EvoMaster

Free plan APILinuxMacSelf-hostedWindows

What EvoMaster is

EvoMaster automatically generates system-level tests for web and enterprise applications by fuzzing APIs. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift. Black-box testing works across implementation languages, while white-box testing applies to APIs compiled to the JVM, including Java and Kotlin. Test cases evolve through evolutionary algorithms, dynamic program analysis, and AI heuristics to improve measures such as code coverage and fault detection. The project describes more than 30 fault-detection oracles, including checks for HTTP status problems, schema mismatches, BOLA, and SQL injection. Outputs include JUnit 4 or 5 tests in Java or Kotlin, test suites in Python or JavaScript, and a default interactive HTML report. White-box testing supports PostgreSQL, MySQL, H2, and MongoDB communications and can generate database initialization. EvoMaster says it has no telemetry and needs no external internet services beyond the application under test. It is free, with GitHub issues and discussions available for questions.

Who it suits

EvoMaster suits teams seeking generated API tests for web or enterprise applications, including JVM projects needing white-box coverage. Users should be prepared to write a driver for white-box testing and provide supported OpenAPI schemas for REST APIs.

What it does well

Supports REST, GraphQL, and RPC APIs.
Black-box testing works across implementation languages.
Provides more than 30 fault-detection oracles.
Generates tests in Java, Kotlin, Python, or JavaScript.
No telemetry, according to the project.

What to know first

White-box testing requires a user-written driver.
RPC schema definitions are not directly supported.
External-service support remains in progress.
REST APIs need OpenAPI 2.0, 3.0, or 3.1 schemas.

Limits

EvoMaster is free. White-box testing requires a user-written driver, REST APIs require OpenAPI 2.0, 3.0, or 3.1 schemas, and OpenAPI 3.2 support is on hold. RPC schema definitions are not directly supported, and support for external services is still in progress.

Plans

Plan	Billed and limits	Price
EvoMaster	Open-source tool · no monetary cost · no paid external services required	Free

As evomaster.org lists them, read 8 Oct 2026. The maker's own page has the final word.

Getting started

Open https://www.evomaster.org.
Install EvoMaster through the recommended PyPI route, or use its JAR or Docker image.
Choose black-box testing, or use white-box testing for a JVM API and provide a driver.
For REST APIs, provide an OpenAPI 2.0, 3.0, or 3.1 schema.
Configure authentication headers, cookies, or declarative login if needed.
Run a search; the project recommends durations of one to 24 hours for stronger results.
Use the generated test suite and interactive HTML report.

Verdict

EvoMaster offers free automated test generation across several API types, with both black-box and JVM-focused white-box modes. Its schema and driver requirements matter when deciding whether it fits a project.

Questions

How much does EvoMaster cost?

The EvoMaster plan is free; it is described as an open-source tool with no paid external services required.

Which API types does it target?

It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift.

Which platforms does it support?

The listed platforms are API, Linux, macOS, self-hosted, and Windows.

What languages can its generated tests use?

It can generate JUnit 4 or 5 tests in Java or Kotlin, and test suites in Python or JavaScript.

Does white-box testing need extra setup?

Yes. White-box testing is for APIs compiled to the JVM and requires users to write a driver.

What schemas do REST APIs need?

REST APIs must provide OpenAPI 2.0, 3.0, or 3.1 schemas. OpenAPI 3.2 support is on hold.

Facts from EvoMaster's own pages

API types: It targets REST, GraphQL and RPC APIs, including gRPC and Thrift. · github.com, 8 Oct 2026
Authentication: It supports authentication headers and cookies, including declarative login endpoint configuration to obtain credentials dynamically for each test execution. · github.com, 8 Oct 2026
CI integration: The project documents running EvoMaster in GitHub Actions through a custom action hosted in a separate repository. · github.com, 8 Oct 2026
Database support: For white-box testing, it supports PostgreSQL, MySQL, H2 and MongoDB communications and can generate database initialization for tests. · github.com, 8 Oct 2026
Fault detection: The project says it uses more than 30 oracles to detect faults including HTTP status problems, schema mismatches, BOLA and SQL injection. · github.com, 8 Oct 2026
Founded: 2016 · evomaster.org, 28 Sept 2026
Generated output: It can generate JUnit 4 or 5 tests in Java or Kotlin and test suites in Python or JavaScript, and creates an interactive HTML report by default. · github.com, 8 Oct 2026
Installation and platforms: The recommended installation is through PyPI; the project also provides a JAR, Docker image and deprecated installers for Windows, macOS and Linux. · github.com, 8 Oct 2026
Limits: White-box testing requires users to write a driver, RPC schema definitions are not directly supported, and support for external services such as other REST APIs is still work in progress. · github.com, 8 Oct 2026
Purpose: EvoMaster automatically generates system-level test cases for web and enterprise applications by fuzzing APIs. · github.com, 8 Oct 2026
Runtime and schema limits: The project recommends searches lasting one to 24 hours for stronger results, and REST APIs must provide OpenAPI 2.0, 3.0 or 3.1 schemas; OpenAPI 3.2 support is on hold. · github.com, 8 Oct 2026
Security and privacy: The project states that it has no telemetry and does not require external internet services beyond the application under test, and says it can run in-house without leaking intellectual property to external parties. · github.com, 8 Oct 2026
Support and community: The project directs users to GitHub issues and discussions for questions and says it offers academia-industry collaborations for closed-source APIs. · github.com, 8 Oct 2026
Test generation: It uses evolutionary algorithms, dynamic program analysis and AI heuristics to evolve test cases and improve measures such as code coverage and fault detection. · github.com, 8 Oct 2026
Testing modes: It supports black-box testing for APIs regardless of implementation language and white-box testing for APIs compiled to the JVM, such as Java and Kotlin. · github.com, 8 Oct 2026