Mobile Verification Toolkit (MVT) is a command-line forensics toolkit that gathers traces from iOS and Android devices and checks them for signs of spyware infection. It was developed and released by the Amnesty International Security Lab in July 2021, in the context of the Pegasus Project, alongside the lab's published technical forensic methodology for detecting NSO Group's Pegasus spyware, and it is still maintained by Amnesty International and outside contributors. The audience is stated plainly by the project itself: technologists and investigators who already understand digital forensics and are comfortable working from a terminal. It is not a consumer antivirus app.
What it does
MVT is a collection of utilities that simplify and automate the process of collecting forensic traces from a mobile device and looking for evidence that the device may have been compromised. Instead of asking you to open a database viewer and read through phone artifacts by hand, it pulls the relevant records out of the device's data and puts them in a form an analyst can search and compare.
The comparison step is the point of the tool. MVT supports public indicators of compromise, published in the companion repository mvt-project/mvt-indicators, and scans a device's collected traces for matches against those indicators. Those IOCs come from real spyware campaigns that have been investigated and documented, not from generic heuristics, so a hit is a concrete lead rather than a risk score. The video that accompanies this entry sums up the practical output the way an analyst would: suspicious processes, files and network traces, surfaced from data that would otherwise be invisible.
How it works
MVT is written in Python and driven from the command line. You point it at data you have already extracted from a phone — a backup or a device dump — and it parses that data into structured records, then runs those records against the indicator list you supply. Anything that matches a known campaign is flagged for a human to look at.
That design has two consequences worth understanding before you use it. First, the analysis happens on a copy of the data, not as an agent living on the handset, which keeps the examined material stable and repeatable. Second, the quality of the result depends on the indicators you feed it: MVT tells you whether known markers appeared, and the indicator set is a separately maintained, publicly available body of work rather than something baked into the binary.
Getting started
The project is distributed on PyPI as the mvt package, and the documentation lives at docs.mvt.re, where the install steps and the per-platform commands are written out. The indicators are a separate download from the mvt-indicators repository. The repository runs CI on its test suite and has been pushed to as recently as September 2026, so this is an actively maintained tool rather than a frozen artifact of the 2021 investigation.
One upgrade note is called out at the top of the README: the "v3" branch has been merged, and it introduced breaking changes. If you had scripts consuming MVT's output, they may no longer work; the project tracks the details in issue 757. Anyone automating around MVT should read that before upgrading.
When to use it / when not
Reach for MVT when you are doing an actual investigation: you support journalists, activists, human rights defenders or executives; you have a reason to believe a specific device was targeted; and you have, or can make, a backup to examine. It is also the right tool when you need your work to be reproducible and defensible, because the indicators are public and the process is a documented methodology rather than a proprietary verdict.
Do not reach for it as a self-check. The maintainers put the warning in the README themselves: MVT is a forensic research tool for technologists and investigators, it requires understanding digital forensics and command-line tools, and it is not intended for end-user self-assessment. If you are personally worried about your phone, the project's own advice is to seek reputable expert help rather than run this yourself. It is also worth being clear-eyed about what a clean run means. MVT checks for indicators of known campaigns, so "nothing matched" means no published marker was found in the data you gave it — useful information, but not a certificate of safety.
Anyone working in civil society security, threat intelligence or incident response on mobile devices should treat MVT as standard equipment. It comes out of one of the most consequential spyware investigations of the last decade, it carries the methodology that investigation used, and with more than 13,000 stars and 1,300 forks it has an unusually broad base of practitioners for a niche forensics tool. For everyone else, the honest recommendation is to know that it exists and to know who to hand a device to — the value here is in the hands of someone trained to read what it prints.