Skip to content
SPECIFICTION
Get listed

EvoMaster

evomaster.org

Free plan WindowsmacOSLinuxAPISelf-hosted
Visit evomaster.org
Spec score 8.1 #11 of 33 in Monorepo Management Tools

What it is

EvoMaster automatically generates system-level tests for web and enterprise applications by fuzzing APIs. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift. Black-box testing works across implementation languages; white-box testing is available for APIs compiled to the JVM, such as Java and Kotlin. The tool evolves test cases using evolutionary algorithms, dynamic program analysis, and AI heuristics to improve measures such as code coverage and fault detection. Its project describes more than 30 fault-detection oracles, covering issues such as HTTP status problems, schema mismatches, BOLA, and SQL injection. Generated results can include JUnit 4 or 5 tests in Java or Kotlin, Python or JavaScript test suites, and an interactive HTML report by default. White-box testing supports PostgreSQL, MySQL, H2, and MongoDB communications and can generate database initialization. Authentication headers and cookies are supported, as is dynamic credential retrieval through configured login endpoints. EvoMaster is free, has no telemetry, and says it needs no external internet services beyond the application under test. It can run on Linux, macOS, Windows, or self-hosted; PyPI is the recommended installation route, with a JAR and Docker image also available.

Spec sheet

Purpose
EvoMaster automatically generates system-level test cases for web and enterprise applications by fuzzing APIs.Read 8 Oct 2026 · github.com
Founded
2016Read 28 Sep 2026 · evomaster.org
API types
It targets REST, GraphQL and RPC APIs, including gRPC and Thrift.Read 8 Oct 2026 · github.com
Authentication
It supports authentication headers and cookies, including declarative login endpoint configuration to obtain credentials dynamically for each test execution.Read 8 Oct 2026 · github.com
CI integration
The project documents running EvoMaster in GitHub Actions through a custom action hosted in a separate repository.Read 8 Oct 2026 · github.com
Database support
For white-box testing, it supports PostgreSQL, MySQL, H2 and MongoDB communications and can generate database initialization for tests.Read 8 Oct 2026 · github.com
Fault detection
The project says it uses more than 30 oracles to detect faults including HTTP status problems, schema mismatches, BOLA and SQL injection.Read 8 Oct 2026 · github.com
Generated output
It can generate JUnit 4 or 5 tests in Java or Kotlin and test suites in Python or JavaScript, and creates an interactive HTML report by default.Read 8 Oct 2026 · github.com
Installation and platforms
The recommended installation is through PyPI; the project also provides a JAR, Docker image and deprecated installers for Windows, macOS and Linux.Read 8 Oct 2026 · github.com
Limits
White-box testing requires users to write a driver, RPC schema definitions are not directly supported, and support for external services such as other REST APIs is still work in progress.Read 8 Oct 2026 · github.com
Runtime and schema limits
The project recommends searches lasting one to 24 hours for stronger results, and REST APIs must provide OpenAPI 2.0, 3.0 or 3.1 schemas; OpenAPI 3.2 support is on hold.Read 8 Oct 2026 · github.com
Security and privacy
The project states that it has no telemetry and does not require external internet services beyond the application under test, and says it can run in-house without leaking intellectual property to external parties.Read 8 Oct 2026 · github.com
Support and community
The project directs users to GitHub issues and discussions for questions and says it offers academia-industry collaborations for closed-source APIs.Read 8 Oct 2026 · github.com
Test generation
It uses evolutionary algorithms, dynamic program analysis and AI heuristics to evolve test cases and improve measures such as code coverage and fault detection.Read 8 Oct 2026 · github.com
Testing modes
It supports black-box testing for APIs regardless of implementation language and white-box testing for APIs compiled to the JVM, such as Java and Kotlin.Read 8 Oct 2026 · github.com

Plans and prices

EvoMaster Free Open-source tool · no monetary cost · no paid external services required Read 8 Oct 2026 · github.com

Every EvoMaster plan and price →

Strong points and limits

Strong points

  • Black-box testing supports APIs across implementation languages
  • Targets REST, GraphQL, gRPC, and Thrift APIs
  • Generates tests in Java, Kotlin, Python, or JavaScript
  • No telemetry or external service beyond the application under test

Limits

  • White-box testing requires a user-written driver
  • RPC schema definitions are not directly supported
  • REST APIs need OpenAPI 2.0, 3.0, or 3.1 schemas
  • Stronger results may require searches lasting one to 24 hours

Who it suits

EvoMaster suits teams that want to generate API tests for web or enterprise applications, including teams working with REST, GraphQL, or supported RPC APIs. White-box use is for JVM APIs and requires users to write a driver.

Verdict

EvoMaster generates varied API test outputs and supports both black-box and JVM white-box approaches. Users should account for its driver requirement, OpenAPI schema limits, and recommended long search durations.

Where Specifiction places it

Alternatives to EvoMasterAll alternatives →