Autonomous mobile app security
Prove the bypass. Ship the fix.
Verify it holds.
An autonomous engine for mobile app-security testing. It reverse-engineers your Android build, proves a real anti-tamper bypass instead of guessing at one, synthesizes the fix, and re-verifies that the fix survives the next release — every run gated behind written authorization.
- Authorization-gated, every run
- Audit manifest — APK sha256 recorded
- Augments the human pentest
How a run works
One loop: find, prove, fix, verify
Most tools stop at a finding. The engine keeps going — it proves the bypass is real, writes the fix, and confirms the fix holds on the next build.
Find
Static recon and on-device probing locate the protected behavior and hypothesize the defense — root and debugger detection, native RASP.
Prove
It modifies the app at runtime and reverses the protection in native code until the bypass is demonstrated, not assumed.
Fix
It synthesizes the disarm, then a concrete hardening recommendation you can hand to engineering.
Verify
It re-runs to confirm the protection holds — and re-anchors on surviving strings so it re-derives on the next release.
Delivery
Run it on our rig, or inside yours
Same engine either way. Start with a managed engagement, or license it and keep the binary in your own perimeter.
Managed service
We run the engagement on our rig and deliver the proof, the fix, and a MASVS-mapped report. The fastest path to your first piece of evidence.
$ disassembly gate --engagement engagement.yaml$ disassembly run --engagement engagement.yaml› REPORT.md · manifest.json
On-prem / self-hosted license
Run the engine inside your own network. The binary never leaves your perimeter — the answer regulated teams and banks reach for.
$ pip install -e ".[dev]"$ disassembly run --engagement engagement.yaml› binary never leaves your network
What's inside
A binary-RE workflow that runs itself
Nine specialized agents, a hard authorization gate, and evidence built for how security teams actually report.
Nine agents, one operator
Recon, device prep, locate, modify, characterize, reverse, disarm, verify, report — run as a DAG with feedback loops, hands-off.
Hard authorization gate
Every device-touching stage refuses to run until a confirmed engagement is present. The scope and APK hash are recorded to an audit manifest.
Proof, then a real fix
It demonstrates the bypass, synthesizes the disarm, and recommends the hardening — and reports “assisted, not resolved” rather than faking a result.
Re-verifies every build
The reverser anchors on the protection’s surviving strings, not addresses, so it re-derives offsets and re-tests on each new release.
Bring your own brain
Judgment runs through a pluggable model layer — the Claude Code CLI by default, using your own login, no API key. The Anthropic API or a supervised manual mode are drop-in.
Evidence that maps to MASVS
Runs produce REPORT.md, a manifest, and proof scripts — scoped to OWASP MASVS-RESILIENCE so the output drops into your existing pentest evidence.
Roadmap
Mobile-first, not mobile-only
Android resilience is where the engine is deepest today. The same reverse-engineering core extends outward from there.
iOS
The same customer, the same app, the same compliance surface — the second platform on the engine.
Web & corporate pentest
Target adapters that point the reasoning loop at web and API surfaces, beyond mobile.
CI evidence & SARIF
Non-interactive runs that emit SARIF for continuous testing between the annual human pentest.
Continuous evidence between pentests.
Bring a build and written scope. We'll run an authorized engagement and show you the proof, the fix, and the re-verification.