MNN is Alibaba's deep learning engine for running models on the device itself: Android and iOS phones, PCs, and embedded boards. It converts models from TensorFlow, ONNX, Caffe and TorchScript, then runs them with hand-tuned code for ARM and x86 CPUs and GPU backends including Metal, OpenCL, Vulkan and CUDA, plus NPUs and, since 3.6.1, Qualcomm Hexagon DSPs. The core library on Android is under 1 MB.
On top sit MNN-LLM and MNN-Diffusion, runtimes for large language models and Stable Diffusion, and a set of ready apps: MNN Chat for Android and iOS runs Qwen, DeepSeek and other models offline with text, image and audio input, and TaoAvatar is an offline 3D talking avatar. Inside Alibaba, MNN runs in more than 30 apps, including Taobao.
It is Apache-2.0, with about 16,300 stars and 218 contributors, at 3.6.1 when scanned. It is a framework for developers: building it means CMake and a C++ toolchain, and the community discussion is mostly in Chinese, though the docs are in English.
- Repository: github.com/alibaba/MNN
- Licence: Apache-2.0 (Apache License 2.0)
- Language: C++. Stars: 16.3K. Forks: 2,486. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 1389ce4
Who it is for
Mobile and embedded developers who need fast local inference, app makers shipping LLM features that work offline, and Android users who want an offline chat app.
Getting started
1. Build the engine with LLM support (macOS or Linux)
mkdir build && cd build && cmake ../ -DMNN_LOW_MEMORY=true -DMNN_BUILD_LLM=true -DMNN_SUPPORT_TRANSFORMER_FUSE=true && make -j162. Chat with a converted model
./llm_demo model_dir/config.jsonJust want to try it? The MNN Chat app for Android is on Google Play and on the app's releases page, and downloads models inside the app.
Safety scan
We cloned alibaba/MNN at commit 1389ce4 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets and no suspicious patterns across 8,559 files and about 2.9 million lines of C++, Python and Kotlin.
- The 5 binaries are four Gradle wrapper jars, the standard way Android projects pin their build tool, and a 512-byte FlatBuffers test file. tools/mnncompress/setup.py runs protoc at install to generate Python code from a local .proto file; the other setup.py files and 12 shell scripts are build and demo helpers, none using sudo.
- 12 known advisories (5 high), none critical, in the MNN Chat app's JavaScript tooling lockfile and in pymnn/test/playground/requirements.txt (an old protobuf). Neither ships in the engine library.
- 16 workflows. The one pull_request_target workflow only pings Alibaba's internal CI, with empty permissions and an explicit rule not to check out PR code. None of the 11 third-party actions is pinned to a commit. Security policy present; OpenSSF Scorecard 5.8 out of 10.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 3 setup.py files with custom install logic. 12 installer scripts |
| Committed binaries | 5 executable or compiled objects committed; listed under the raw findings. |
| CI workflows | 16 workflows. 1 uses pull_request_target, none check out the pull request head. 11 of 11 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, json.nlohmann.me, www.opengl.org, developers.google.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 12 advisories across 103 pinned packages: 0 critical, 5 high, 5 moderate, 1 low, 1 unrated. apps/Android/MnnLlmChat/package-lock.json: 89 packages, 6 advisories; docs/requirements.txt: 1 packages, 0 advisories; pymnn/test/playground/requirements.txt: 11 packages, 6 advisories; pymnn/test/playground/requirements_inner.txt: 2 packages, 0 advisories. |
| Project hygiene | Has security policy, licence file, contributing guide. Missing automated dependency updates, CodeQL. |
