Skip to content
SPECIFICTION
Get listed

WuppieFuzz

github.com

Free plan Open source WindowsmacOSLinuxAPISelf-hosted
Visit github.com
Spec score 8.2 #8 of 27 in API Security Testing Software

What it is

WuppieFuzz is a free, open-source, self-hosted REST API fuzzer built on LibAFL. It generates and mutates requests from an OpenAPI specification to seek potential errors and security flaws. Black-box, grey-box, and white-box testing are supported, along with authentication and input-validation testing. Authentication formats include Bearer, custom, cookie, OAuth, and Web Fuzzing Commons. Code coverage is supported for Java, JavaScript, and Python, while code coverage reports currently support JaCoCo. The tool can produce endpoint coverage reports, and a Grafana dashboard can visualize request information from a fuzzing campaign. It runs on Windows, macOS, and Linux and uses the Apache 2.0 license. TNO says fuzzing data is not shared with TNO or third parties. The tool is described for software development, supply-chain quality control, or penetration testing. WuppieFuzz requires an OpenAPI document in JSON or YAML to generate requests, and API discovery is not supported. Its plan costs nothing.

Spec sheet

What it does
WuppieFuzz is a coverage-guided REST API fuzzer built on LibAFL.Read 15 Oct 2026 · github.com
Purpose
WuppieFuzz is a coverage-guided REST API fuzzer built on LibAFL to find potential errors and security flaws.Read 8 Oct 2026 · github.com
Platforms
The project README lists quick installation for macOS, Windows, and Linux, and also documents Docker use.Read 8 Oct 2026 · github.com
Privacy
TNO states that fuzzing data is not shared with TNO or third parties.Read 8 Oct 2026 · tno.nl
Support
TNO invites users to contact it for help, ideas, or information about automated reliability and security testing tools.Read 8 Oct 2026 · tno.nl
License
WuppieFuzz is available under the Apache 2.0 license.Read 8 Oct 2026 · github.com
API specification
It requires an OpenAPI specification to generate and mutate requests.Read 8 Oct 2026 · github.com
Audience and uses
TNO describes the tool as intended for a broad audience and usable during software development, supply-chain quality control, or penetration testing.Read 8 Oct 2026 · tno.nl
Authentication
Authentication documentation describes Bearer, custom, cookie, OAuth, and Web Fuzzing Commons formats.Read 8 Oct 2026 · github.com
Automated harness
The tool automates creation of the HTTP fuzzing harness, reducing manual setup work.Read 15 Oct 2026 · arxiv.org
Black-box fallback
Black-box testing remains available without a coverage agent, but provides less detailed feedback than line coverage.Read 15 Oct 2026 · researchgate.net
CLI and configuration
The command-line interface accepts an OpenAPI file, and YAML configuration files can be combined with command-line flags, with flags taking precedence.Read 15 Oct 2026 · github.com
Code coverage
The maker says code coverage is supported for Java, JavaScript, and Python, and that adding languages is possible.Read 8 Oct 2026 · tno.nl
Coverage agents
The research describes coverage agents for Java, Python and JavaScript, with a modular design intended to allow more languages.Read 15 Oct 2026 · researchgate.net
Coverage feedback
Scheduling can use code coverage and endpoint coverage gathered through coverage agents.Read 15 Oct 2026 · researchgate.net
Dashboard
A Grafana dashboard is supplied to visualize and explore fuzzing results.Read 15 Oct 2026 · github.com
Developer prerequisites
Building from source requires build-essential, pkg-config, CMake and Rust, with OpenSSL, SQLite and Z3 system-library options documented.Read 15 Oct 2026 · github.com
Docker
The project documents building a Docker image and running it with a mounted fuzzing directory and host networking for local targets.Read 15 Oct 2026 · github.com
Documentation depth
The repository includes a low-level tutorial, example configurations, coverage-agent instructions and generated Rust API documentation support.Read 15 Oct 2026 · github.com
Extensibility
The project invites contributions such as new language coverage agents and mutation techniques.Read 15 Oct 2026 · tno.nl
Independent registry status
The Dutch open-source registry marks the repository status as stable and lists Linux, macOS and Windows platforms.Read 15 Oct 2026 · oss.developer.overheid.nl
Independent technical description
An ETSI workshop presentation characterizes WuppieFuzz as an open-source, LibAFL-based coverage-guided REST API fuzzer using OpenAPI response conformance and endpoint coverage.Read 15 Oct 2026 · docbox.etsi.org
Install platforms
The README points users to releases or Homebrew for macOS, Windows and Linux installation.Read 15 Oct 2026 · github.com
