The request names OSS-Fuzz, so the answer is about it: it is Google's free continuous fuzzing service for open source, which a project can enroll in and drive locally, as described in the Trail of Bits action record for the ossfuzz action 111. Alternatives that cover fuzzing for other languages are cargo-fuzz for Rust and Ruzzy for Ruby 111.
- 1
Sources
- 1Trail of Bits: Security Research, Audits, and Toolstrailofbits.com · read 2026-10-29
- 11ossfuzz: declares "ossfuzz" (the record we read and signed)unfragile.ai · read 2026-10-24
Left out: Webhound, because each one's own page says it is retired or discontinued.
For agents: the 10 actions behind this answer
ossfuzz · ossfuzz verified and signed
Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh setup, the helper scripts, reproducing OSS-Fuzz crash reports, and the acceptance criteria. Use when setting up continuous fuzzing for an open-
ruff-recursive-fix · ruff-recursive-fix verified and signed
Run Ruff checks with optional scope and rule overrides, apply safe and unsafe autofixes iteratively, review each change, and resolve remaining findings with targeted edits or user decisions.
find-untested-sources · find-untested-sources verified and signed
MANDATORY for static source-to-test pairing: find or list source files/modules without corresponding tests, or suggest test locations from repository structure. Invoke even for a tiny package; do not substitute manual globbing. Uses Roslyn for C#/.NET and tree-sitter for Python, TS/JS, Go, Java, Rus
get_GetOpenPorts · Cloudflare API verified and signed
Get the Latest Scan Result
docker-project-foundations · docker-project-foundations verified and signed
Use this skill when setting up, initializing, or Dockerizing a project, even if the user doesn't explicitly mention Docker but describes a need for containerized local development, adding a database or cache dependency, or running services without host-level installs. Covers Dockerfile, compose.yaml
custom_api_call · Notion (Activepieces) verified and signed
Custom API Call — Make a custom API call to a specific endpoint
fuzzing · hypothesis verified and signed
rds-oss · rds-oss verified and signed
Advises on Amazon RDS open-source engines (MySQL, MariaDB, PostgreSQL) for instance creation, upgrade planning, commitment pricing, proxy evaluation, and Blue/Green deployments. Handles any RDS MySQL, MariaDB, or PostgreSQL question, including create a production-ready RDS MySQL instance, provision
babysit-pr · babysit-pr verified and signed
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropr
osv_get_vuln · xpsd found in code, not yet checked
Fetch the full OSV.dev record for a known vulnerability id (e.g. a CVE,
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.