mvt

Open source alternative to iVerify, Zimperium and Lookout

15.5K stars
MVT License 1.1
Active this week
Last commit 1 day ago

Last verified Oct 22, 2026

Analyze Android and iOS devices for signs of spyware and targeted compromise using forensic artifact extraction and public indicator scanning.

Visit website GitHub15.5K

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who mvt is for#

Digital security helplines triaging compromised devices

Organizations like Access Now's Digital Security Helpline perform device forensics for journalists, activists, and human rights workers who report suspected surveillance. MVT's structured output and IOC matching make it possible to process multiple cases with consistent, documented methodology.

Skip if:

Skip if the device owner has not given explicit consent to the forensic procedure. The MVT license requires data owner consent, and the tool is not appropriate for covert device analysis.

Security researchers investigating mobile spyware campaigns

Researchers studying new spyware campaigns can use MVT's extraction pipeline to build forensic artifact datasets from reference devices. The plugin architecture supports custom detection modules, making MVT useful as a base for novel IOC research beyond the publicly maintained set.

Skip if:

Skip if you are working on Windows. MVT runs on macOS and Linux only; a Linux VM or container is needed for Windows-based researcher workflows.

Investigative journalists verifying device integrity

Journalists covering national security or human rights who suspect surveillance can work with a digital forensics investigator to run MVT on their device. The tool provides documented, reproducible output that can be cited as forensic evidence in published investigations.

Skip if:

Skip if you are attempting self-assessment without forensics training. The README explicitly notes MVT is not suitable for end-user self-assessment, and a false-negative result carries real risk.

IT security teams auditing devices at civil society organizations

NGOs and journalism organizations can run MVT as part of periodic device security audits for staff in high-risk environments. The IOC download command (`mvt download-iocs`) keeps the indicator database current without manual maintenance.

Skip if:

Skip if your organization lacks staff with command-line forensics experience. MVT produces outputs that require forensic interpretation; acting on misread results can create false confidence.

the problem

The problem it solves#

When a journalist or human rights defender suspects their device has been compromised by targeted spyware like Pegasus, verifying that suspicion has historically required access to commercial forensics labs and tools with enterprise pricing that civil society organizations cannot match. Tools like Cellebrite UFED and Oxygen Forensic Detective are typically sold to government and law enforcement agencies, leaving security teams supporting at-risk individuals without reliable tooling.

The deeper challenge is that advanced mobile spyware leaves subtle traces distributed across dozens of artifact types: process logs, network connection records, timeline events, crash reports, and browser history. Reliable detection requires systematic extraction of all relevant artifacts and cross-referencing against known compromise indicators. Without automation, this process is too slow and error-prone for organizations handling multiple device cases simultaneously.

how mvt solves it

How it solves it#

iOS forensic acquisition and analysis

The `mvt-ios` command analyzes both iTunes backups and full filesystem acquisitions, extracting dozens of artifact types including SMS records, call history, browser history, app data, and timeline events. Results are saved to a local directory for offline review and IOC scanning.

Android device analysis over ADB

The `mvt-android` command connects to Android devices over the Android Debug Bridge to extract forensic artifacts without requiring a full device image. This covers installed apps, SMS records, and other indicators accessible over ADB, making triage feasible without root access in many scenarios.

IOC-based spyware detection

MVT supports loading public indicators of compromise from the mvt-indicators repository, maintained by Amnesty International and partner researchers. After extraction, it cross-references device artifacts against these IOCs to flag potential traces of targeting by known campaigns including Pegasus.

Plugin architecture for extended forensic modules

Plugin packages extend MVT with additional forensic modules that run inside the `check-*` commands and add top-level commands on `mvt`, `mvt-ios`, and `mvt-android`. This lets specialized teams add detection logic without modifying the core tool.

Shell completion for Bash, Zsh, and Fish

Running `mvt completion` generates a shell completion script covering all three commands. Pass the shell name directly (`mvt completion bash`) to generate the script without prompts. Completion scripts speed up investigation workflows where analysts run many sequential forensic commands.

strengths · trade-offs

Strengths and trade-offs#

Strengths

Created and maintained by Amnesty International Security LabMVT was built by the team that investigated and exposed the Pegasus spyware campaign in 2021, and continues to be maintained by that team. This institutional backing means IOC databases and forensic methodology reflect active threat intelligence from ongoing civil society investigations, not just community contributions.
Actively maintained with 13,500+ GitHub starsWith over 13,500 stars and 1,324 forks, MVT has strong adoption among forensic investigators. The repository received its most recent push on September 21, 2026, reflecting ongoing maintenance. 54 open issues indicates active community engagement with a project that is still evolving.
No cloud component, all data stays on investigator hardwareMVT has no telemetry, no cloud API calls, and no account registration. All forensic data stays on the investigator's machine. This matters when analyzing devices belonging to sources, activists, or individuals under surveillance, where data exfiltration to third-party servers would create additional risk.
Published forensic methodology, reviewed by security researchersMVT was released alongside Amnesty International's technical forensic methodology from the 2021 Pegasus investigation. The extraction and detection approach is publicly documented, which means findings produced with MVT can be cited in published investigations with traceable methodology.

