# gosentry brings LibAFL-grade fuzzing to Go's native interface

DevFeed: [gosentry brings LibAFL-grade fuzzing to Go's native interface](<https://devfeed.tech/articles/gosentry-brings-libafl-grade-fuzzing-to-go-s-native-interface-7650.md>)

Original publisher: [Read original article](<https://blog.trailofbits.com/2026/05/12/go-fuzzing-was-missing-half-the-toolkit.-we-forked-the-toolchain-to-fix-it./>)

Author: "Kevin Valerio"

Published: 2026-05-12T11:00:00Z

Content type: article

Language: en

Sources: [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog.md>), [The Trail of Bits Blog](<https://devfeed.tech/sources/the-trail-of-bits-blog-2.md>)

Topics: [Go Language](<https://devfeed.tech/topics/go-language.md>), [C++](<https://devfeed.tech/topics/c-plus-plus.md>)

Tags: [bug](<https://devfeed.tech/tags/bug.md>), [c](<https://devfeed.tech/tags/c.md>), [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [cache](<https://devfeed.tech/tags/cache.md>), [cli](<https://devfeed.tech/tags/cli.md>), [fuzzing](<https://devfeed.tech/tags/fuzzing.md>), [go](<https://devfeed.tech/tags/go.md>), [research-practice](<https://devfeed.tech/tags/research-practice.md>), [rust](<https://devfeed.tech/tags/rust.md>), [security](<https://devfeed.tech/tags/security.md>), [testing](<https://devfeed.tech/tags/testing.md>), [tool-release](<https://devfeed.tech/tags/tool-release.md>), [toolchain](<https://devfeed.tech/tags/toolchain.md>), [tooling](<https://devfeed.tech/tags/tooling.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [workflow](<https://devfeed.tech/tags/workflow.md>)

## AI overview

Gosentry is a fuzzing-oriented fork of the Go toolchain that retains Go's native fuzzing interface while using LibAFL by default. It adds native struct fuzzing, Nautilus grammar-based fuzzing, additional bug detection, and campaign coverage reporting without requiring existing Go fuzz harnesses to be rewritten.

## Source excerpt

Go's native fuzzing is useful, but it stands far behind state-of-the-art tooling that the Rust, C, and C++ ecosystems offer with LibAFL and AFL++. Path constraints are hard to solve. Structured inputs usually need handmade parsing. It doesn't even detect several common bug classes, such as integer overflows, goroutine leaks, data races, and execution timeouts. So to make it better, we built gosentry, a fuzzing-oriented fork of the Go toolchain that keeps the standard testing.F workflow while using a stronger fuzzing stack underneath to tackle those issues. With gosentry, go test -fuzz uses LibAFL by default. It can fuzz structs natively, run grammar-based fuzzing with Nautilus, detect bug classes that it couldn't detect before, and create a fuzzing campaign coverage report in one command. If you already have Go fuzz harnesses, you don't need to rewrite them. Point them at gosentry's binary and you get all of the above through the same go test -fuzz interface, with a few new flags: ./bin/go test -fuzz=FuzzHarness --focus-on-new-code=false --catch-races=true --catch-leaks=true Figure 1: Basic gosentry usage gosentry keeps the harness API and changes the engine and the surrounding tooling -- you just tweak the CLI. You can also generate coverage reports from an existing campaign with --generate-coverage. Run it from the same package with the same -fuzz target, and no corpus path is needed; gosentry stores the campaign state under Go's fuzz cache index by package and fuzz target, so restarting the campaign resumes from the existing corpus. Why we built gosentry We started this project after we released go-panikint to improve Go fuzzing's integer overflow detection. We realized that integer overflow detection wasn't enough. Go's fuzzing ecosystem was still missing techniques that Rust, C, and C++ researchers already use every day. We often faced these gaps in our own security work using Go's vanilla fuzzer: Program comparisons (path constraints) were impossible to solve: