Mobile Verification Toolkit

[!IMPORTANT] We recently merged the "v3" branch. This introduced breaking changes. If you relied on mvt output in other scripts They might have broken. More details: https://github.com/mvt-project/mvt/issues/757

Documentation Status CI Downloads

Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices.

It has been developed and released by the Amnesty International Security Lab in July 2021 in the context of the Pegasus Project along with a technical forensic methodology. It continues to be maintained by Amnesty International and other contributors.

Note MVT is a forensic research tool intended for technologists and investigators. It requires understanding digital forensics and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek reputable expert assistance.

Indicators of Compromise

MVT supports using public indicators of compromise (IOCs) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by Amnesty International and other research groups.

Warning Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.

Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.

Such support is available to civil society through Amnesty International's Security Lab or through our forensic partnership with Access Now’s Digital Security Helpline.

More information about using indicators of compromise with MVT is available in the documentation.

Installation

MVT can be installed from sources or from PyPI (you will need some dependencies, check the documentation):

pip3 install mvt

You can also install MVT from PyPI with uv. First, install uv:

curl -LsSf https://astral.sh/uv/install.sh | sh

Then install MVT as a command-line tool:

uv tool install mvt

For alternative installation options and known issues, please refer to the documentation as well as GitHub Issues.

Usage

MVT provides three commands: mvt-ios and mvt-android analyse acquisitions from devices of that platform, and mvt hosts what belongs to neither: version, completion, plugins and download-iocs (version and download-iocs remain available on the platform commands for now). Running mvt on its own shows the installed version, update notices and the available commands. Check out the documentation to learn how to use them!

Pass --verbose to any of the three commands, before the command name (mvt-ios --verbose check-backup ...), for debug output. The --verbose option the check-* commands accept after their name still works but is kept for compatibility only and will be removed in a future release.

Shell completion

MVT can generate a shell completion script for Bash, Zsh, and Fish which covers mvt, mvt-ios and mvt-android:

mvt completion

The command prints setup instructions by default. To generate the completion script directly, pass the shell name:

mvt completion bash

MVT only writes completion files or shell configuration when --install is passed. See the command completion documentation for details.

Plugin packages extend MVT with additional forensic modules, which run inside the check-* commands, and with top-level commands on mvt, mvt-ios and mvt-android. See the development documentation for writing and installing them, and the custom CLI command documentation for the entry points a package registers commands in.

License

The purpose of MVT is to facilitate the consensual forensic analysis of devices of those who might be targets of sophisticated mobile spyware attacks, especially members of civil society and marginalized communities. We do not want MVT to enable privacy violations of non-consenting individuals. In order to achieve this, MVT is released under its own license. Read more here.

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (2026.9.7)

4 maintainers

PyPI data
Data sourced directly from PyPI's database.
Avatar for botherder from gravatar.com botherder Avatar for DonnchaC from gravatar.com DonnchaC Avatar for rory_ai from gravatar.com rory_ai
+1 more Avatar for tekkk from gravatar.com tekkk

Credits

Author: Claudio Guarnieri

Maintainer: Etienne Maynier

Requires

Python >=3.10

Tags

security mobile forensics malware

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

mvt-2026.9.1.tar.gz (1.7 MB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

mvt-2026.9.1-py3-none-any.whl (267.7 kB view details)

Uploaded Python 3

File details

Details for the file mvt-2026.9.1.tar.gz.

File metadata

  • Download URL: mvt-2026.9.1.tar.gz
  • Upload date:
  • Size: 1.7 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/7.0.0 CPython/3.13.13

File hashes

Hashes for mvt-2026.9.1.tar.gz
Algorithm Hash digest
SHA256 8716852ad04767fdd213b660fd67888e988000ca227d57ec2da2f9e656226b2c
MD5 8795aa1eb9bb35236afbc26d04e8152f
BLAKE2b-256 d7eb4d617d384cc90224e0b7746077198d49b10031d323ce90ce56a11fd2d237

See more details on using hashes here.

File details

Details for the file mvt-2026.9.1-py3-none-any.whl.

File metadata

  • Download URL: mvt-2026.9.1-py3-none-any.whl
  • Upload date:
  • Size: 267.7 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/7.0.0 CPython/3.13.13

File hashes

Hashes for mvt-2026.9.1-py3-none-any.whl
Algorithm Hash digest
SHA256 ccf576df954d66bbc1308845233259c421bbc49f4051231cf13cfb242820fae5
MD5 c66b648228b20295987a64231e4d1f53
BLAKE2b-256 6cfa22982ef6373373d957be7fcb8962b1e5a78670cda0569876a5a68f2a9061

See more details on using hashes here.

Release history Release notifications | RSS feed

2026.9.7

2 files

This release

2026.9.1 This release

2 files

2026.7.29

2 files

Yanked

2026.6.29

2 files

Yanked reason: Incorrect calendar version number

2026.5.12

2 files

2026.4.28

2 files

2.7.0

2 files

2.6.1

2 files

2.6.0

2 files

2.5.4

2 files

2.5.3

2 files

2.5.2

2 files

2.5.1

2 files

2.5.0

2 files

2.4.5

2 files

2.4.4

2 files

2.4.3

2 files

2.4.2

2 files

2.4.1

2 files

2.4.0

2 files

2.3.0

2 files

2.2.6

2 files

2.2.5

2 files

2.2.4

2 files

2.2.3

2 files

2.2.2

2 files

2.2.1

2 files

2.2

2 files

2.1.6

2 files

2.1.5

2 files

2.1.4

2 files

2.1.3

2 files

2.1.2

2 files

2.1.1

2 files

2.1

2 files

2.0.1

2 files

2.0

2 files

1.5.5

2 files

1.5.4

2 files

1.5.3

2 files

1.5.2

2 files

1.5.1

2 files

1.4.11

2 files

1.4.10

2 files

1.4.9

2 files

1.4.8

2 files

1.4.7

2 files

1.4.6

2 files

1.4.5

2 files

1.4.4

2 files

1.4.3

2 files

1.4.2

2 files

1.4.1

2 files

1.4.0

2 files

1.2.14

2 files

1.2.13

2 files

1.2.12

2 files

1.2.11

2 files

1.2.10

2 files

1.2.9

2 files

1.2.8

2 files

1.2.7

2 files

1.2.6

2 files

1.2.5

2 files

1.2.4

2 files

1.2.3

2 files

1.2.2

2 files

1.2.1

2 files

1.2.0

2 files

1.1.1

2 files

1.1.0

2 files

1.0.17

2 files

1.0.16

2 files

1.0.15

2 files

1.0.14

2 files

1.0.13

2 files

1.0.12

2 files

1.0.11

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page