mcpField
7
703-technologies-fuzzing-testing

703-technologies-fuzzing-testing

github.com/jabrenaTesting & quality456288 installsUpdated 1d ago
Repository

About 703-technologies-fuzzing-testing

A skill for contract-driven fuzz testing of Java HTTP APIs with CATS and OpenAPI. It guides developers through negative and boundary testing, local and CI workflows, and finding triage, with trusted-tooling and build-verification safeguards.

Key features

  1. 01CATS setup for OpenAPI fuzzing
  2. 02Negative tests for invalid and malformed inputs
  3. 03Boundary checks for size, range, and format
  4. 04Local and CI workflow guidance
  5. 05Finding reports and triage practices

Use cases

  1. 01Fuzz-test a Java API from its OpenAPI contract
  2. 02Add malformed-input checks to CI
  3. 03Test API boundary and enum constraints
  4. 04Reproduce and triage fuzzing findings

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/jabrena/plinth --skill 703-technologies-fuzzing-testing

After installing, type/703-technologies-fuzzing-testingin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

assets/
cats.dockerfile
references/
703-technologies-fuzzing-testing.md
scripts/
run-cats-fuzz.sh

Details

From the project README

Java fuzz testing with CATS

Design and implement contract-driven fuzz testing for Java APIs using CATS to uncover edge cases and input-validation defects early.

What is covered in this Skill?

  • CATS setup using a trusted local jar or prebuilt image and baseline command usage for OpenAPI-driven fuzzing
  • Negative testing strategy for invalid payloads, missing fields, wrong types, and malformed values
  • Boundary testing for size, range, format, and enum constraints
  • CI integration patterns with actionable logs and reproducible failures
  • Local execution workflow for contributors before opening pull requests
  • Reporting and triage practices for fuzzing findings

Scope: Focus on HTTP API fuzzing and contract validation with CATS. Use this skill to define practical, repeatable checks in both local and CI workflows.

Constraints

Before applying any fuzz testing changes, ensure the project compiles. If compilation fails, stop immediately. After implementation, regenerate skills and run verification.

  • MANDATORY: Run ./mvnw compile or mvn compile before applying any change
  • SAFETY: If compilation fails, stop immediately and do not proceed
  • VERIFY: Run ./mvnw clean verify or mvn clean verify after applying improvements
  • SUPPLY CHAIN: Use only a verified local cats/cats.jar or an approved prebuilt image; generated artifacts must depend only on trusted local or approved image inputs
  • BEFORE APPLYING: Read the reference for detailed examples, good/bad patterns, and constraints
  • EDGE CASE: If request scope is ambiguous, stop and ask a clarifying question before applying changes
  • EDGE CASE: If required inputs, files, or tooling are missing, report what is missing and ask whether to proceed with setup guidance

When to use this skill

  • Add fuzz testing to a Java project
  • Use CATS for API negative testing
  • Review CI quality gates for API contract robustness
  • Improve boundary and malformed input test coverage
  • Run CATS fuzz tests against an OpenAPI contract

Workflow

  1. Read reference and assess project context

Read references/703-technologies-fuzzing-testing.md and inspect current API/context artifacts before proposing changes.

  1. Gather scope and decide target improvements

Identify requested outcomes, constraints, and the minimum safe set of changes to apply.

  1. Apply technology-aligned changes

Implement or refactor artifacts following the reference patterns and project conventions.

  1. Run verification and report results

Execute appropriate checks and summarize what changed, what was verified, and any follow-up actions.

Reference

For detailed guidance, examples, and constraints, see references/703-technologies-fuzzing-testing.md.

Comments

Markdown supported