atheris
A coverage-guided fuzzer for Python and Python extensions.
Decision gist · record as of 2026-08-14
Yes, if you need automated bug detection in Python code or native extensions. Atheris is actively maintained, has no known vulnerabilities, and is well-suited for security testing and robustness validation. Install friction is moderate due to compiled dependencies, but prebuilt wheels ease setup for standard Python versions. Verify the license terms before use. Not necessary for basic unit testing, but valuable for finding edge-case bugs.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.11–3.14 on Linux or macOS.
- Fuzzing native extensions requires Clang and libFuzzer; building from source may require downloading and building LLVM if your Clang version is too old.
- Medium install friction due to compiled dependencies.
License · maintenance · safety
(unclear) — License treatment is unclear; no SPDX identifier or raw license text is available in the metadata. Verify the license terms at the GitHub repository before use in proprietary or restricted-license projects.
last release 2026-06-17 (58 days) · last repo commit 2026-06-17 · 1,660 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 269,688 downloads/mo, #8,253 on PyPI
Alternatives
Verify before relying
pip install atheris
import atheris
import sys
with atheris.instrument_imports():
import sys
def TestOneInput(data):
pass
atheris.Setup(sys.argv, TestOneInput)
atheris.Fuzz()- Whether the license is compatible with your project's requirements (GitHub repo should clarify).
- Performance overhead of bytecode instrumentation on large codebases.
- Compatibility with third-party fuzzing frameworks or CI/CD systems.
What it is and what it does
Atheris is a coverage-guided fuzzer that automatically generates and mutates test inputs to find bugs in Python code and native CPython extensions. It instruments Python bytecode to track code coverage, then uses that feedback to guide libFuzzer's mutation engine toward unexplored code paths. This approach makes it effective at discovering crashes, uncaught exceptions, and undefined behavior in both pure Python and C/C++ extension code.
The fuzzer works by defining a single entry point function (TestOneInput) that accepts raw bytes, then running it repeatedly with mutated inputs. You control which code gets instrumented—via context managers, decorators, or a blanket call—and can optionally enable hooks for regex and string methods. It integrates with coverage.py for visualization and supports custom mutators for grammar-aware fuzzing of complex data formats.
Use it for
- Discover crashes and uncaught exceptions in Python code by fuzzing parsing or processing functions.
- Test native CPython extensions for memory safety bugs using Address Sanitizer or Undefined Behavior Sanitizer.
- Validate input handling in code by generating diverse, coverage-guided test cases.
- Fuzz complex data formats using custom mutators to generate valid inputs.
- Measure code coverage of fuzzing campaigns and identify untested code paths.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need automated bug detection in Python code or native extensions.
Atheris is actively maintained, has no known vulnerabilities, and is well-suited for security testing and robustness validation. Install friction is moderate due to compiled dependencies, but prebuilt wheels ease setup for standard Python versions. Verify the license terms before use. Not necessary for basic unit testing, but valuable for finding edge-case bugs.
Install
atheris on PyPI
Before you install
Medium install friction due to compiled dependencies. Prebuilt wheels are available for Python 3.11–3.14 on Linux and macOS, but fuzzing native extensions requires building from source with Clang and libFuzzer, which adds complexity. The package is actively maintained with recent releases.
Requires Python 3.11–3.14 on Linux or macOS. Fuzzing native extensions requires Clang and libFuzzer; building from source may require downloading and building LLVM if your Clang version is too old.
License in practice
License treatment is unclear; no SPDX identifier or raw license text is available in the metadata. Verify the license terms at the GitHub repository before use in proprietary or restricted-license projects.
Quickstart
pip install atheris
import atheris
import sys
with atheris.instrument_imports():
import sys
def TestOneInput(data):
pass
atheris.Setup(sys.argv, TestOneInput)
atheris.Fuzz()Verify before relying
- Whether the license is compatible with your project's requirements (GitHub repo should clarify).
- Performance overhead of bytecode instrumentation on large codebases.
- Compatibility with third-party fuzzing frameworks or CI/CD systems.
Package facts
| License | Not declared unclear |
| Python support | Not specified |
| Install friction | Medium. Platform-specific wheel |
| Runtime dependencies | None |
| Maintenance | Actively maintained 58 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 269,688 / month, #8,253 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
Evidence: atheris-3.1.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl; atheris-3.1.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl; atheris-3.1.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “python fuzzing engine”
- atherisAtheris is a coverage-guided fuzzer for Python code and native…
- dnstwistGenerates domain name permutations to detect typosquatting, phishing,…
- fuzzfetchFuzzfetch retrieves Firefox, Spidermonkey, and Thunderbird builds…
Give your agent the search over MCP, or paste the wish link into any chat.
More Quality Assurance packages
Coverage.py measures which lines of Python code are executed during test runs, reporting coverage percentages and identifying untested code paths.
Install it if you want to measure test completeness or enforce coverage thresholds in your project.
Ruff is a Python linter and code formatter written in Rust that combines linting, formatting, and code fixing into a single tool, replacing Flake8, Black, isort, and related utilities.
Pexpect spawns and controls interactive console applications by sending input and matching output patterns, automating tasks that would otherwise require manual interaction.
Black reformats Python source code to a consistent style by parsing entire files and rewriting them according to an opinionated, deterministic set of rules, eliminating manual formatting decisions.
pytest-xdist distributes pytest tests across multiple CPU cores or machines to speed up test execution, with the simplest usage being `pytest -n auto` to spawn workers equal to available CPUs.
Install it if your test suite takes long enough that parallelization would save meaningful time.
Validates AWS CloudFormation templates in YAML or JSON format against resource provider schemas and best practices, checking property values and configuration correctness.
Install it if you work with CloudFormation templates.
See also boofuzz · hypothesis · mutmut · lit · crashtest · cosmic-ray · fuzzfetch · clang-tidy · scan-build