EvoMaster

Overview

EvoMaster is a free, open-source fuzzing tool that builds system-level tests for web and enterprise applications. It suits engineering teams with API-heavy systems, particularly those able to supply an OpenAPI document or create a JVM test driver. Its broad protocol coverage and generated test formats make it a practical option for automated API assurance, while its setup requirements narrow its usefulness for some architectures.

Key features

The tool exercises REST, GraphQL, and RPC interfaces, including gRPC and Thrift. Black-box mode can target an API written in any programming language, which is the sensible choice for polyglot estates. White-box mode inspects JVM bytecode and can expose deeper application behavior, but it is confined to JVM applications and requires a manually authored driver.

Generated output includes JUnit 4 or 5 tests for Java or Kotlin, plus test suites in Python or JavaScript. That lets teams place results in existing language-specific test pipelines rather than adopting a proprietary format. More than 30 oracles look for failures such as HTTP 500 responses, schema mismatches, broken object-level authorization (BOLA), and SQL injection. These checks give the fuzzer a useful fault-finding remit beyond simple status-code assertions, although they do not replace a broader security program.

White-box runs can inspect SQL and MongoDB interactions, with PostgreSQL, MySQL, H2, and MongoDB supported. Authentication accepts headers and cookies, including tokens or cookies obtained dynamically from a login endpoint, which is important for protected APIs. REST targets must expose an OpenAPI schema: versions 2.0, 3.0, and 3.1 are supported, while 3.2 is not currently supported. There is no automatic mocking of external services, so dependent systems need to be reachable or handled by your own test environment.

The project reports no telemetry and says it needs no internet service beyond the application under test. GitHub Actions integration and a Docker image suit CI workflows. PyPI is the recommended installation route; an uber-fat JAR is also provided. Windows MSI, macOS DMG, and Linux DEB installers are deprecated, so those packages are a poor basis for a new deployment.

Pricing

EvoMaster costs 0.00 USD on its free plan, billed with no monetary cost. It is open source and requires no paid external services. There is no free trial because the product is already offered as a free plan, and no paid tiers, seat charges, usage quotas, renewal terms, or time limits are published. The LGPL v3 licence permits teams to evaluate and operate the source under its terms, with support routed through GitHub issues and discussions rather than a commercial support plan.

Platforms

EvoMaster is listed for API, Linux, macOS, self-hosted, and Windows use. Docker and the JAR make self-hosted and CI deployment straightforward in principle, while the deprecated native installers mean package-based desktop installation should not be the default plan.

Who it's for

Choose EvoMaster when your team needs generated system tests across several API styles and wants outputs that fit Java, Kotlin, Python, or JavaScript pipelines. It is especially appropriate for API owners with OpenAPI contracts, JVM teams prepared to write a white-box driver, and organizations that want fuzzing in GitHub Actions without sending telemetry to a hosted service.

It is a weaker fit for REST services without an OpenAPI schema, non-JVM teams seeking white-box analysis, or environments whose critical dependencies must be mocked automatically. Those teams should first confirm that they can provide the required driver and manage external-service dependencies themselves.

Pros and cons

Pros

• Supports REST, GraphQL, gRPC, Thrift, and other RPC testing, covering varied API estates.
• Black-box mode works with any programming language, avoiding a language lock-in for the system under test.
• Produces JUnit, Python, and JavaScript tests that can join established CI pipelines.
• More than 30 oracles include checks for BOLA, SQL injection, schema errors, and HTTP 500 responses.
• No telemetry requirement, with Docker, a JAR, PyPI, and GitHub Actions options for self-hosted operation.

Cons

• REST testing depends on an OpenAPI 2.0, 3.0, or 3.1 schema; OpenAPI 3.2 is not supported.
• White-box testing is JVM-only and needs a manually written driver.
• External services are not mocked automatically, increasing test-environment work for distributed systems.
• Native MSI, DMG, and DEB installers are deprecated.
• Documentation and usage help are directed to community GitHub issues and discussions rather than a paid support channel.

Alternatives

For a broader directory of Fuzz Testing Software, compare tools by their fuzzing focus. The API Testing Tools list is a better starting point when contract and endpoint testing matter more than generated system tests. Teams managing large repositories can review Monorepo Management Tools instead.

Bazel is a free, open-source build and test tool from Google; choose it when build orchestration is the primary need rather than API fuzzing. bento offers a free tier with 10 GB of storage and 14-day retention, making it relevant when artifact storage and retention are the deciding factors. Bit is free and open source with free personal Bit Cloud use, suited to component sharing across web and mobile projects. Blaze is free to use for teams seeking a general development tool. Bun is an MIT-licensed JavaScript runtime and toolkit, so pick it for JavaScript runtime and tooling needs. FerrFlow is a free, MIT-licensed single Rust binary for teams wanting that style of utility. manypkg is a free MIT-licensed CLI from Thinkmill for package-management workflows. mise is a free MIT-licensed tool for macOS, Linux, and Windows when environment and tool-version management is the goal.

Verdict

EvoMaster is a strong choice for teams that want no-cost, self-hosted fuzz-based generation across REST, GraphQL, and RPC APIs, with test output that fits common programming languages and CI systems. Choose it when you can supply OpenAPI contracts or a JVM driver and can control external dependencies. Look elsewhere if those prerequisites are unavailable or automatic service mocking is essential.