WuppieFuzz
WuppieFuzz is a free, open-source REST API fuzzer built on LibAFL to look for potential errors and security flaws.
What WuppieFuzz is
WuppieFuzz is a free, open-source REST API fuzzer built on LibAFL to look for potential errors and security flaws. It generates and mutates requests from an OpenAPI specification, so users need that specification to run it. The tool supports black-box, grey-box, and white-box testing, as well as authentication and input-validation testing. Authentication documentation covers Bearer, custom, cookie, OAuth, and Web Fuzzing Commons formats. WuppieFuzz can produce endpoint coverage reports; code coverage is supported for Java, JavaScript, and Python, while code coverage reports are currently limited to JaCoCo. A Grafana dashboard can display and explore request data from a fuzzing campaign. The tool is self-hosted and runs on Linux, macOS, and Windows under the Apache 2.0 license. TNO says fuzzing data is not shared with TNO or third parties. It describes use during software development, supply-chain quality control, or penetration testing.
Good
- Supports black-box, grey-box, and white-box testing.
- Tests authentication and input validation.
- Supports several documented authentication formats.
- Runs on Linux, macOS, and Windows.
- Apache 2.0 licensed and open source.
Watch out
- Requires an OpenAPI specification.
- Code coverage reports currently support only JaCoCo.
- API discovery is not supported.
Who it suits
WuppieFuzz may suit developers, quality teams, and security testers working with APIs described by OpenAPI specifications. It is relevant to users seeking self-hosted fuzzing for development, supply-chain checks, or penetration testing.
Verdict
WuppieFuzz offers several testing modes and can report endpoint coverage, but it depends on an OpenAPI specification rather than discovering APIs. Check whether JaCoCo-only code coverage reporting fits your needs.
Plans and prices
From WuppieFuzz's own pricing page, checked 8 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| WuppieFuzz | Free | Free, open source REST API fuzzer |
| WuppieFuzz Free | Free | Open-source REST API fuzzer · self-hosted · Apache-2.0 |
The facts
Each one read from WuppieFuzz's own pages, with the date it was checked.
What it does
- API specification
- It requires an OpenAPI specification to generate and mutate requests.checked 8 Oct 2026
- Audience and uses
- TNO describes the tool as intended for a broad audience and usable during software development, supply-chain quality control, or penetration testing.checked 8 Oct 2026
- Authentication
- Authentication documentation describes Bearer, custom, cookie, OAuth, and Web Fuzzing Commons formats.checked 8 Oct 2026
- Automated harness
- The tool automates creation of the HTTP fuzzing harness, reducing manual setup work.checked 15 Oct 2026
- Black-box fallback
- Black-box testing remains available without a coverage agent, but provides less detailed feedback than line coverage.checked 15 Oct 2026
- CLI and configuration
- The command-line interface accepts an OpenAPI file, and YAML configuration files can be combined with command-line flags, with flags taking precedence.checked 15 Oct 2026
- Code coverage
- The maker says code coverage is supported for Java, JavaScript, and Python, and that adding languages is possible.checked 8 Oct 2026
- Coverage agents
- The research describes coverage agents for Java, Python and JavaScript, with a modular design intended to allow more languages.checked 15 Oct 2026
- Coverage feedback
- Scheduling can use code coverage and endpoint coverage gathered through coverage agents.checked 15 Oct 2026
- Dashboard
- A Grafana dashboard is supplied to visualize and explore fuzzing results.checked 15 Oct 2026
- Developer prerequisites
- Building from source requires build-essential, pkg-config, CMake and Rust, with OpenSSL, SQLite and Z3 system-library options documented.checked 15 Oct 2026
- Docker
- The project documents building a Docker image and running it with a mounted fuzzing directory and host networking for local targets.checked 15 Oct 2026
- Documentation depth
- The repository includes a low-level tutorial, example configurations, coverage-agent instructions and generated Rust API documentation support.checked 15 Oct 2026
- Extensibility
- The project invites contributions such as new language coverage agents and mutation techniques.checked 15 Oct 2026
- Independent registry status
- The Dutch open-source registry marks the repository status as stable and lists Linux, macOS and Windows platforms.checked 15 Oct 2026
- Independent technical description
- An ETSI workshop presentation characterizes WuppieFuzz as an open-source, LibAFL-based coverage-guided REST API fuzzer using OpenAPI response conformance and endpoint coverage.checked 15 Oct 2026
- Latest repository release
- The GitHub repository page currently presents WuppieFuzz v1.8.0.checked 15 Oct 2026
- Licence
- WuppieFuzz is distributed under the Apache-2.0 licence.checked 15 Oct 2026
- License
- WuppieFuzz is available under the Apache 2.0 license.checked 8 Oct 2026
- Limit: black-box detail
- Without a coverage agent, testing can measure endpoint coverage but cannot provide the detail of line-coverage feedback.checked 15 Oct 2026
- Limit: result minimization
- The research paper identifies automated minimization of the request sequence and parameters causing a failure as future work.checked 15 Oct 2026
- Limit: specification dependency
- The research architecture requires an OpenAPI specification describing the system under test before fuzzing can start.checked 15 Oct 2026
Where it runs
- Install platforms
- The README points users to releases or Homebrew for macOS, Windows and Linux installation.checked 15 Oct 2026
The company
- Maker founded
- LinkedIn lists TNO's founding year as 1932.checked 15 Oct 2026
Alternatives to WuppieFuzz
- 1
42Crunch API Security Platform
Free planWebAPIExtensionLinux7.9From $9 a month - 2
APISec Platform
Free planWebAPIExtensionLinux7.5From $690 a month - 3
Beagle Security
Free planWebAPI6.9From $99 a month - 4
StackHawk HawkScan
WebAPILinuxmacOS6.8From $10 a month - 5
AquilaX API Security Scanner
Free planWebAPIExtensionSelf-hosted6.7From $19 a month - 6
Parasoft SOAtest
AndroidiOSAPILinux6.7