| OpenSSF Scorecard | 5.8 out of 10, as of Oct 26, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (12)
- 3rd_party/flatbuffers/.travis/deploy-python.sh, 13 lines; talks to test.pypi.org, upload.pypi.org
- apps/Android/MnnLlmChat/installDebug.sh, 2 lines
- apps/Android/MnnLlmChat/scripts/setup_release.sh, 77 lines
- apps/frameworks/sherpa-mnn/c-api-examples/run.sh, 49 lines; talks to k2-fsa.github.io
- apps/frameworks/sherpa-mnn/kotlin-api-examples/run.sh, 385 lines; talks to github.com, huggingface.co
- apps/sana/run_sana_benchmark_android.sh, 204 lines
- apps/sana/run_sana_benchmark_host.sh, 159 lines
- apps/sana/run_sana_demo.sh, 311 lines
- apps/sana/run_sana_on_android.sh, 143 lines
- project/android/run.sh, 119 lines
- source/backend/hexagon/htp-ops-lib/run_sim_so.sh, 62 lines
- tools/script/runMNNBasic.sh, 21 lines
Committed binaries (5)
project/android/demo/gradle/wrapper/gradle-wrapper.jar: JAR, 55 KBproject/android/gradle/wrapper/gradle-wrapper.jar: JAR, 55 KB3rd_party/flatbuffers/samples/android/gradle/wrapper/gradle-wrapper.jar: JAR, 55 KBapps/Android/MnnLlmChat/gradle/wrapper/gradle-wrapper.jar: JAR, 44 KB3rd_party/flatbuffers/tests/javatest.bin: .bin, 1 KB
Worst known vulnerabilities (12 of 12)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-r5fr-rjxr-66jc | high | lodash@4.17.23 | lodash vulnerable to Code Injection via `_.template` imports key names |
| GHSA-hq3h-g68c-hp78 | high | urllib@2.44.0 | urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage |
| GHSA-7gcm-g887-7qv7 | high | protobuf@3.13.0 | protobuf affected by a JSON recursion depth bypass |
| GHSA-8gq9-2x98-w8hf | high | protobuf@3.13.0 | protobuf-cpp and protobuf-python have potential Denial of Service issue |
| GHSA-8qvm-5x2c-j2w7 | high | protobuf@3.13.0 | protobuf-python has a potential Denial of Service issue |
| GHSA-f23m-r3pf-42rh | moderate | lodash@4.17.23 | lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` |
| GHSA-4mjr-xmp4-gh2g | moderate | qs@6.15.0 | qs: Denial of Service via Attacker Controlled isBuffer |
| GHSA-q8mj-m7cp-5q26 | moderate | qs@6.15.0 | qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays … |
| GHSA-x5fp-wj9c-mxmx | moderate | qs@6.15.0 | qs array-limit bypass via bracket-key comma parsing |
| GHSA-7p48-42j8-8846 | moderate | streamlit@1.37.0 | Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure) |
| GHSA-vqwp-45wm-r9r5 | low | streamlit@1.37.0 | Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission |
| GHSA-77rm-9x9h-xj3g | unknown | protobuf@3.13.0 |
Workflows worth a look
- .github/workflows/aone-pr-merge-trigger.yml: pull_request_target
By the numbers
| Stars | 16.3K |
|---|---|
| Forks | 2,486 |
| Contributors | 218 |
| Commits | 3,225 |
| Open issues | 37 |
| Open pull requests | 32 |
| Releases | 63 |
| Latest release | 3.6.1 |
| Licence | Apache-2.0 |
| Main language | C++ |
| Project age | 7 years |
| Last push | Oct 26, 2026 |
| Tracked files | 8,559 |
| Lines of code | 2.9M |
| Checkout size | 258 MB |
Lines by language: C++ 1.7M, C/C++ header 728.4K, Python 77K, Kotlin 70.5K, Markdown 65.8K, C 39K.
Questions
Is MNN free?
Yes. MNN is Apache-2.0 and free, including for commercial apps. The models you run with it have their own licences.
Can MNN run large language models on a phone?
Yes. MNN-LLM runs Qwen, DeepSeek R1 distills, Llama and other models on Android and iOS, and the MNN Chat app shows it working offline, including multimodal models.
How does MNN compare with llama.cpp?
Both run models locally. llama.cpp focuses on language models in the GGUF format, while MNN is a general inference engine for vision, speech, diffusion and language models, with particular tuning for mobile CPUs, GPUs and NPUs.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.