genotoxic

Map each survived mutant to its containing function in a Trailmark code graph, then classify by caller count, cyclomatic complexity, and entrypoint reachability. Mutants with no callers are false positives, simple reachable functions need unit tests, and complex entrypoint-reachable functions are fuzzing targets.

Necessist removes statements from test code and re-runs tests; if a test still passes, the removed statement was unnecessary, indicating weak assertions. It supports Go, Rust, Foundry, Hardhat, Vitest, and Anchor, and findings corroborated by mutation testing are highest-confidence.

Python uses pytest-gremlins or mutmut, JavaScript/TypeScript uses Stryker, Rust uses cargo-mutants, Go uses gremlins, Java uses PITest, C/C++ uses Mull, Solidity uses slither-mutate, and Circom and Cairo use circomvent and cairo-mutants respectively.

macOS Tahoe sets an unlimited file descriptor limit by default, which crashes Mull's subprocess spawning. Run ulimit -n 1024 before any mull-runner invocation to set a bounded limit.

Choose fuzzing when the function has cyclomatic complexity above 10, is reachable from an untrusted entrypoint, has more than 10 callers, or handles parsing, deserialization, or binary protocols. Simple deterministic functions with low complexity are better served by unit tests.

Skip it when the codebase has no existing passing test suite, since mutation frameworks require a green baseline. It also adds no value for pure documentation changes or trivial single-file scripts.