EvoMaster vs Mayhem
EvoMaster
github.com
Mayhem
mayhem.securitySide by side
| Figure | EvoMaster | Mayhem |
|---|---|---|
| Price from | Free | $236/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Fuzz Testing Software | 8.3 (#8) | 8.4 (#7) |
| Authentication | It supports authentication headers and cookies, including dynamically obtaining tokens or cookies from a login endpoint. | The feature list says enterprise SSO can use SAML, OpenID, or OAuth, and enterprise customers can integrate LDAP and Active Directory. |
| Founded | 2016 | 2012 |
| Integrations | It can run in GitHub Actions through a custom action and is distributed as a Docker image. | The homepage lists integrations for GitHub, Jenkins, GitLab, Jira, Slack, CircleCI, Azure DevOps, Google Chat, and Travis CI. |
| Support | The project directs users to GitHub issues and discussions for documentation and usage questions. | The feature list includes enterprise support, and the API plan announcement cites personalized support among paid-plan offerings. |
Plans
In their own words
EvoMaster
EvoMaster is a free, open-source tool that uses fuzzing to generate system-level tests for web and enterprise applications. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift. Black-box mode works with APIs in any programming language, while white-box mode analyzes JVM bytecode. Generated tests can be JUnit 4 or 5 in Java or Kotlin, or suites in Python or JavaScript. More than 30 oracles check issues including HTTP 500 responses, schema mismatches, BOLA, and SQL injection. White-box testing can analyze SQL and MongoDB interactions with PostgreSQL, MySQL, H2, and MongoDB support. Authentication accepts headers and cookies, including tokens or cookies obtained from a login endpoint. REST testing requires OpenAPI 2.0, 3.0, or 3.1. PyPI is the recommended installation route, with Docker and an uber-fat JAR also available. EvoMaster runs on Linux, macOS, Windows, and self-hosted environments, and integrates with GitHub Actions through a custom action.
Mayhem
Mayhem is a security platform for testing code and APIs and assessing software components in a dashboard. Its fuzzing combines AI-powered, network-aware methods with symbolic execution and triage. For code, it generates tests autonomously to find vulnerabilities and supplies a reproduction and backtrace for each defect. Mayhem for API tests for OWASP Top 10 API weaknesses and supports stateful, agentless testing. Dynamic SBOM reachability analysis helps identify which software components are on the attack surface. The platform produces vendor-neutral SARIF reports and real-time notifications, and lists integrations with tools including GitHub, Jenkins, GitLab, Jira, Slack, CircleCI, Azure DevOps, Google Chat and Travis CI. Deployment options include managed SaaS, private cloud and closed-network installation; command-line tools run on macOS, Linux and Windows. The Mayhem for API free plan allows up to 50 scans per month. Paid API plans cost $236 a month, with additional scans, enterprise features and personalized support; a 30-day trial is listed for paid plans.