ClusterFuzz vs Mayhem
ClusterFuzz
google.github.io
Mayhem
mayhem.securitySide by side
| Figure | ClusterFuzz | Mayhem |
|---|---|---|
| Price from | Free | $236/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Fuzz Testing Software | 8.9 (#2) | 8.4 (#7) |
| Authentication | ClusterFuzz supports various authentication providers using Firebase. | The feature list says enterprise SSO can use SAML, OpenID, or OAuth, and enterprise customers can integrate LDAP and Active Directory. |
| Integrations | The overview lists Monorail and Jira as example issue trackers and Firebase for authentication; the architecture page says Monorail is currently the only supported bug tracker. | The homepage lists integrations for GitHub, Jenkins, GitLab, Jira, Slack, CircleCI, Azure DevOps, Google Chat, and Travis CI. |
| Support | Users can file a GitHub issue to ask questions, request features, or ask for help. | The feature list includes enterprise support, and the API plan announcement cites personalized support among paid-plan offerings. |
Plans
In their own words
ClusterFuzz
ClusterFuzz is open-source infrastructure for finding security and stability problems in software through fuzzing. It supports coverage-guided engines libFuzzer, AFL++, and Honggfuzz, alongside blackbox fuzzing. Its workflow can find crashes, group duplicates, minimize testcases, use bisection to locate regressions, and verify fixes. It can also file, triage, and close bugs automatically. Google uses ClusterFuzz across its products and as the fuzzing backend for OSS-Fuzz. The system is designed to run on clusters of any size; Google’s instance runs on 30,000 VMs. Production deployments use Google Cloud services, including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver Logging and Monitoring. Local instances are supported on Linux and macOS, with some BigQuery- and Stackdriver-dependent features disabled. Although the overview mentions Monorail and Jira as examples, the architecture currently supports only Chromium-hosted Monorail. The software runs on Linux, macOS, and Windows and is licensed under Apache-2.0. Its listed price is free.
Mayhem
Mayhem is a security platform for testing code and APIs and assessing software components in a dashboard. Its fuzzing combines AI-powered, network-aware methods with symbolic execution and triage. For code, it generates tests autonomously to find vulnerabilities and supplies a reproduction and backtrace for each defect. Mayhem for API tests for OWASP Top 10 API weaknesses and supports stateful, agentless testing. Dynamic SBOM reachability analysis helps identify which software components are on the attack surface. The platform produces vendor-neutral SARIF reports and real-time notifications, and lists integrations with tools including GitHub, Jenkins, GitLab, Jira, Slack, CircleCI, Azure DevOps, Google Chat and Travis CI. Deployment options include managed SaaS, private cloud and closed-network installation; command-line tools run on macOS, Linux and Windows. The Mayhem for API free plan allows up to 50 scans per month. Paid API plans cost $236 a month, with additional scans, enterprise features and personalized support; a 30-day trial is listed for paid plans.