facebook/mariana-trench

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1250 stars · 156 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Mariana Trench is a security-focused static analysis platform for Android and Java applications, built by Meta on the SPARTA and Redex infrastructure. It performs fast, customizable global taint analysis on Dalvik bytecode to find security vulnerabilities like remote code execution and sensitive data leaks.

Use cases

• find security vulnerabilities in android apps
• static analysis of java code for taint flows
• detect remote code execution vulnerabilities in apk
• scan android app for sensitive data leaks before code lands
• analyze dalvik bytecode without source code
• customize sources and sinks for taint analysis

When to choose

• you need fast taint analysis on very large Android or Java codebases
• you want to analyze APKs/Dalvik bytecode with or without source access
• you need customizable source/sink rules to find app-specific vulnerabilities
• you want to catch security issues in CI before code is merged

When to avoid

• you need static analysis for languages other than Java/Kotlin/Android
• you want dynamic or runtime security testing rather than static analysis
• you are on Apple silicon and cannot build from source (no pip support)
• you need a GUI-driven vulnerability scanner rather than a CLI tool

Facets

cli-tool · maturity active

security vulnerability-scanning linter security mobile-development android-tools developer-tools cli python cpp static-analysis taint-analysis android-security dalvik-bytecode java sast linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="facebook/mariana-trench")