Autonomous API testing, built for precision.
CATS reads your OpenAPI specification, resolves resource dependencies, and executes thousands of self-healing boundary, security, and stateful functional tests in seconds—with zero test code.
# 1. Install via Homebrew
$ brew tap endava/tap && brew install cats
# 2. Score contract fuzzability (0–100) and verify live connectivity
$ cats analyze -c openapi.yml
$ cats smoke -c openapi.yml -s http://localhost:8080 -H 'Authorization=$$API_AUTH'
# 3. Run stateful wave fuzzing and cluster root causes
$ cats -c openapi.yml -s http://localhost:8080 --profile ci
$ cats triage -r cats-report -c openapi.yml --verify -s http://localhost:8080From OpenAPI spec to verified fix in four commands.
Every subcommand is designed for both interactive developer workflows and machine-readable JSON (`-j`) automation.
Analyze & Smoke-Probe Your API
Inspect your contract’s 0–100 Fuzzability Readiness Score and producer-to-consumer resource chains offline, then run a 1-request-per-operation smoke probe to verify connectivity, routing, and authentication.
cats analyze -c openapi.yml
cats smoke -c openapi.yml -s http://localhost:8080Fuzz in Stateful Execution Waves
Execute 200+ fuzzers across 4 breadth-first waves (seed, coverage, crash, consistency) while automatically learning resource IDs and ETags from 2XX responses and feeding them into downstream requests.
cats -c openapi.yml -s http://localhost:8080 --profile ci
cats -c openapi.yml -s http://localhost:8080 --profile securityAuthor Declarative Functional Flows
Write stateful multi-step CRUD workflows, cross-field correlation rules, async polling assertions, and data-driven forEach matrices in minimal YAML—CATS generates the rest of every request from your schema.
cats run -c openapi.yml -s http://localhost:8080 flow.yml
cats -c openapi.yml -s http://localhost:8080 --correlations rules.ymlTriage Root Causes & Verify Fixes
Cluster failures into deduplicated root causes, auto-mine refData.yml and correlations.yml from recorded traffic, replay stateful producer chains, and verify fixes live against the server.
cats triage -r cats-report --verify -s http://localhost:8080
cats replay Test42 --stateful --export-flow flow.ymlEngineered for real-world APIs.
Compiled to a standalone GraalVM native binary with deterministic seeding, multi-content-type negotiation, and zero external runtime dependencies.
Automatic Resource Correlation
Orders root POST producers ahead of dependent endpoints, learns IDs and ETags from 2XX responses, validates candidates against target schema patterns, and defers DELETE teardown until the final wave.
Deep Schema & Constraint Fuzzing
Tests numeric and string boundaries, exclusiveMinimum/Maximum, multipleOf, minItems/maxItems, minProperties, const/not, ambiguous oneOf branches, type coercion, and Unicode normalization.
OWASP API Security Top 10
Detects SQL, NoSQL, LDAP, Command, SSTI, XXE, XSS, SSRF, and Path Traversal injections, BOLA/IDOR, readOnly and undeclared Mass Assignment, HTTP Parameter Pollution, and verb tunneling.
Cross-Field Correlations
Express conditional when/set/omit dependencies across sibling fields and arrays so both functional flows and negative fuzzers satisfy domain invariants and test conditionally required fields.
Interactive Terminal UI
Follow live wave progress, filter by result reason or response code, inspect full request/response payloads, and copy one-click curl reproducers directly from your terminal with --tui.
Built-In AI Coding Agent Skills
Install ready-made CATS skills for Devin, Claude Code, Codex, OpenCode, and Cursor with a single command (cats init --skills) to automate API auditing, fuzzing, and test authoring.