Open-Source Testing · WebFuzzing

EvoMaster

EvoMaster is an open-source, AI-driven fuzzing tool that automatically generates system-level test cases for web APIs (REST, GraphQL, RPC). It uses evolutionary algorithms and dynamic analysis to create both crash-finding fuzzing inputs and regression test suites, supporting both white-box testing for JVM languages and black-box testing for any API.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/WebFuzzing/EvoMaster

758

GitHub stars

114

Forks

Kotlin

Primary language

LGPL-3.0

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	WebFuzzing/EvoMaster
Owner	WebFuzzing
Primary language	Kotlin
License	LGPL-3.0 — OSI-approved
Stars	758
Forks	114
Open issues	49
Latest release	v6.1.1 (2026-07-08)
Last updated	2026-07-08
Source	https://github.com/WebFuzzing/EvoMaster

What EvoMaster is

EvoMaster applies evolutionary algorithms and taint analysis to generate test cases, with white-box support for JVM bytecode analysis (Java, Kotlin; JDK 8–21) and black-box support for any API. It accepts OpenAPI 2.0/3.0/3.1 schemas, outputs tests in JUnit (Java/Kotlin) or Python, and includes an interactive HTML report generator.

Quickstart

Get the EvoMaster source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/WebFuzzing/EvoMaster.git2cd EvoMaster3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

REST API Test Case Generation

Automatically generate JUnit or Python test suites for REST APIs with OpenAPI schemas, reducing manual test authoring and improving coverage via evolutionary search.

White-Box Regression Testing for JVM Services

Leverage bytecode analysis on Java/Kotlin microservices to generate targeted tests that detect regressions and edge cases with higher precision than black-box approaches.

Black-Box Fuzzing for Third-Party or Polyglot APIs

Fuzz APIs regardless of implementation language (Python, Go, .NET) without source access; useful for integration testing and vendor API validation.

Implementation considerations

For white-box testing, ensure JDK 8 (client library) or JDK 17+ (CLI/JAR) compatibility; older or non-LTS versions are unsupported.
Provide accurate, up-to-date OpenAPI/GraphQL schemas; incomplete or outdated specifications will reduce test quality and coverage.
Black-box testing requires a running API instance; white-box requires the ability to instrument and analyze the JVM application during test generation.
Generated tests output format varies (Python default, JUnit for Java/Kotlin); plan integration with your CI/CD test framework accordingly.
Fuzzing duration and search parameters (algorithm, population size, time) are configurable; tuning is often needed to balance coverage vs. runtime in your environment.

When to avoid it — and what to weigh

Non-Schema-Based APIs — EvoMaster requires structured API specifications (OpenAPI, GraphQL schema, RPC IDL). SOAP, proprietary, or undocumented endpoints are not supported.
Non-JVM White-Box Testing — White-box mode is exclusive to JVM languages. If you need instrumentation-level analysis for Python, Go, or C#, EvoMaster will fall back to black-box with reduced effectiveness.
Simple Unit/UI Testing — EvoMaster focuses on system-level API testing, not unit tests or user interface automation. Projects requiring UI test generation should look elsewhere.
Real-Time or Low-Latency Constraints — Evolutionary test generation is computationally expensive. If you require instant test generation in production pipelines, the runtime overhead may be prohibitive.

License & commercial use

EvoMaster is licensed under LGPL-3.0 (GNU Lesser General Public License v3.0). LGPL is a copyleft license that permits commercial use, modification, and distribution, but requires that LGPL-licensed components remain under LGPL and that source code for those components be made available to recipients.

LGPL-3.0 permits commercial use without payment. However, if you distribute or deploy EvoMaster (or a derivative), you must: (1) disclose that LGPL-3.0 components are used, (2) provide access to the LGPL-licensed source code, and (3) allow end-users to modify and re-link those components. Using EvoMaster internally for testing requires no source disclosure. Any modifications to EvoMaster itself must remain under LGPL-3.0. Consult your legal team for complex distribution scenarios.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Adequate
License clarity	Clear
Deployment complexity	Low
DEV.co fit	Strong
Assessment confidence	High

Security considerations

EvoMaster performs fuzzing (sending crafted inputs to APIs to trigger failures). Ensure the target API runs in an isolated test environment where crashes, data corruption, or unexpected state changes do not affect production. No telemetry is sent externally. The tool itself does not perform authentication/encryption security testing; it relies on API schemas. If fuzzing an API with sensitive data, ensure proper data masking and access controls. Source code availability (LGPL) allows security audits.

Alternatives to consider

Postman (commercial)

Manual or script-based API testing with contract validation. Less automated; requires more manual test design but easier UI-driven workflow for smaller teams.

Swagger Codegen / OpenAPI Generator

Generates boilerplate code and client libraries from schemas, not test cases. Complements rather than replaces fuzzing; focuses on SDK generation.

AFL, libFuzzer, or OSS-Fuzz

General-purpose fuzzing tools for binaries and code-level fuzzing. Not API-aware; require custom harnesses. Better for low-level fuzzing, not REST/GraphQL.

Software development agency

Build on EvoMaster with DEV.co software developers

Evaluate EvoMaster for your REST/GraphQL APIs. Start with the 1-minute Docker example or pip install. No external services required. Review the GitHub repository and documentation for white-box instrumentation details.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

testsigma testplane evlog

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source Testing API Development Application Development (AI)DevOps Talk to DEV.co

EvoMaster FAQ

Can I use EvoMaster without providing an OpenAPI schema?

No. EvoMaster requires a structured schema (OpenAPI 2.0/3.0/3.1 for REST, GraphQL SDL for GraphQL, RPC IDL for gRPC/Thrift). For undocumented APIs, you would need to create a schema first or fall back to generic black-box fuzzing with limited guidance.

What's the difference between white-box and black-box modes?

White-box analyzes JVM bytecode in real-time, using code coverage and taint analysis to guide test generation, yielding higher-quality tests. Black-box only sends inputs to a running API and observes responses, so it is less precise but works with any API regardless of language.

Do I need to modify my application code to use white-box testing?

You need to add the EvoMaster client library (JVM) to your build and configure a controller that starts/stops your app and reports coverage. Your application code itself does not require modification, but your build and test setup do.

Does EvoMaster send data to external services or the cloud?

No. EvoMaster has no telemetry and does not require external service connectivity (except to reach the target API you are testing). It can run completely on-premises or air-gapped.

Software development & web development with DEV.co

Adopting EvoMaster is usually one piece of a larger software development effort. As a software development agency, DEV.co provides software development services and web development expertise — pairing senior software developers and web developers with your team to design, build, and operate open-source testing software in production.

Ready to Automate API Testing?

Talk to DEV.co Schedule a Consultation