Skip to content
SPECIFICTION
Get listed

EvoMaster

github.com

Free plan WindowsmacOSLinuxAPISelf-hosted
Visit github.com
Spec score 8.2 #8 of 33 in Monorepo Management Tools

What it is

EvoMaster is a free, open-source tool that uses fuzzing to generate system-level tests for web and enterprise applications. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift. Black-box mode works with APIs in any programming language, while white-box mode analyzes JVM bytecode. Generated tests can be JUnit 4 or 5 in Java or Kotlin, or suites in Python or JavaScript. More than 30 oracles check issues including HTTP 500 responses, schema mismatches, BOLA, and SQL injection. White-box testing can analyze SQL and MongoDB interactions with PostgreSQL, MySQL, H2, and MongoDB support. Authentication accepts headers and cookies, including tokens or cookies obtained from a login endpoint. REST testing requires OpenAPI 2.0, 3.0, or 3.1. PyPI is the recommended installation route, with Docker and an uber-fat JAR also available. EvoMaster runs on Linux, macOS, Windows, and self-hosted environments, and integrates with GitHub Actions through a custom action.

Spec sheet

Purpose
EvoMaster automatically generates system-level tests through fuzzing for web and enterprise applications.Read 8 Oct 2026 · github.com
Integrations
It can run in GitHub Actions through a custom action and is distributed as a Docker image.Read 8 Oct 2026 · github.com
Support
The project directs users to GitHub issues and discussions for documentation and usage questions.Read 8 Oct 2026 · github.com
Founded
2016Read 28 Sep 2026 · github.com
API coverage
It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift.Read 8 Oct 2026 · github.com
Authentication
It supports authentication headers and cookies, including dynamically obtaining tokens or cookies from a login endpoint.Read 8 Oct 2026 · github.com
Database support
For white-box testing, it can analyze SQL and MongoDB interactions and supports PostgreSQL, MySQL, H2, and MongoDB.Read 8 Oct 2026 · github.com
Fault detection
Its heuristics check for issues including HTTP 500 responses, schema mismatches, BOLA, and SQL injection, using more than 30 oracles.Read 8 Oct 2026 · github.com
Installation
The recommended install method is PyPI; the project also provides an uber-fat JAR and Docker distribution.Read 8 Oct 2026 · github.com
Known limitations
White-box testing requires a manually written driver, and EvoMaster does not yet automatically mock external services.Read 8 Oct 2026 · github.com
License and funding
The source code is released under LGPL v3 and the project reports funding from ERC and the Research Council of Norway.Read 8 Oct 2026 · github.com
Platform installers
Windows MSI, macOS DMG, and Linux DEB installers are listed as deprecated.Read 8 Oct 2026 · github.com
REST schema limits
REST APIs need an OpenAPI schema; versions 2.0, 3.0, and 3.1 are supported, while 3.2 support is on hold.Read 8 Oct 2026 · github.com
Security and privacy
The project says it has no telemetry and does not require internet services beyond the application being tested.Read 8 Oct 2026 · github.com
Test generation
It generates JUnit 4 or 5 tests in Java or Kotlin and test suites in Python or JavaScript.Read 8 Oct 2026 · github.com
Testing modes
Black-box mode can run against APIs in any programming language, while white-box mode analyzes JVM application bytecode.Read 8 Oct 2026 · github.com

Plans and prices

EvoMaster Free No monetary cost Open source · no paid external services required Read 8 Oct 2026 · github.com

Every EvoMaster plan and price →

Strong points and limits

Strong points

  • Free open-source testing tool
  • Supports REST, GraphQL, and RPC APIs
  • Generates tests in several languages
  • Uses more than 30 oracles
  • Integrates with GitHub Actions

Limits

  • REST testing requires an OpenAPI schema
  • White-box testing needs a manual driver
  • Does not automatically mock external services
  • Platform installers are deprecated

Who it suits

It suits teams generating automated API and system tests across web or enterprise applications. It fits users working with supported API styles, JVM white-box analysis, CI workflows, or self-hosted deployments.

Verdict

EvoMaster covers broad API styles, multiple generated-test languages, security-oriented fault checks, and CI deployment options without telemetry. Its schema requirement, manual white-box driver, and lack of automatic external-service mocking define the setup work.

Where Specifiction places it

Alternatives to EvoMasterAll alternatives →

Nx From $29/mo · Free plan 8.2 Visit