# facebook/mariana-trench

A security focused static analysis tool for Android and Java applications.

Repository: https://github.com/facebook/mariana-trench
Canonical: https://ross.abutalabs.com/products/mariana-trench
Homepage: https://mariana-tren.ch/
Language: C++
License: MIT
License Family: permissive
Last push: 2026-08-24T20:00:33+00:00

## Health v2 (maintenance only)
Score: 77/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 35, longevity 100
- inputs: {"age_days": 2101, "days_push": 9, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1250, forks 156 (observed 2026-08-28T04:04:08.032705+00:00)

## What it is
Mariana Trench is a security-focused static analysis platform for Android and Java applications, built by Meta on the SPARTA and Redex infrastructure. It performs fast, customizable global taint analysis on Dalvik bytecode to find security vulnerabilities like remote code execution and sensitive data leaks.

## Use cases
- find security vulnerabilities in android apps
- static analysis of java code for taint flows
- detect remote code execution vulnerabilities in apk
- scan android app for sensitive data leaks before code lands
- analyze dalvik bytecode without source code
- customize sources and sinks for taint analysis

## When to choose
- you need fast taint analysis on very large Android or Java codebases
- you want to analyze APKs/Dalvik bytecode with or without source access
- you need customizable source/sink rules to find app-specific vulnerabilities
- you want to catch security issues in CI before code is merged

## When to avoid
- you need static analysis for languages other than Java/Kotlin/Android
- you want dynamic or runtime security testing rather than static analysis
- you are on Apple silicon and cannot build from source (no pip support)
- you need a GUI-driven vulnerability scanner rather than a CLI tool

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, linter
- domain: security, mobile-development, android-tools, developer-tools
- platform: cli, python, cpp
- tags: static-analysis, taint-analysis, android-security, dalvik-bytecode, java, sast, linux, macos

## Member repositories
- facebook/mariana-trench (main) score 77

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:08.032705+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T05:07:44.381687+00:00, confidence not recorded.
  - readme: https://github.com/facebook/mariana-trench (fetched 2026-08-28T04:04:08.032705+00:00, sha 3e3204af1d08)
  - homepage: https://mariana-tren.ch/ (fetched 2026-08-29T12:18:36.004989+00:00, sha f75d8ef62afe)
  - site_page: https://mariana-tren.ch/docs/overview (fetched 2026-08-29T12:18:36.014260+00:00, sha 5c684fbe071d)
  - site_page: https://mariana-tren.ch/docs/getting-started (fetched 2026-08-29T12:18:36.016168+00:00, sha 19d771667998)
- Data as of 2026-08-30T08:39:29.467469+00:00.