key, 100+ models |
OpenRouter model names use the
provider/modelformat — e.g.anthropic/claude-sonnet-5,meta-llama/llama-3.3-70b-instruct:free. Browse models at openrouter.ai/models.
Groq note: Groq deprecated
llama-3.3-70b-versatilein June 2026. If you configured Groq before this update and analysis suddenly stops working, switch your model toopenai/gpt-oss-120bin ⚙ Settings.
When scanning a new APK, APKiD runs in parallel with MobSF to detect:
- Packers — tools that wrap the real code to prevent analysis (common in malware)
- Obfuscators — code obscuration tools (DexGuard, Allatori, Dasho)
- Anti-VM / anti-emulator — the app detects virtual environments and may refuse to run on emulators or test devices
- Anti-debug / anti-disassembly — the app resists reverse engineering
- Compiler fingerprint — what toolchain built the app
Known malware-associated packers (Bangcle, SecNeo, Jiagu, DexProtect, iJiami, and others) automatically escalate the AI verdict to HIGH or CRITICAL.
APKiD requires Python 3.12 due to a native dependency. The launcher handles this automatically. If APKiD can't be installed, the scan continues normally without packer analysis.
Quark-Engine runs in parallel with MobSF and APKiD, matching API-call patterns against a database of ~280 community rules covering known malware-family behaviours — banking trojans, spyware, persistence/evasion techniques, and more.
Unlike APKiD's malware-packer detection, Quark's "threat level" is a mechanical score with no awareness of what an app actually is — many legitimate apps (system tools, package managers) trigger a Moderate or High threat level purely because they use APIs also common in malware. The AI is instructed to weigh each matched behaviour in context rather than trust the threat level blindly, exactly as it does for permissions and other findings.
For the same reason, the report card shows how many behaviour patterns matched rather than Quark's threat level, and a match never withholds the "Safe to use" badge on its own — what those patterns mean is a question for the report, not the badge.
Quark-Engine is pure Python — no native build tools required, unlike APKiD. Its rule database is fetched once via freshquark (needs internet for that one step), then every scan runs entirely offline against the local copy. The launcher handles installation and the initial rule fetch automatically; if it can't be installed or the rules aren't available, the scan continues normally without behavioural analysis.
Scan a new APK — drag and drop an .apk file. MobSF scans it, with APKiD and Quark-Engine running in parallel, and the combined findings are passed to the AI.
Load an existing MobSF report — export the JSON from MobSF and load it directly, skipping the scan step.
Re-analyse — the ⟳ button on any saved report re-runs AI analysis with a different model, without re-uploading the APK.
Compare versions — when an app has 2+ saved analyses, a "⇄ Compare" button appears on its group header. Pick any two runs to see what changed: permissions, trackers, domains, secrets, code issues, APKiD packer flags, and Quark-Engine threat-level changes — added/removed, no re-scanning needed. Reports saved before this feature was added show "Not available" for detailed diffs until re-run.
The app checks for new releases on startup and shows a banner when one is available. Click "How to update" in the banner for step-by-step instructions, or follow the relevant path below.
No data migration needed. Your config and reports are stored in a platform-standard location outside the app folder (see below), so they persist untouched across any update.
git pull
Then re-run the launcher. It will install any new dependencies automatically.
- Download the new release from the Releases page
- Extract anywhere and run the launcher — that's it
| Platform | Location |
|---|---|
| Mac | ~/Library/Application Support/APK-JTM/ |
| Windows | %APPDATA%\APK-JTM\ |
| Linux | ~/.local/share/apk-jtm/ |
The exact path is shown in ⚙ Settings at the bottom of the panel.
If you have an existing install with .env and reports/ in the app folder, the app migrates them automatically on first launch.
Close the terminal window that opened when you launched the app. MobSF continues running in the background — stop it from Docker Desktop or run docker stop mobsf.
"Could not connect to MobSF" — make sure Docker Desktop is running and MobSF has fully started (30–60 seconds on first launch). Check http://localhost:8000.
APKiD not working — requires Python 3.12. Run the launcher and it will offer to install it.
Quark-Engine not working / no behavioural analysis — usually means freshquark couldn't fetch its rule database (needs internet for that one-time step). Run freshquark manually, then re-launch.
Ollama model not found — run ollama pull <model-name> in a terminal before launching.
Slow first launch — dependencies install on first run (1–3 minutes). Subsequent launches are instant.
"No internet — skipping dependency updates" — expected, not an error. Once the app has been set up, it runs entirely offline; the launcher only checks for dependency updates when it can reach the package index. If this appears on a machine that has never run the app before, it will stop and say so — the first run needs a connection once, or use the offline bundle in docs/OFFLINE.md.
Mac Gatekeeper warning — right-click Start - Mac.command → Open → Open. One-time step.
Windows "Python not found" — reinstall Python from python.org with "Add Python to PATH" ticked.
See CHANGELOG.md for the full version history.
Bug reports and feature requests are welcome via the issue templates. Found a security vulnerability? See SECURITY.md instead of opening a public issue. For code contributions, see CONTRIBUTING.md.
APK-JTM is an orchestration layer — the actual security analysis is done by these open-source projects. Full credit and thanks to their authors and communities.
| Project | What it does here | Licence |
|---|---|---|
| MobSF | Static analysis engine — permissions, manifest, code, network, secrets, security score | GPL-3.0 |
| APKiD | Packer, obfuscator, and anti-VM/anti-debug detection via YARA rules | GPL v3 (dual-licensed) |
| Quark-Engine | Behavioural malware-family pattern matching | GPL-3.0 |
All three are GPL-licensed, which lines up naturally with APK-JTM's own GPL v3 licence.
| Category | Projects |
|---|---|
| Web server | FastAPI (MIT), Uvicorn (BSD-3-Clause), sse-starlette (BSD-3-Clause) |
| AI provider SDKs | Anthropic (MIT), OpenAI (Apache-2.0), Google Gen AI (Apache-2.0), Ollama (MIT) — the same OpenAI-compatible client also drives Groq, Mistral, OpenRouter, and LM Studio |
| Utilities | Requests (Apache-2.0), Rich (MIT), python-dotenv (BSD-3-Clause), Python-Markdown (BSD-3-Clause), aiofiles (Apache-2.0), python-multipart (Apache-2.0) |
See requirements.txt for the complete, version-pinned dependency list.
Copyright (C) 2026 f0dders
Licensed under the GNU General Public License v3.0. Free to use, modify, and distribute — any derivative work must also be open source under the same licence. Commercial use requires separate written permission from the author.