Beetle

What it is

Beetle (github.com/f3rb123/beetle, Apache 2.0) is a self-hosted mobile app static analysis workspace run through Docker Compose. The summary covers its feature set. The page adds the deployment details, the default credentials, and how it separates deterministic analysis from AI.

How it works

Findings pass through a fixed pipeline: scan target registry, platform analyzer, intelligence engines, canonical findings, then Ownership, Confidence, Evidence Selection and Finding Fusion, then attack chains, then reports and the dashboard. Each engine adds metadata and never deletes a finding.

Two design claims bear on trust in the output:

• Ownership gating separates library and framework code from application code, so third-party SDK behavior is not reported as an app weakness.
• Data-flow findings distinguish proven flow from method-reachable co-occurrence, and severity and confidence are labeled to match.

Detection and scoring are deterministic. AI only explains findings, evidence and attack paths, and drafts remediation and executive summaries. It does not scan. Without a provider, scanning, reporting and CI/CD policy gating still work. The page lists JADX, apktool, LIEF, Semgrep and APKLeaks among the projects it builds on.

What to do

Install and start:

git clone https://github.com/f3rb123/beetle.git
cd beetle
docker compose build
docker compose up

Then open http://localhost:9005. Optional keys go in the environment or docker-compose.yml: ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, DEEPSEEK_API_KEY, VIRUSTOTAL_API_KEY. Set CORTEX_JWT_SECRET only if you want to supply your own signing secret; otherwise one is generated and persisted on first run.

Default admin credentials are beetle / beetle. Override them before first startup:

CORTEX_ADMIN_USERNAME=...
CORTEX_ADMIN_PASSWORD=...

The bootstrap only runs when no admin exists. Changing these variables on an existing install has no effect, so change the password in the app instead.

To reset to a clean state:

docker compose down -v
docker compose up

This deletes the local database, uploaded scans, reports and volumes, and recreates the default beetle / beetle admin.

Caveats

• The page states the default credentials are for local development only. The login page displays them on a fresh install.
• Scan time is given only as "seconds to a few minutes", depending on app size and host resources. No benchmark numbers are given.
• Accuracy is described as tested against known-vulnerable reference apps, but the page names none and reports no false-positive or detection figures.
• Dynamic analysis, a plugin SDK, team collaboration and an enterprise dashboard are listed as planned, not available.
• Cloud AI providers need an API key, and the page does not say what data is sent to them. Ollama is the local, fully on-premises option.