Struct FuzzPlan 

pub struct FuzzPlan {
    pub iterations: u64,
    pub mode: GenMode,
    pub master_seed: u64,
    pub include: Vec<String>,
    pub exclude: Vec<String>,
    pub max_tools: Option<usize>,
    pub timeout: Duration,
    pub transport_name: String,
    pub detector: DestructiveDetector,
    pub severity: SeverityConfig,
    pub fuzz_corpus: Option<FuzzCorpus>,
    pub mutate_ratio: f64,
}

A reproducible fuzz plan.

Fields

iterations: u64

Number of payloads generated per tool.

mode: GenMode

Generation mode (Conform / Adversarial / Mixed).

master_seed: u64

Master seed used to derive per-iteration seeds. The same seed reproduces the same sequence of payloads.

include: Vec<String>

Glob patterns: empty = match every tool name.

exclude: Vec<String>

Glob patterns excluded from the fuzz set. Always honored.

max_tools: Option<usize>

Cap on the number of tools after filtering. None = unlimited.

timeout: Duration

Timeout applied to each call_tool.

transport_name: String

Transport label persisted in the ReproInfo. Plans don’t open the transport themselves, so we receive a stable name (stdio / http) from the caller.

detector: DestructiveDetector

Compiled destructive-tool detector built from [destructive] + [allow_destructive] config.

severity: SeverityConfig

[severity] overrides from wallfacer.toml. Applied to every produced finding before it lands on disk.

fuzz_corpus: Option<FuzzCorpus>

Phase R — optional persistent fuzz corpus. When set, the loop pulls inputs that triggered findings or new response fingerprints from prior runs and mutates from them mutate_ratio fraction of the time. Pure schema-driven generation handles the remainder so the fuzzer keeps exploring beyond the corpus’s basin.

mutate_ratio: f64

Phase R — fraction of iterations that mutate from the corpus instead of generating fresh schema-driven payloads. Default 0.9 matches AFL/libFuzzer convention. Ignored when Self::fuzz_corpus is None or the corpus is empty.

Implementations

impl FuzzPlan

pub async fn dry_run<C: McpExec + ?Sized>( &self, client: &C, ) -> Result<Vec<String>>

Returns the tool names that would be fuzzed, for --dry-run.

pub async fn execute<C: McpExec + ?Sized>( self, client: &mut C, corpus: &Corpus, reporter: &mut dyn Reporter, ) -> Result<FuzzReport>

Drives the full fuzz loop, persisting findings to corpus and notifying reporter along the way.

Trait Implementations

impl Debug for FuzzPlan

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.