v3.0.2 · 16 protocols · security fixes after the Mythos audit · JavaScript scripting

The test automation workbench for you and the agents you supervise.

A signup goes out over HTTP, the confirmation arrives over IMAP, and the account has to land in MongoDB. You build that as one chain across sixteen protocols, group chains into a suite with setup and teardown, and the run comes back with a JUnit report and the raw bytes still there to read. An agent can build and run the same things you can, over MCP, without ever being handed a secret.

Download → Read the docs

HTTP SMTP IMAP LDAP DNS SMB Kerberos SpamAssassin MySQL MongoDB PostgreSQL SQL Server Redis FTP STOMP Freestyle

VirtuProbe Studio v3.0.2 More videos on YouTube

Screenshots

A quick tour of the app

Probe editor

You can see the method, the URL, the headers, the body and the response at the same time. Variables resolve when you send, so a secret never has to sit in the file, and what comes back is the status, the latency and the raw bytes.

Chain editor

Drop probes into a sequence and pass data between steps with {{variables}}. Branch on a response, loop over a list, fan out in parallel. HTTP → IMAP → LDAP in a single artefact you can replay in CI.

Credential store

Every scheme sits behind one picker, and the probe stores only which credential to use. The panel shows you which one resolved and where it came from before you send.

GraphQL

The query and the variables get an editor each, and they serialize into the request body and come back unchanged. After that you can chain it, script it or fuzz it like any other HTTP call.

MITM proxy

Drop in the CA cert, point your client at :1080, watch every flow land in the table, filtered by host, status class or method. Promote any line to a saved probe and it's part of your chain.

Proxy interception rules editor with a MOCK rule returning a synthetic response

Service virtualization

Rules are evaluated top to bottom and the first match wins, so the order is the logic. A rule that matches answers from here and the request never leaves your machine.

Script editor

Scripts run as JavaScript. The editor highlights, completes and checks as you type, and the script drives probes through vp.send(…), then asserts on what comes back.

Agent Activity

An agent connected over MCP shows up here with the runs it starts, step by step as they happen. You approve which projects it can reach before it can change or run anything, and you can block it while it is working.

What's inside

One workbench for the whole stack.

Sixteen protocols

Chain HTTP, mail, LDAP, SMB, Kerberos and five databases in a single test.

Supervised agents

An agent builds and runs the tests over MCP. You approve what it can reach.

Proxy and mocking

Intercept every flow, then answer for a dependency that is down or not built yet.

Byte-level fuzzing

Send malformed packets byte for byte against protocols written against the RFC.

Git-backed, no cloud

Version your tests in your own repo. Execution stays where your targets are.

Suites for CI

Group chains with setup and teardown, run them in CI, read the JUnit report.

Free and paid

Three protocols free, no account, no run limits.

The free tier is a working test bench: HTTP, DNS and SMTP, request chaining, agent access over MCP, git-backed workspaces and as many runs as you like. You pay when you need the other ten protocols, the proxy, scripting, test suites or the fuzzer.

Free, forever NO ACCOUNT

✓Protocols: HTTP, DNS & SMTP (send, chain & assert on the response)
✓Agent access over MCP: point your coding agent at the workbench and let it author probes, chains and suites, run them, and read back the evidence
✓AI assistant: bring your own key, we never charge for tokens
✓No cloud, no account, no run limits: runs where your targets are
✓Directory-backed GIT workspaces: version your tests in your own repo
✓Import from everywhere: OpenAPI, Postman, Bruno, HAR, Insomnia, cURL
✓OAuth2, every flow: plus Basic, Bearer, API key & Digest
✓GraphQL requests, first-class
✓Request chaining: the output of one step feeds the next
✓Run history, diff & JSON evidence export

Paid tiers

Two tiers, sold separately. Pick the one that matches the work you do.

Engineering · for shipping integrations

→More protocols: IMAP, LDAP, MySQL/MariaDB, MongoDB, PostgreSQL & Redis (query & assert on the response)
→JavaScript scripting: programmatic chains, loops & custom logic
→MITM proxy & service-virtualization mocks
→Enterprise & Windows auth: NTLM, PtH, SPNEGO/Kerberos, AWS SigV4
→Test suites: ordered chains with setup and teardown, JUnit output for CI
→MCP interception: read the tool definitions and calls going past an agent's MCP server, and alter one on the way through to see whether your agent resists
→Skills: publish a chain or script under a fixed contract an agent can call
→Out-of-band callback detection: catch the HTTP, DNS or SMTP callback a payload triggers, and assert on who called and when

Security · for breaking them

Everything in Engineering, plus:

→Fuzzing & wordlist iterators: malformed packets, byte for byte
→Security protocols: SMB & Kerberos, for Active Directory work
→Freestyle probes: write the raw TCP or UDP exchange yourself when what you are testing has no module
→Pentest libraries: Active Directory, API, per-protocol packs

Students & academics: the full Security tier is free with verification. Academic License →

Download VirtuProbe Studio.

You install it once. There is no cloud and no telemetry, a licence turns on the rest of the features, and execution stays on your machine or inside the network where your targets are.

macOS Apple Silicon macOS Intel Linux AppImage Windows x64

v3.0.2 · macOS builds are signed and notarized; SHA-256 checksums for binaries are available for other platforms.

SHA256: mac-arm64 · mac-x64 · AppImage · win-x64

The VirtuProbe Bridge extension moves a request between Burp Suite and VirtuProbe in either direction. How it works →