Endava

cats

Java2020–2026

Endava / cats

cats

CATS is a REST API Fuzzer and negative testing tool for OpenAPI endpoints. CATS automatically generates, runs and reports tests with minimum configuration and no coding effort. Tests are self-healing and do not require maintenance.

Web Development Testing & Quality

Explore on GitHub Read Hacker News discussions

2Distinct people

23Mentions

0Explicit recommenders

1.4KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year23 dated mentions

Observed mentions: 2020-04-06 17:06:56 UTC to 2026-09-14 13:47:37 UTC.

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2020	2020-01-01 00:00:00 UTC	2021-01-01 00:00:00 UTC	4	4	0
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	5	3	2
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	7	2	5
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	3	1	2
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	2	0	2
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	1	0	1
2026 (partial)	2026-01-01 00:00:00 UTC	2027-01-01 00:00:00 UTC	1	0	1

What Hacker News says

23 sources

ludovicianul·Sep 14, 2026

Working on a words game: https://hilogame.cc and planning to release 2-3 more that, if they get traction, will live under a single umbrella in the future. Additionally, I'm building a REST API fuzzer: https://github.com/Endava/cats

In Ask HN: What are you working on? (September 2026)

ludovicianul·Jan 20, 2025

An API fuzzer I've been building for several years now: https://github.com/Endava/cats

In The Fuzzing Book

ludovicianul·Sep 13, 2024

I've followed similar approach for building a REST API fuzzer for the past 3 years: https://github.com/Endava/cats. Fuzz testing is still not widely adopted considering the obvious benefits and usually minimum setup time. Even if it's java, getting it to native code was a must, so I had to rewrite it from spring to quarkus to get native image compilation out of the box. And focus on the performance bit to be able to run large number of mutation even for large json payloads. Quite a journey.

In Build Simple Fuzzer (2020)

ludovicianul·Mar 8, 2024

Rest API fuzzing with minimal configuration: https://github.com/Endava/cats

In Ask HN: What underrated open source project deserves more recognition?

ludovicianul·Oct 20, 2023Submission

Yet Another REST API Fuzzer

1 points · Open discussion

ludovicianul·Jul 13, 2023

Out of this frustration I've built: https://github.com/Endava/cats. It's for APIs, but mostly addressing exactly this case: don't use strings for everything, if you choose to use it though, make sure you add patterns for checking if things are valid, make sure you think about all the corner cases and all the weird characters that can brake you app, and so on.

In CWE Top Most Dangerous Software Weaknesses

ludovicianul·Mar 3, 2023

This is why we need better tools which will give benefits for the added complexity. If you need to create both the feature files AND the code, it's just complexity with little benefits. But frameworks like https://github.com/karatelabs/karate or https://github.com/Endava/cats are hiding this complexity and remove the code layer entirely. Which, in my view, this is where you need to be in 2023, particularly for API testing.

In Cucumber maintainer has been laid off

ludovicianul·Dec 5, 2022

I've built a tool specifically to test if these kind of characters will reach API backends: https://github.com/Endava/cats. My idea was that APIs should explicitly reject or sanitise input containing such characters.

In Invisible Characters

ludovicianul·Oct 11, 2022Submission

REST API fuzzer with minimum configuration

1 points · Open discussion

asicsp·May 26, 2022

These might help: * https://github.com/Endava/cats * https://github.com/google/oss-fuzz

In Learnings from 5 years of tech startup code audits

ludovicianul·May 13, 2022

Here you go: https://github.com/Endava/cats

In Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs

ludovicianul·May 13, 2022

This is great :) You can then fuzz your APIs for issues using https://github.com/Endava/cats.

In Show HN: Mitmproxy2swagger – Automagically reverse-engineer REST APIs

ludovicianul·Mar 9, 2022Submission

Harden Your REST APIs with this OpenAPI Fuzzer

2 points · Open discussion

ludovicianul·Feb 16, 2022

I've written an API Fuzzer that (among other things) tests specifically for things like this: https://github.com/Endava/cats (with a lot more other unicode special chars). People many times forget how big the Unicode standard is and that a lot of Control Characters are used by different processors for specific logic not-very-obvious logic.

In How can you be fooled by the U+202E trick? (2013)

ludovicianul·Dec 21, 2021Submission

Show HN: OpenAPI Fuzzer written in Java, compiled to native code

1 points · Open discussion

Showing the 15 most recent of 23 sources. Enable JavaScript to search and browse every indexed mention.