CheckOps home

Tools directory

C

CheckOps

CATS

CATS is Endava's Apache-2.0 REST API fuzzer and negative-testing tool that generates, runs and reports tests for OpenAPI endpoints with no coding.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

CATS (Contract Auto-generated Tests for Swagger) is a REST API fuzzer and negative-testing tool for OpenAPI endpoints. It automatically generates, runs and reports tests with minimum configuration and no coding, and its README says tests are self-healing and need no maintenance.

The source code is at Endava/cats on GitHub under the Apache-2.0 licence, with about 1,400 stars; the most recent commit was on 10 November 2026.

Features

  1. Zero-code tests: Generated from OpenAPI.
  2. Many fuzzers: Boundary, type, header and injection fuzzers.
  3. HTML reports: Detailed results.
  4. Authentication support: Headers and auth configuration.
  5. CI friendly: Run as a CLI in pipelines.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 10 November 2026.

Cons

  1. Requires a good spec: Results depend on OpenAPI quality.
  2. Many requests: Run against non-production.
cats --contract=openapi.yml --server=https://staging.example.com

Resources:

Pricing

CATS is free and open source under the Apache-2.0 licence.

  1. API teams wanting negative tests without code.
  2. QA engineers fuzzing OpenAPI services.
  3. Not a fit for GraphQL or gRPC.

Conclusion

CATS generates large negative-test suites for OpenAPI services with no coding.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with CATS side by side.