CheckOps home

Tools directory

E

CheckOps

EvoMaster

EvoMaster is an LGPL-3.0 open-source tool that uses AI search techniques to generate system-level tests for REST, GraphQL and RPC APIs, in white-box and black-box modes.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

EvoMaster describes itself on GitHub as “the first open-source AI-driven tool for automatically generating system-level test cases (also known as fuzzing) for web/enterprise applications”. The repository WebFuzzing/EvoMaster is licensed LGPL-3.0.

It targets white-box and black-box testing of Web APIs, including REST, GraphQL and RPC (for example gRPC and Thrift). The project comes from academic research and is actively maintained, with commits the day before this review.

Features

  1. Automatic test generation: Generates system-level test cases for APIs.
  2. Black-box mode: Tests any API from its schema without source access.
  3. White-box mode: Instruments JVM code for deeper coverage, according to the project.
  4. Multiple API styles: REST, GraphQL and RPC (gRPC, Thrift).
  5. Fault finding: Fuzzing aims to find crashes and server errors.
  6. Test output: Produces executable test files you can keep in your repository; see docs for formats.

Pros

  1. Free and open: LGPL-3.0.
  2. Research-backed: Grounded in published search-based testing work.
  3. Finds unexpected faults: Fuzzing explores inputs humans rarely try.
  4. Broad API support: REST, GraphQL and RPC.
  5. Active: Regular commits.

Cons

  1. Learning curve: White-box setup needs a driver for your service.
  2. Generated tests are many: Large outputs need curation.
  3. Not LLM-based: “AI” here means search-based techniques, not chat models.
  4. Website unavailable at review: evomaster.org did not respond; use GitHub.
  5. JVM focus for white-box: Black-box works for any language.

Download a release from GitHub, then run black-box mode against an OpenAPI schema; see the README and docs for the exact command-line options. Review the generated test files, keep the useful ones, and run them in CI.

Resources:

Pricing

EvoMaster is free and open source under LGPL-3.0.

  1. API teams wanting automated fuzzing and regression tests.
  2. Security-minded testers looking for crashes and 500s.
  3. Researchers and educators in search-based testing.
  4. Not a fit if you want a hosted, no-code product.

Conclusion

EvoMaster is a mature, research-driven open-source generator of API tests and fuzzing cases.

Expect setup effort for white-box mode and curate the generated output.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with EvoMaster side by side.