Awesome Testing

The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

A modern load testing tool, using Go and JavaScript

Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.

Open-source platform for creating safe, isolated production sandboxes for API, integration, and E2E testing.

MockServer is an HTTP(S) mock server and proxy for testing that lets you mock APIs, inspect and modify live traffic, and inject failures. It supports HTTP/1.1, HTTP/2, gRPC, WebSockets, TCP and more on a single port, with additional support for HTTP/3, message brokers, and AI/LLM APIs.

Hardware testing for the software world. Real or virtual, local or remote, human, automated or agentic.

High-performance, multi-protocol mock server. HTTP, WebSocket, gRPC, MQTT, SSE, GraphQL, SOAP in one binary.

Locust Kubernetes operator: run distributed Locust load tests on Kubernetes with a LocustTest CRD. Helm chart, OpenTelemetry, OpenShift support.

Ultimate tool to measure gRPC service coverage from tests

A library that records a program's external inputs — database, HTTP, clock, randomness — and replays them, so any past run can be reproduced and debugged exactly.