[venkatas]

Summary

• Opt-in Endava CATS (OpenAPI negative/boundary fuzz, 100+ fuzzers) via thin cats_audit.py wrapper and vikramaditya.py --cats flags — not on the default scan path.
• Complements Schemathesis (property-based) and RESTler (stateful); Apache-2.0 invoke only (not vendored).
• Parses cats-summary-report.json into summary.json + error_leads.json under findings/<host>/cats/ (HTML report at index.html).
• Docs (docs/cats.md), optional setup.sh PATH check, NOTICE attribution, .gitignore for stray cats-report/.
• No ALLOW_STATE_CHANGES / aggression default changes.

Invoke

# Install (optional)
brew tap endava/tap && brew install cats
# or CATS_BIN=/path/to/cats  /  CATS_JAR=/path/to/cats.jar

python3 cats_audit.py --contract openapi.yml --server https://api.example.com \
  --token "Bearer $TOK" --blackbox

python3 vikramaditya.py --cats openapi.yml --cats-server https://api.example.com \
  --cats-token "Bearer $TOK" --cats-blackbox

Test plan

• pytest tests/test_cats_audit.py (10 passed — resolve, argv, summary parse, mock binary)
• Manual: with cats on PATH, dry-run against a lab OpenAPI spec