Latest repository release
The GitHub repository page currently presents WuppieFuzz v1.8.0.Read 15 Oct 2026 · github.com
Licence
WuppieFuzz is distributed under the Apache-2.0 licence.Read 15 Oct 2026 · github.com
Limit: black-box detail
Without a coverage agent, testing can measure endpoint coverage but cannot provide the detail of line-coverage feedback.Read 15 Oct 2026 · researchgate.net
Limit: result minimization
The research paper identifies automated minimization of the request sequence and parameters causing a failure as future work.Read 15 Oct 2026 · researchgate.net
Limit: specification dependency
The research architecture requires an OpenAPI specification describing the system under test before fuzzing can start.Read 15 Oct 2026 · researchgate.net
Maker founded
LinkedIn lists TNO's founding year as 1932.Read 15 Oct 2026 · linkedin.com
Maker headquarters
LinkedIn lists TNO headquarters at postal code 2595 DA in The Hague, Netherlands.Read 15 Oct 2026 · linkedin.com
Maker identity
The GitHub organisation identifies WuppieFuzz as a project of TNO's Software and System Security Expertise group.Read 15 Oct 2026 · github.com
Maker legal profile
LinkedIn lists TNO as a nonprofit research-services organisation with 1,001–5,000 employees.Read 15 Oct 2026 · linkedin.com
Notable limitation
The README says code coverage reporting is currently supported only for JaCoCo.Read 8 Oct 2026 · github.com
Notable news
TNO announced its new REST API fuzzer on 15 October 2024 and presented it as easier to configure and interpret through a dashboard.Read 15 Oct 2026 · tno.nl
OpenAPI input
It requires an OpenAPI specification to generate and mutate HTTP requests.Read 15 Oct 2026 · github.com
Praise: government developer portal
The Dutch government developer portal describes WuppieFuzz as usable, modular and focused on identifying vulnerabilities, sequential bugs and specification deviations.Read 15 Oct 2026 · developer.overheid.nl
Praise: open-source registry
The Dutch government open-source registry credits automatic request generation, mutation and detection of server errors, crashes and security-relevant edge cases.Read 15 Oct 2026 · oss.developer.overheid.nl
Privacy statement
TNO states that fuzzing data is not shared with TNO or third parties.Read 15 Oct 2026 · tno.nl
Reports
The README distinguishes endpoint-coverage reports from code-coverage reports and stores campaign request data in a database.Read 15 Oct 2026 · github.com
Request mutation
Specification-aware mutators can alter individual requests, request sequences and relationships between parameters and responses.Read 15 Oct 2026 · researchgate.net
Research evaluation
The published study evaluated WuppieFuzz on the Petstore API and monitored endpoint and code coverage over time.Read 15 Oct 2026 · arxiv.org
Response checking
Its response checker compares returned responses with the OpenAPI specification and can flag unexpected server-status responses.Read 15 Oct 2026 · researchgate.net
Security purpose
TNO positions the fuzzer for finding REST API bugs, errors and vulnerabilities through automated fuzzing and coverage measurements.Read 15 Oct 2026 · nordicapis.com
Stateful sequences
The research paper says WuppieFuzz generates and mutates sequences of related API requests to reach deeper application states.Read 15 Oct 2026 · arxiv.org
Supported code report
The README says code-coverage report generation currently supports JaCoCo, while more formats are planned.Read 15 Oct 2026 · github.com
Testing modes
The project supports black-box, grey-box and white-box testing.Read 15 Oct 2026 · github.com

Plans and prices

WuppieFuzz Free Free, open source REST API fuzzer Read 8 Oct 2026 · tno.nl
WuppieFuzz Free Free Open-source REST API fuzzer · self-hosted · Apache-2.0 Read 15 Oct 2026 · tno.nl

Every WuppieFuzz plan and price →

Strong points and limits

Strong points

  • Free and open source under Apache 2.0
  • Supports black-box, grey-box, and white-box testing
  • Covers several authentication formats
  • Runs on Windows, macOS, and Linux
  • Grafana dashboard explores campaign request data

Limits

  • Requires an OpenAPI specification
  • API discovery is not supported
  • Code coverage reports currently support only JaCoCo
  • Deployment is self-hosted

Who it suits

WuppieFuzz suits teams testing REST APIs in their own environment during development, supply-chain quality control, or penetration testing. It is relevant when an OpenAPI specification is available.

Verdict

WuppieFuzz provides broad fuzzing modes, authentication handling, coverage information, and self-hosted operation at no cost. Its OpenAPI requirement and current JaCoCo reporting limit should match your testing workflow.

Where Specifiction places it

Alternatives to WuppieFuzzAll alternatives →