ClusterFuzz vs EvoMaster

ClusterFuzz is open-source infrastructure for finding security and stability problems in software through fuzzing. It supports coverage-guided engines libFuzzer, AFL++, and Honggfuzz, alongside blackbox fuzzing. Its workflow can find crashes, group duplicates, minimize testcases, use bisection to locate regressions, and verify fixes. It can also file, triage, and close bugs automatically. Google uses ClusterFuzz across its products and as the fuzzing backend for OSS-Fuzz. The system is designed to run on clusters of any size; Google’s instance runs on 30,000 VMs. Production deployments use Google Cloud services, including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver Logging and Monitoring. Local instances are supported on Linux and macOS, with some BigQuery- and Stackdriver-dependent features disabled. Although the overview mentions Monorail and Jira as examples, the architecture currently supports only Chromium-hosted Monorail. The software runs on Linux, macOS, and Windows and is licensed under Apache-2.0. Its listed price is free.

EvoMaster automatically generates system-level tests for web and enterprise applications by fuzzing APIs. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift. Black-box testing works across implementation languages; white-box testing is available for APIs compiled to the JVM, such as Java and Kotlin. The tool evolves test cases using evolutionary algorithms, dynamic program analysis, and AI heuristics to improve measures such as code coverage and fault detection. Its project describes more than 30 fault-detection oracles, covering issues such as HTTP status problems, schema mismatches, BOLA, and SQL injection. Generated results can include JUnit 4 or 5 tests in Java or Kotlin, Python or JavaScript test suites, and an interactive HTML report by default. White-box testing supports PostgreSQL, MySQL, H2, and MongoDB communications and can generate database initialization. Authentication headers and cookies are supported, as is dynamic credential retrieval through configured login endpoints. EvoMaster is free, has no telemetry, and says it needs no external internet services beyond the application under test. It can run on Linux, macOS, Windows, or self-hosted; PyPI is the recommended installation route, with a JAR and Docker image also available.