Mayhem vs Schemathesis
Mayhem
mayhem.securitySchemathesis
schemathesis.ioSide by side
| Figure | Mayhem | Schemathesis |
|---|---|---|
| Price from | $236/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 1 |
| Spec score · Fuzz Testing Software | 8.4 (#7) | 7.5 (#16) |
| Authentication | The feature list says enterprise SSO can use SAML, OpenID, or OAuth, and enterprise customers can integrate LDAP and Active Directory. | It supports Bearer tokens, Basic authentication, and API keys, with environment variable substitution and Python hooks for dynamic flows. |
| Integrations | The homepage lists integrations for GitHub, Jenkins, GitLab, Jira, Slack, CircleCI, Azure DevOps, Google Chat, and Travis CI. | The maker lists a GitHub Action, Docker image, pip or uvx installation, and pytest integration. |
| Support | The feature list includes enterprise support, and the API plan announcement cites personalized support among paid-plan offerings. | The maker directs users to Discord for technical support, configuration questions, bug reports, and integration examples. |
Plans
In their own words
Mayhem
Mayhem is a security platform for testing code and APIs and assessing software components in a dashboard. Its fuzzing combines AI-powered, network-aware methods with symbolic execution and triage. For code, it generates tests autonomously to find vulnerabilities and supplies a reproduction and backtrace for each defect. Mayhem for API tests for OWASP Top 10 API weaknesses and supports stateful, agentless testing. Dynamic SBOM reachability analysis helps identify which software components are on the attack surface. The platform produces vendor-neutral SARIF reports and real-time notifications, and lists integrations with tools including GitHub, Jenkins, GitLab, Jira, Slack, CircleCI, Azure DevOps, Google Chat and Travis CI. Deployment options include managed SaaS, private cloud and closed-network installation; command-line tools run on macOS, Linux and Windows. The Mayhem for API free plan allows up to 50 scans per month. Paid API plans cost $236 a month, with additional scans, enterprise features and personalized support; a 30-day trial is listed for paid plans.
Schemathesis
Schemathesis generates property-based tests from OpenAPI and GraphQL schemas to help engineers find API bugs. Its cases probe boundary values, type mismatches and constraint violations, and it validates API responses against the OpenAPI specification. For multi-step workflows, it chains operations using links inferred from a schema. During a run, it can learn validation rules, resource IDs and authentication requirements from server responses, then reuse them. Users can add Python checks for business rules alongside built-in checks. It supports OpenAPI 2.0, 3.0, 3.1 and 3.2, plus GraphQL schemas. Authentication options include Bearer tokens, Basic authentication and API keys, with environment variable substitution and Python hooks for dynamic flows. Integrations include a GitHub Action, Docker image, pip or uvx installation, and pytest. Reports can be exported as JUnit, VCR, HAR, NDJSON, JSON or Allure; failures can also be saved with curl commands for replay. The tool is self-hosted and licensed under MIT.