displacement: drive fuzzing primitives with schemathesis under the adversarial loop #31

New issue

Closed

opened 2026-06-17 08:26:19 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-17 08:26:19 +00:00

Owner

Displacement: drive the fuzzing layer with schemathesis, keep the adversarial loop

From the 2026-06-17 displacement scout.

gauntlet's novel core - the two-role attacker/inspector adversarial MCP loop, role discipline, and holdout evaluation - is worth keeping custom. But the request-generation / API-fuzzing PRIMITIVES underneath overlap mature OSS:

schemathesis - property-based, OpenAPI/GraphQL-schema-driven, strong at semantic errors. Actively maintained 2026.
MS RESTler - stateful (infers request dependency grammar), strong at server errors / deeper coverage.

Action (design call, not mechanical)

Evaluate driving gauntlet's execution stage with schemathesis as the payload/case generator instead of hand-rolled request mutation, with the attacker/inspector loop orchestrating on top.
schemathesis fits the property-based angle; RESTler if stateful dependency coverage matters more.

Keep custom

The MCP role discipline, iteration/holdout records, and the adversarial loop itself.

Caution

New dependency - run tooling-supply-chain-audit + pin before adopting.

## Displacement: drive the fuzzing layer with schemathesis, keep the adversarial loop From the 2026-06-17 displacement scout. gauntlet's novel core - the two-role attacker/inspector adversarial MCP loop, role discipline, and holdout evaluation - is worth keeping custom. But the request-generation / API-fuzzing PRIMITIVES underneath overlap mature OSS: - [`schemathesis`](https://github.com/schemathesis/schemathesis) - property-based, OpenAPI/GraphQL-schema-driven, strong at semantic errors. Actively maintained 2026. - MS [`RESTler`](https://github.com/microsoft/restler-fuzzer) - stateful (infers request dependency grammar), strong at server errors / deeper coverage. ### Action (design call, not mechanical) - Evaluate driving gauntlet's execution stage with schemathesis as the payload/case generator instead of hand-rolled request mutation, with the attacker/inspector loop orchestrating on top. - schemathesis fits the property-based angle; RESTler if stateful dependency coverage matters more. ### Keep custom The MCP role discipline, iteration/holdout records, and the adversarial loop itself. ### Caution New dependency - run `tooling-supply-chain-audit` + pin before adopting.

coilysiren added the

label

2026-06-17 09:23:28 +00:00

coilysiren commented

2026-06-17 18:52:36 +00:00

Author

Owner

Closing. gauntlet is archived in the June 2026 surface reduction.

coilysiren closed this issue

2026-06-17 18:52:36 +00:00

Commenting is not possible because the repository is archived.