Show HN: Mist – a tool pairing SAST and Fuzzing for smarter Bug Hunting

Smoothly transform static analysis findings into tailored fuzzing campaigns.

MIST orchestrates the vulnerability analysis workflow, standardizing and automating the steps unifying SAST and DAST, so that you can focus on security reasoning while it takes care of the analysis pipeline.

For developers.

MIST can be employed as a light, modular and extensible Python framework, to create new plugins and standalone tools. The whole project is realeased under the Apache License 2.0, and its source code is freely available to inspect, study, modify, extend, and build upon, encouraging experimentation and further development.

git clone https://github.com/alessandroPalazzolo/mist.git cd mist

MIST can run both as a local installation or in a Docker container.

The local installation supports all features and is recommended for more in-depth and advanced use. However, when dealing with fuzz testing, some operations may directly affect the host system, so additional care is required.

Some additional tweaking might be required based on your system configuration.

The containerized version provides complete isolation from the host system, making it the safest option while providing a ready-to-use environment. Nonetheless, as documented in the relevant section, some features may be limited or behave differently due to Docker's isolation mechanisms. Docker is therefore recommended for testing MIST or trying it for the first time.

Below are the steps required for the local installation. See the Docker section to run MIST in a container.

Create and activate a virtual environment (unless you want a global install):

python3 -m venv .venv source .venv/bin/activate

Install the python3 mist wheel with dependencies:

pip install -e .

AFLGo

Mist leverages AFLGo directed greybox fuzzer for DAST. See more at https://github.com/aflgo/aflgo.

AFLGo build script will attempt to apply modifications on your host system, potentially affecting your existing compiler toolchain. The AFLGo documentation explains each action taken in depth, still, if you don't feel confident with it you might want to check the Docker installation.

cd AFLGo sudo ./build.sh cd ..

You ideally only need this to make AFLGo work. If you encounter any issue refer to the official documentation for better support.

MIST only works with a slightly modified version of AFLGo, see more at THIRD_PARTY_NOTICES. You can provide a custom AFLGo version, but should only apply your edits on the one shipping with MIST.

if you don't wish to use a global custom semgrep installation you can skip this step.

MIST employs Semgrep capabilities for efficient SAST. See more at https://docs.semgrep.dev.

Semgrep conveniently exposes a python package that can be installed with pip install semgrep, for this reason it is already included as a mist wheel dependency and should be locally installed.

If you wish to use a global semgrep installation you need to run:

pipx install semgrep

then proceed to edit your $PATH accordingly, so that mist sees it first.

You can now start exploring MIST by simply typing:

mist

Run MIST with Docker

Seamlessly build and run MIST using Docker Compose.

Assuming that you are in the mist/ root directory, run:

H_WORKSPACE=<path-to-host-workspace> docker compose run --rm mist

Replace <path-to-host-workspace> with the path to the host directory containing the systems you want to test (SUTs), this will bind it to the container.

If it's the first time you run it, Docker Compose will pull and build all the required assets (this might take a few minutes). After that, it will automatically start the container with mist running inside of it. You can use again the same command every time you want to start MIST.

Some MIST features may be limited or behave differently in Docker.

High performance fuzzing: MIST optionally leverages the afl-system-config script to reconfigure the host system to a high performance fuzzing state. The script requires elevated privileges and performs host-level system configurations, making it not suitable for a Docker container environment.

Split view of AFLGo and MIST Monitor UIs: during fuzz time, by default, MIST launches afl-fuzz in a separate terminal window to provide its interactive UI alongside the MIST Monitor one. This functionality is not supported in Docker containers, resulting in a less informative runtime that can only show MIST relevant metrics.

If you wish to get more insights on the fuzzer runtime you can access the /<path-to-SUT>/obj-aflgo/out/fuzzer_stats host file, with SUT being your current system under test.

Once installed, you can check if your MIST instance correctly works by testing it on a simple default SUT.

The SUT is provided in the test-system directory. Inside you'll find additional documentation on how to proceed.

Start your MIST instance and set your SUT to ./test-system. The wizard will then guide you through the next steps.

AFLGo/ is the aflgo source directory.

mist/ is the MIST source directory.

test-system/ contains the default system for testing MIST.

testcases/ contains a multitude of file samples used for fuzzing.

.gitattributes

.gitignore

Dockerfile is the Docker configuration file for running MIST in a container.

LICENSE.txt is the Apache 2.0 license file.

README.md

THIRD_PARTY_NOTICES.md keeps a log of included third-party packages with their related MIST modifications.

compose.yaml is the Docker compose configuration file.

pyproject.toml is the python configuration file used to install MIST sources.

logo.png is MIST logo.

License

Copyright © 2026 Alessandro Palazzolo.

MIST is distributed under the Apache License 2.0.