Trail of Bits Releases MuTON and mewt Mutation Testing Tools for Agentic AI Era
Trail of Bits announced MuTON and mewt, two new mutation testing tools optimized for agentic use, along with a configuration optimization skill to help AI agents set up campaigns efficiently.
Trail of Bits has released MuTON and mewt, two new mutation testing tools designed for the agentic era, along with a configuration optimization skill to help AI agents set up campaigns efficiently. The tools aim to address limitations of earlier mutation testing tools like universalmutator and slither-mutate, improving speed and prioritization. Mutation testing systematically introduces bugs (mutants) and checks if tests catch them, flagging insufficiently tested code.
MuTON provides first-class support for TON blockchain languages (FunC, Tolk, and Tact), while mewt is the language-agnostic core that also supports Solidity, Rust, Go, and more. Both tools are built on Tree-sitter, a parser that powers syntax highlighting in modern editors, enabling them to handle multi-line statements gracefully and target expressions like if-statements in a well-structured way. This contrasts with earlier regex-based tools like universalmutator, which struggled with multi-line mutations and lacked mutant prioritization.
The new tools store all mutants and test results in a SQLite database, a quality-of-life improvement that allows campaigns to be paused and resumed without losing progress. Results persist across sessions, and flexible filtering and formatting options enable users to print only uncaught mutants in specific files or translate results to SARIF for improved review. This flexibility helps both humans and AI agents explore results, triage findings, and hunt for bugs.
Trail of Bits highlighted that mutation testing uncovered a high-severity Arkis protocol vulnerability that was overlooked by coverage metrics, demonstrating the technique's value. The company has been deploying slither-mutate across most Solidity audits since late 2022, but its tight coupling to Solidity limited support for other languages. MuTON and mewt overcome this by using Tree-sitter, which allows easy extension to new languages with the help of AI agents.
The configuration optimization skill helps AI agents set up mutation testing campaigns efficiently, reducing the time needed to configure tools for specific codebases. This is part of a broader trend toward agentic AI in cybersecurity, where autonomous agents perform tasks like vulnerability discovery and testing.
The release of MuTON and mewt marks a significant step forward in mutation testing for blockchain and other languages, offering faster, more flexible, and more persistent testing capabilities. As software development increasingly relies on AI agents, tools like these will be critical for ensuring code quality and security.