- Home
- Fuzz Testing Software
- EvoMaster
EvoMaster
What it is
EvoMaster is a free, open-source tool that uses fuzzing to generate system-level tests for web and enterprise applications. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift. Black-box mode works with APIs in any programming language, while white-box mode analyzes JVM application bytecode. Generated tests can be JUnit 4 or 5 in Java or Kotlin, or test suites in Python or JavaScript. More than 30 oracles check for issues including HTTP 500 responses, schema mismatches, BOLA, and SQL injection. White-box testing can analyze SQL and MongoDB interactions across PostgreSQL, MySQL, H2, and MongoDB. Authentication supports headers and cookies, including tokens or cookies obtained from a login endpoint. REST testing requires OpenAPI 2.0, 3.0, or 3.1 schemas. Installation is recommended through PyPI, with Docker and an uber-fat JAR also provided. The project can run in GitHub Actions through a custom action. It reports no telemetry and requires no internet services beyond the application being tested. White-box mode requires a manually written driver, and external services are not automatically mocked.
For and against
For
- Free open-source distribution
- Supports REST, GraphQL, and RPC APIs
- Generates Java, Kotlin, Python, and JavaScript tests
- More than 30 fault-detection oracles
- Runs in GitHub Actions
Against
- White-box testing requires a manual driver
- External services are not automatically mocked
- REST testing requires an OpenAPI schema
- Deprecated platform installers are listed
The verdict
EvoMaster offers broad API coverage and generated tests without monetary cost. Its schema requirement and white-box setup work make those constraints worth checking first.
Who it suits
It suits developers and testers working with web, enterprise, REST, GraphQL, or RPC applications. Teams using white-box mode need to write a driver themselves.
Plans and prices
EvoMaster
Open source · no paid external services required
Read 8 Oct 2026 · github.com
On the record
- API coverage
- It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift.github.com · read 8 Oct 2026
- Authentication
- It supports authentication headers and cookies, including dynamically obtaining tokens or cookies from a login endpoint.github.com · read 8 Oct 2026
- Database support
- For white-box testing, it can analyze SQL and MongoDB interactions and supports PostgreSQL, MySQL, H2, and MongoDB.github.com · read 8 Oct 2026
- Fault detection
- Its heuristics check for issues including HTTP 500 responses, schema mismatches, BOLA, and SQL injection, using more than 30 oracles.github.com · read 8 Oct 2026
- Installation
- The recommended install method is PyPI; the project also provides an uber-fat JAR and Docker distribution.github.com · read 8 Oct 2026
- Integrations
- It can run in GitHub Actions through a custom action and is distributed as a Docker image.github.com · read 8 Oct 2026
- Known limitations
- White-box testing requires a manually written driver, and EvoMaster does not yet automatically mock external services.github.com · read 8 Oct 2026
- License and funding
- The source code is released under LGPL v3 and the project reports funding from ERC and the Research Council of Norway.github.com · read 8 Oct 2026
- Platform installers
- Windows MSI, macOS DMG, and Linux DEB installers are listed as deprecated.github.com · read 8 Oct 2026
- Purpose
- EvoMaster automatically generates system-level tests through fuzzing for web and enterprise applications.github.com · read 8 Oct 2026
- REST schema limits
- REST APIs need an OpenAPI schema; versions 2.0, 3.0, and 3.1 are supported, while 3.2 support is on hold.github.com · read 8 Oct 2026
- Security and privacy
- The project says it has no telemetry and does not require internet services beyond the application being tested.github.com · read 8 Oct 2026
- Support
- The project directs users to GitHub issues and discussions for documentation and usage questions.github.com · read 8 Oct 2026
- Test generation
- It generates JUnit 4 or 5 tests in Java or Kotlin and test suites in Python or JavaScript.github.com · read 8 Oct 2026
- Testing modes
- Black-box mode can run against APIs in any programming language, while white-box mode analyzes JVM application bytecode.github.com · read 8 Oct 2026