Trade-offs

-Requires forensics expertise to interpret results correctlyMVT is explicitly a research tool for technologists and investigators. The README states it requires understanding digital forensics and using command-line tools, and is not intended for end-user self-assessment. The project also warns that public IOCs alone cannot confirm a device is clean: uncharacterized or new spyware variants will not appear in the public databases, and a negative result should not be treated as confirmation of no compromise.
-MVT License 1.1 is not an OSI-approved open source licenseMVT uses a custom fair-code license. You may use, modify, distribute, and deploy MVT on your own infrastructure, including for commercial internal use. Two conditions apply: the data owner whose device is analyzed must explicitly consent to the forensic procedure (Section 3.0), and distributing MVT in executable form requires making source code available. This differs from MIT or Apache licenses and matters for organizations building services on top of MVT.
-v3 branch introduced breaking changes to output formatThe recently merged v3 branch introduced breaking changes. Scripts or pipelines that consume MVT's JSON output may break after upgrading. Issue #757 documents the specific changes. Organizations relying on MVT output in downstream tooling should review the migration notes before upgrading.

versus alternatives

mvt vs alternatives#

MVT vs Cellebrite UFED

Cellebrite UFED is the dominant commercial product in mobile device forensics, used primarily by law enforcement and government agencies. MVT covers a narrower scope, focusing specifically on spyware detection for civil society, rather than full device extraction for criminal investigation.

Feature	MVT	Cellebrite UFED
License	MVT License 1.1 (fair-code)	Proprietary
Cost	Free	Enterprise licensing
Self-hosting	Yes (macOS, Linux)	No
iOS support	Yes (backups + filesystem)	Yes
Android support	Yes (ADB)	Yes
Spyware IOC matching	Yes	Limited
Available to civil society	Yes	Restricted to law enforcement

MVT is the right choice for security labs and civil society organizations that need to detect targeted spyware without law enforcement credentials or enterprise forensics budgets. Cellebrite UFED has broader extraction capabilities across device types and supports more acquisition methods, making it the appropriate tool when thoroughness and legal chain of custody requirements matter more than cost or access.

MVT vs Oxygen Forensic Detective

Oxygen Forensic Detective is a commercial mobile forensics suite used by corporate security teams and law enforcement for general-purpose device analysis across a wide range of device types.

Feature	MVT	Oxygen Forensic Detective
License	MVT License 1.1 (fair-code)	Proprietary
Cost	Free	Commercial license required
Spyware IOC detection	Yes, via public IOC databases	No dedicated IOC matching
Supported platforms	macOS, Linux	Windows
Civil society focus	Yes	No specific focus

MVT's advantage is its integration with Amnesty International's published IOC databases, enabling detection of specific named spyware campaigns. Oxygen Forensic Detective is more appropriate for corporate incident response teams that need broad device type coverage in a Windows workflow, where spyware detection is one part of a wider forensic investigation rather than the primary goal.

install · quick start

Quick start#

bash

Install MVT from PyPI using pip on any system with Python 3.

```bash
pip install mvt
```

tech stack · detected from GitHub

What it's built on#

Languages: Python

frequently asked

FAQ#

Is MVT free to use?

Yes, MVT is free to install and run on your own machine. It uses the MVT License 1.1, a fair-code license that permits use, modification, and deployment on your own infrastructure, including for commercial internal use. The key condition is that the data owner must consent to the forensic analysis (Section 3.0 of the license). There is no per-device fee or subscription.

Does MVT work on both iPhone and Android?

Yes. The mvt-ios command analyzes iOS devices via iTunes backups or full filesystem acquisitions. The mvt-android command analyzes Android devices over ADB. iOS analysis typically extracts more artifact types, particularly from full filesystem acquisitions. Both commands output results in the same format for IOC cross-referencing.

What is the MVT License 1.1?

