# Endava/cats

CATS is a REST API Fuzzer and negative testing tool for OpenAPI endpoints. CATS automatically  generates, runs and reports tests with minimum configuration and no coding effort. Tests are self-healing and do not require maintenance.

Repository: https://github.com/Endava/cats
Canonical: https://ross.abutalabs.com/products/endava-cats
Language: Java
License: Apache-2.0
License Family: permissive
Topics: java, openapi, testing, api, swagger, fuzzer, rest-api, rest-fuzzer
Last push: 2026-07-24T12:18:58+00:00

## Health v2 (maintenance only)
Score: 85/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 94, release rhythm 65, longevity 100
- inputs: {"age_days": 2344, "days_push": 40, "days_rel": 154, "gap_med": 33, "n_releases_24m": 16}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1367, forks 90 (observed 2026-08-28T04:04:31.480644+00:00)

## What it is
CATS (Contract API Testing and Security) is a REST API fuzzer and negative testing tool for OpenAPI endpoints. It automatically generates, runs, and reports thousands of tests from 100+ fuzzers with no coding effort, and tests are self-healing when the OpenAPI spec changes.

## Use cases
- fuzz my REST API endpoints automatically
- generate negative tests from an OpenAPI spec
- find bugs in API contract validation
- run boundary testing on API fields and headers
- security-test OpenAPI endpoints without writing code
- catch API regressions when the swagger spec changes

## When to choose
- you have an OpenAPI/Swagger spec and want automated negative and boundary testing with zero coding
- you want self-healing API tests that adapt to spec changes
- you need broad API security and contract fuzzing coverage quickly

## When to avoid
- your API has no OpenAPI specification
- you need highly customized, hand-written integration or E2E test scenarios
- you are testing GraphQL, gRPC, or non-REST protocols

## Facets
- artifact type: cli-tool
- maturity: active
- function: testing, fuzzing, e2e-testing, security, cli
- domain: testing, apis, security, developer-tools
- platform: cli, cross-platform, jvm, windows
- tags: openapi, rest-api, negative-testing, api-fuzzing, contract-testing, swagger, java, graalvm, command-line, linux, macos

## Member repositories
- Endava/cats (main) score 85

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:31.480644+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:41:05.552494+00:00, confidence not recorded.
  - readme: https://github.com/Endava/cats (fetched 2026-08-28T04:04:31.480644+00:00, sha 2ea0c6c6726b)
- Data as of 2026-08-30T08:39:29.467469+00:00.