AI analysis grounded in the code graph — computed facts, not vibes · 2026-09-23T03:03:03Z
MVT (Mobile Verification Toolkit) is a command-line forensics toolkit for Android and iOS devices, distributed as two entry-point CLIs — mvt-android and mvt-ios — with subcommands like check_backup, check_androidqf, check_bugreport, check_fs, and decrypt_backup. It parses device backups, filesystem dumps, bug reports and sysdiagnose archives, then checks extracted artefacts against indicators of compromise (IOCs), commonly STIX2-formatted feeds from Amnesty International and other researchers (parse_stix2, check_url, check_app_id in src/mvt/common/indicators.py). It's built for forensic investigators and technologists examining devices for potential spyware compromise, not for general end-user self-checks.
The star bump doesn't map to a single dramatic feature launch; growth looks driven by steady, frequent shipping — five releases in under two months (v2026.7.29 through v2026.9.21), now on a weekly release cadence per the commit "Release weekly instead of monthly." Recent commits add concrete forensic capability (new SysdiagnoseInfo module, iOS build-number updates, bugreport settings parsing), which sustains visibility for a tool already tied to high-profile Pegasus Project reporting. The README's explicit mention of a recent "v3" merge with breaking changes may also be prompting renewed community attention and re-evaluation.
What changed recently, how it's actually built (from the code graph), and whether you should care. Free account — no card, no spam.