v2.8.0 · macOS · Linux · Windows

Test automation for systems that speak more than HTTP.

A signup goes out over HTTP, the confirmation arrives over IMAP, and the account has to land in MongoDB. You build that as one chain across thirteen protocols, group chains into a suite with setup and teardown, and the run comes back as one verdict with a JUnit report and the raw bytes still there to read. An agent can build and run the same things you can, over MCP, without ever being handed a secret.

Download v2.8.0 → Browse the library Read the docs

Started by one engineer (20+ years from core-banking to big data) who kept running out of road with the testing tools on hand and built this one, now built with a small team. The story →

HTTP · SMTP · IMAP · LDAP · DNS · SMB · Kerberos · SpamAssassin · MySQL · MongoDB · PostgreSQL · Redis · Freestyle No cloud · runs where your targets are

VirtuProbe Studio v2.8.0 More videos on YouTube

Screenshots

A quick tour of the app

Probe editor

You can see the method, the URL, the headers, the body and the response at the same time. Variables resolve when you send, so a secret never has to sit in the file, and what comes back is the status, the latency and the raw bytes.

Chain editor

Drop probes into a sequence and pass data between steps with {{variables}}. Branch on a response, loop over a list, fan out in parallel. HTTP → IMAP → LDAP in a single artefact you can replay in CI.

Credential store

Every scheme sits behind one picker, and the probe stores only which credential to use. The panel shows you which one resolved and where it came from before you send.

GraphQL

The query and the variables get an editor each, and they serialize into the request body and come back unchanged. After that you can chain it, script it or fuzz it like any other HTTP call.

MITM proxy

Drop in the CA cert, point your client at :1080, watch every flow land in the table, filtered by host, status class or method. Promote any line to a saved probe and it's part of your chain.

Proxy interception rules editor with a MOCK rule returning a synthetic response

Service virtualization

Rules are evaluated top to bottom and the first match wins, so the order is the logic. A rule that matches answers from here and the request never leaves your machine.

Script editor

A script is JavaScript or Groovy, chosen per script, and a new one starts in JavaScript. The editor highlights, completes and checks as you type, and the script drives probes through vp.send(…), then asserts on what comes back.

Agent Activity

An agent connected over MCP shows up here with the runs it starts, step by step as they happen. You approve which projects it can reach before it can change or run anything, and you can block it while it is working.

Free and paid

Three protocols free, no account, no run limits.

The free tier is a working test bench: HTTP, DNS and SMTP, request chaining, agent access over MCP, git-backed workspaces and as many runs as you like. You pay when you need the other ten protocols, the proxy, scripting, test suites or the fuzzer.

Free, forever NO ACCOUNT

✓Protocols: HTTP, DNS & SMTP (send, chain & assert on the response)
✓Agent access over MCP: point your coding agent at the workbench and let it author probes, chains and suites, run them, and read back the evidence
✓AI assistant: bring your own key, we never charge for tokens
✓No cloud, no account, no run limits: runs where your targets are
✓Directory-backed GIT workspaces: version your tests in your own repo
✓Import from everywhere: OpenAPI, Postman, Bruno, HAR, Insomnia, cURL
✓OAuth2, every flow: plus Basic, Bearer, API key & Digest
✓GraphQL requests, first-class
✓Request chaining: the output of one step feeds the next
✓Run history, diff & JSON evidence export

Paid tiers

Two tiers, sold separately. Pick the one that matches the work you do.

Engineering · for shipping integrations

→More protocols: IMAP, LDAP, MySQL/MariaDB, MongoDB, PostgreSQL & Redis (query & assert on the response)
→JavaScript and Groovy scripting: programmatic chains, loops & custom logic
→MITM proxy & service-virtualization mocks
→Enterprise & Windows auth: NTLM, PtH, SPNEGO/Kerberos, AWS SigV4
→Test suites: ordered chains with setup and teardown, one verdict, JUnit output for CI
→MCP interception: read the tool definitions and calls going past an agent's MCP server, and alter one on the way through to see whether your agent resists
→Skills: publish a chain or script under a fixed contract an agent can call

Security · for breaking them

Everything in Engineering, plus:

→Fuzzing & wordlist iterators: malformed packets, byte for byte
→Security protocols: SMB & Kerberos, for Active Directory work
→Freestyle probes: write the raw TCP or UDP exchange yourself when what you are testing has no module
→Out-of-band callback detection: catch the HTTP, DNS or SMTP callback a payload triggers, and assert on who called and when
→Pentest libraries: Active Directory, API, per-protocol packs

Students & academics: the full Security tier is free with verification. Academic License →

Testing in the age of AI

Why testing the real thing matters more in the AI era

An AI can ship an integration in an afternoon, which leaves finding out whether it works as the part that still takes time: under load, against malformed input, on the protocol that does not quite follow the spec.

A model writes the happy path well, and sending a CRLF in a header field to see what your reverse proxy does is still something you have to go and do, which is what this is for.

A code review tells you
what the code was meant to do. Running it tells you what it does, which matters more once a model wrote it.

01 · the shift

Writing the code stopped being the slow part.

Generated code ships in minutes and its bugs ship with it, at the same pace, without anybody on the team having read them closely enough to notice.

A test that exercises the running system is what tells you what shipped, and it is the part you still have to write.

Running the system is what tells you what shipped.

02 · the blind spot

A model writes the request the server expects.

Models are trained on code that works, so they generate clients that respect the spec and send the requests a server expects.

Malformed envelopes and undocumented corners of a protocol are not in that training set, and they are where production tends to break.

Adversarial input is still something a person has to think of.

03 · the workbench

We wrote the protocol stacks ourselves.

Our HTTP, SMTP, IMAP, LDAP, DNS, SMB, Kerberos and SpamAssassin are written from scratch against the RFCs, so you can send what the spec forbids, fuzz with §payload§, and see the real traffic.

A model can write the chain that claims your signup flow works, and running it against the real system is how you find out whether it does.

A model can suggest the chain, and the run against the real system settles it.

v2.8.0 · current build

Download VirtuProbe Studio.

You install it once. There is no cloud and no telemetry, a licence turns on the rest of the features, and execution stays on your machine or inside the network where your targets are.

macOS Apple Silicon macOS Intel Linux AppImage Windows x64

v2.8.0 · macOS builds are signed and notarized; SHA-256 checksums for binaries are available for other platforms.

SHA256: mac-arm64 · mac-x64 · AppImage · win-x64

The VirtuProbe Bridge extension moves a request between Burp Suite and VirtuProbe in either direction. How it works →