Static comes first.
The static pipeline never executes the APK. Runtime analysis requires an explicit action inside an attached emulator.
Evidence-first Android triage
Understand the app.
See the evidence.
Inspect suspicious APKs, understand their risk, and follow the findings behind every score. All in one local workspace.
Local analysis
Explainable scoring
Optional AI review
Portable workspaceA clear view of
what you're dealing with.
From a suspicious permission to a critical verdict, see the evidence that connects the dots.
Inside the desktop app
Actual app captures using a harmless synthetic APK. The example score illustrates test findings; it is not an accuracy metric. About these captures
Less guesswork.
A more informed next step.
A connected investigation, from the first hash to a report you can share.
- 01
Look inside
Extract metadata, permissions, suspicious APIs, and embedded indicators without running the APK.
Static inspection - 02
Understand the risk
Review a rule-based score and the explicit reasons behind it, alongside signatures and threat mappings.
Transparent scoring - 03
Go a little deeper
Optionally use a local or hosted model to investigate extracted findings through a bounded, auditable review.
Optional AI assistance - 04
Take it forward
Keep your sample history. Export a PDF report or carry indicators into the next workflow as CSV or JSON.
Shareable findings
Designed for deliberate analysis
Confidence starts
with clear boundaries.
The score stays explainable.
Local scoring is rule-based. Optional VirusTotal corroboration is shown separately and does not change the local verdict.
Findings go to the model.
Only extracted findings are sent to AI. Raw APK bytes stay out of the model request. Template reports work without an API key.
A workspace that travels with you
Local by design.
Portable by choice.
The Windows portable app bundles Electron and the Python analysis engine. Keep the EXE and its data folder together.
History and settings beside your EXE- No separate Python or Node installation
- Your own SDK, ADB, and model locations
Build from source. A packaged GitHub release is not published yet. External tool paths may need updating on another PC.
Built on tools you can inspect.
Python / FastAPIAndroguard
YARA / APKiD
SQLite
ElectronCan I analyze an APK on this website?
This is the project showcase. To inspect APKs, run the desktop app or the FastAPI web application locally. This website does not upload or analyze files.
Does it work without an AI API key?
Yes. Static analysis, rule-based scoring, YARA scanning, ATT&CK mapping, and template reporting work without a hosted AI key. Optional model and external-service features have their own setup requirements.
Do I need an Android emulator?
Only for explicitly requested dynamic analysis. Static analysis runs without an emulator and never executes the APK on the host.
Does a low score mean an app is safe?
No. Scores and findings support analyst triage; they do not guarantee safety. Static analysis cannot observe every runtime behavior.
Where are the source and documentation?
The project repository contains the source, architecture, scoring rules, and setup guides. The redesigned desktop workspace lives on the redesign branch.
Make the next call
with better evidence.
Explore the code. Understand the rules. Start your investigation.
View source