- Home
- Fuzz Testing Software
- EvoMaster
EvoMaster
What it is
EvoMaster is a free tool that generates system-level tests for web and enterprise applications by fuzzing APIs. It targets REST and GraphQL APIs as well as RPC APIs, including gRPC and Thrift. Black-box testing can work with APIs regardless of implementation language; white-box testing is available for JVM-compiled APIs such as Java and Kotlin. EvoMaster evolves test cases using evolutionary algorithms, dynamic program analysis, and AI heuristics to improve measures such as code coverage and fault detection. The project describes more than 30 fault-detection oracles, including checks for HTTP status problems, schema mismatches, BOLA, and SQL injection. Outputs include JUnit 4 or 5 tests in Java or Kotlin, test suites in Python or JavaScript, and an interactive HTML report by default. White-box testing supports PostgreSQL, MySQL, H2, and MongoDB communications and can generate database initialization. The project says it has no telemetry and does not need external internet services beyond the application under test. Installation is recommended through PyPI; a JAR and Docker image are also available.
For and against
For
- Free tool with no paid external services required
- Supports black-box testing across implementation languages
- Generates tests in Java, Kotlin, Python, or JavaScript
- Creates an interactive HTML report by default
Against
- White-box testing requires users to write a driver
- RPC schema definitions are not directly supported
- External-service support remains work in progress
- OpenAPI 3.2 support is on hold
The verdict
EvoMaster offers broad API test generation and several code-output formats at no monetary cost. Its white-box driver requirement and listed schema and external-service limitations may affect which projects can use it directly.
Who it suits
EvoMaster suits developers and teams who need automated API testing across REST, GraphQL, or RPC interfaces. Teams using white-box testing should be prepared to write a driver.
Plans and prices
EvoMaster
Open-source tool · no monetary cost · no paid external services required
Read 8 Oct 2026 · github.com
On the record
- API types
- It targets REST, GraphQL and RPC APIs, including gRPC and Thrift.github.com · read 8 Oct 2026
- Authentication
- It supports authentication headers and cookies, including declarative login endpoint configuration to obtain credentials dynamically for each test execution.github.com · read 8 Oct 2026
- CI integration
- The project documents running EvoMaster in GitHub Actions through a custom action hosted in a separate repository.github.com · read 8 Oct 2026
- Database support
- For white-box testing, it supports PostgreSQL, MySQL, H2 and MongoDB communications and can generate database initialization for tests.github.com · read 8 Oct 2026
- Fault detection
- The project says it uses more than 30 oracles to detect faults including HTTP status problems, schema mismatches, BOLA and SQL injection.github.com · read 8 Oct 2026
- Generated output
- It can generate JUnit 4 or 5 tests in Java or Kotlin and test suites in Python or JavaScript, and creates an interactive HTML report by default.github.com · read 8 Oct 2026
- Installation and platforms
- The recommended installation is through PyPI; the project also provides a JAR, Docker image and deprecated installers for Windows, macOS and Linux.github.com · read 8 Oct 2026
- Limits
- White-box testing requires users to write a driver, RPC schema definitions are not directly supported, and support for external services such as other REST APIs is still work in progress.github.com · read 8 Oct 2026
- Purpose
- EvoMaster automatically generates system-level test cases for web and enterprise applications by fuzzing APIs.github.com · read 8 Oct 2026
- Runtime and schema limits
- The project recommends searches lasting one to 24 hours for stronger results, and REST APIs must provide OpenAPI 2.0, 3.0 or 3.1 schemas; OpenAPI 3.2 support is on hold.github.com · read 8 Oct 2026
- Security and privacy
- The project states that it has no telemetry and does not require external internet services beyond the application under test, and says it can run in-house without leaking intellectual property to external parties.github.com · read 8 Oct 2026
- Support and community
- The project directs users to GitHub issues and discussions for questions and says it offers academia-industry collaborations for closed-source APIs.github.com · read 8 Oct 2026
- Test generation
- It uses evolutionary algorithms, dynamic program analysis and AI heuristics to evolve test cases and improve measures such as code coverage and fault detection.github.com · read 8 Oct 2026
- Testing modes
- It supports black-box testing for APIs regardless of implementation language and white-box testing for APIs compiled to the JVM, such as Java and Kotlin.github.com · read 8 Oct 2026