MVT License 1.1 is a custom fair-code license written specifically for this tool. You may use, modify, distribute, and deploy MVT on your own infrastructure for any purpose, including commercial internal use. Two key restrictions apply: the data owner whose device is being analyzed must explicitly consent to the procedure and be informed of its privacy implications (Section 3.0), and distributing MVT in executable form requires making source code available.

Can MVT definitively prove a device is free from spyware?

No. The README explicitly warns that public indicators of compromise are insufficient to determine that a device is 'clean.' MVT detects traces of known spyware campaigns by matching against published IOCs, but novel or uncharacterized spyware will not appear in those databases. A negative result should not be treated as confirmation of no compromise. Organizations like Amnesty International's Security Lab and Access Now's Digital Security Helpline can provide deeper analysis using non-public indicators.

Who created and maintains MVT?

MVT was created by the Amnesty International Security Lab and released in July 2021 alongside the Pegasus Project investigation. It continues to be maintained by Amnesty International and other contributors. The GitHub repository is actively maintained, with the most recent commit in September 2026.

also worth a look

Similar open-source tools#

Pulse

InSecurity & Monitoring

Read-only Windows diagnostics with a local AI assistant.

368 GitHub stars
Licence MIT

Xray-core

Alternative toAstrill VPN

Open source proxy core with XTLS, VLESS, and REALITY protocols

42,209 GitHub stars
Licence MPL-2.0

Obtainium

InIT Management

Android app updates direct from GitHub and F-Droid

20,630 GitHub stars
Licence GPL-3.0

OpenFlux

Alternative toAstrill VPN

TCP tunneling via Yandex Docs or WebRTC transports

2,227 GitHub stars
Licence GPL-3.0

tailcat

Alternative toTailscale

Encrypted tunnels between machines, no account or IP needed

8,432 GitHub stars
Licence BSD-3-Clause

airstats

Alternative toiStat Menus

Sixteen macOS metrics in your menu bar at 0.046% CPU

458 GitHub stars
Licence MIT

by category

Open source tools in these categories#

126

12,712 GitHub stars
Licence AGPL-3.0
#Email

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

4,904 GitHub stars
Licence Apache-2.0
#AI Agents

Omnara

Alternative toClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

2,957 GitHub stars
Licence Apache-2.0
#AI Agents

Feature your project

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

MVT vs Cellebrite UFED

Feature	MVT	Cellebrite UFED
License	MVT License 1.1 (fair-code)	Proprietary
Cost	Free	Enterprise licensing
Self-hosting	Yes (macOS, Linux)	No
iOS support	Yes (backups + filesystem)	Yes
Android support	Yes (ADB)	Yes
Spyware IOC matching	Yes	Limited
Available to civil society	Yes	Restricted to law enforcement

MVT vs Oxygen Forensic Detective

Oxygen Forensic Detective is a commercial mobile forensics suite used by corporate security teams and law enforcement for general-purpose device analysis across a wide range of device types.

Feature	MVT	Oxygen Forensic Detective
License	MVT License 1.1 (fair-code)	Proprietary
Cost	Free	Commercial license required
Spyware IOC detection	Yes, via public IOC databases	No dedicated IOC matching
Supported platforms	macOS, Linux	Windows
Civil society focus	Yes	No specific focus

Who mvt is for#

Digital security helplines triaging compromised devices

Skip if:

Security researchers investigating mobile spyware campaigns

Skip if:

Investigative journalists verifying device integrity

Skip if:

IT security teams auditing devices at civil society organizations

Skip if:

The problem it solves#

How it solves it#

iOS forensic acquisition and analysis

Android device analysis over ADB

IOC-based spyware detection

Plugin architecture for extended forensic modules

Shell completion for Bash, Zsh, and Fish

Strengths and trade-offs#

Strengths

Trade-offs

mvt vs alternatives#

MVT vs Cellebrite UFED

MVT vs Oxygen Forensic Detective

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Developer Tools

IT Management

Find open source alternatives to paid software

Who mvt is for#

Digital security helplines triaging compromised devices

Skip if:

Security researchers investigating mobile spyware campaigns

Skip if:

Investigative journalists verifying device integrity

Skip if:

IT security teams auditing devices at civil society organizations

Skip if:

The problem it solves#

How it solves it#

iOS forensic acquisition and analysis

Android device analysis over ADB

IOC-based spyware detection

Plugin architecture for extended forensic modules

Shell completion for Bash, Zsh, and Fish

Strengths and trade-offs#

Strengths

Trade-offs

mvt vs alternatives#

MVT vs Cellebrite UFED

MVT vs Oxygen Forensic Detective

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Developer Tools

IT Management

Find open source alternatives to paid software