MVT: Open-Source Forensics Toolkit That Detects Pegasus Spyware From the Command Line

> Project: mvt-project/mvt > Stars: 275 (as of 2026-10-08, first trending appearance in 14 days) > Language: Python > Author: Amnesty International Security Lab > License: MVT License (custom)

---

A Scenario

Imagine you are a human rights activist. One day you receive a suspicious WhatsApp message from someone claiming to have private photos of a colleague. You click the link — nothing happens.

Three months later, your contacts start receiving emails "from you" that you never wrote. Your phone is being monitored, but you don't know since when, by what software, or how much data has leaked.

In July 2021, the Pegasus Project investigation revealed that NSO Group's Pegasus spyware had infiltrated the phones of tens of thousands of activists, journalists, and lawyers worldwide via "zero-click" exploits. At the same time, Amnesty International's Security Lab released MVT (Mobile Verification Toolkit) — an open-source tool that lets investigators check whether a phone has been compromised by spyware.

What It Does

MVT is a Python CLI tool that does three things:

Forensic acquisition: Extracts backups and log files from iOS or Android devices. For iOS: iTunes backups or jailbroken filesystem extraction. For Android: ADB backups or full images from rooted devices.

IOC scanning: Scans the extracted data using Indicators of Compromise (IOCs) — sets of known spyware signatures such as file paths, domains, URLs, and process names. MVT compares your phone's data against IOC lists to find matches.

Reporting: Generates JSON-formatted scan results listing all matched IOCs and related artifacts.

Three commands: mvt-ios analyzes iOS devices, mvt-android analyzes Android devices, and mvt handles platform-agnostic operations (version, shell completion, IOC downloads).

Why It Matters

MVT's core value isn't technical complexity — the underlying principles (file comparison and log analysis) are nothing new. Its value lies in making nation-state surveillance detectable.

Before MVT, detecting a Pegasus compromise meant shipping your phone to a specialized lab, taking weeks and costing thousands of dollars. Most victims couldn't afford it. MVT compresses that process into a single command — provided you have an IOC list.

A key design decision: MVT itself contains no IOCs; it only provides the scanning framework. IOCs are published separately by Amnesty International and other research organizations, downloaded via mvt download-iocs. This separation has two benefits:

1. IOCs update over time — new spyware versions emerge and new indicators are discovered. With framework and data decoupled, updating IOCs doesn't require updating the tool. 2. IOCs are sensitive — some come from confidential investigations and cannot be made public. An open framework doesn't mean all IOCs are public.

The "False Negative" Warning

MVT's README contains a crucial warning:

> Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.

In other words, public IOCs are not enough to declare a device "clean." Scanning with public IOCs alone may miss the latest forensic traces and create a false sense of security.

This warning is central to MVT's design philosophy. It acknowledges its own limitations — public IOCs will always lag behind the newest spyware versions. Pegasus's zero-click exploits may leave no traces that public IOCs can match. MVT can tell you "what was found," but it cannot tell you "nothing was found."

This attitude is the opposite of most security tools, which tend to overstate their capabilities — "Scan complete, no threats found, your device is safe!" MVT explicitly says: "I found nothing, but that doesn't mean you're safe." That's not modesty; it's honesty.

Breaking Changes in v3

Recently in 2026, MVT merged the v3 branch, introducing breaking changes. If you have scripts that depend on MVT's output format, you may need to adapt.

Key changes in v3:

• Plugin system: MVT now supports plugin packages that extend it with additional forensic modules. Third parties can write their own analysis modules without modifying MVT's core code.
• Command structure changes: Subcommand arguments for mvt-ios and mvt-android have been adjusted; --verbose moved from after the command to before it.
• Shell completion: A new mvt completion command supports Bash/Zsh/Fish auto-completion.

The plugin system is v3's most important architectural change. It means MVT is evolving from "a tool maintained by Amnesty" into "a forensics framework" — others can build their own detection logic on top of it. This mirrors YARA's design philosophy: the core provides the framework, the community contributes the rules.

A Unique License

MVT uses a custom license, not MIT or Apache. Its core clause reads:

> The purpose of MVT is to facilitate the consensual forensic analysis of devices of those who might be targets of sophisticated mobile spyware attacks, especially members of civil society and marginalized communities. We do not want MVT to enable privacy violations of non-consenting individuals.

MVT exists to help potential spyware victims undergo consensual forensic analysis. Amnesty does not want MVT used to violate the privacy of non-consenting individuals.

This license isn't strongly enforceable legally — technically MVT is open source and anyone can use it. But it's an ethical statement: the tool exists to protect victims, not to invade privacy. Using it to monitor someone else's phone betrays its design intent.

Such "ethical licenses" are rare in the open-source community. Most licenses only care about code freedom, not use cases. MVT's license is an interesting experiment: the code is free to use, but the use case has ethical boundaries.

Why It's Trending Now

MVT returned to GitHub's trending list in October 2026, likely due to several factors:

1. v3 release: The breaking changes sparked community discussion and documentation updates, boosting GitHub activity. 2. New spyware threats: Recent disclosures of new mobile spyware may have driven renewed attention to MVT. 3. Plugin ecosystem growth: Third-party plugins are beginning to appear, expanding MVT's capabilities.

MVT isn't a new project — it has existed since 2021. But it represents a continually important direction: putting the ability to detect nation-state surveillance into ordinary people's hands. As mobile spyware grows more sophisticated, the value of this direction only increases.

One-Sentence Summary

MVT compresses five years of Amnesty International's spyware forensics experience into a single command. It cannot tell you "your phone is safe," but it can tell you "what known bad things are on your phone" — and in security, that distinction matters enormously.