Skip to content
SPECIFICTION
Get listed

mountebank

mbtest.dev

Free plan LinuxAPISelf-hosted
Visit mbtest.dev
Spec score 7.6 #14 of 21 in Service Virtualization Software

What it is

mountebank is a free, self-hosted service-virtualization tool that supplies test doubles instead of real application dependencies. Through its HTTP API, developers configure stubs, record and replay proxies, and verify mock expectations. HTTP, HTTPS, TCP, and SMTP are built in; community plugins add LDAP, WebSockets, GraphQL, SNMP, Telnet, SSH, and NETCONF. Installation documentation covers npm and Docker. Community extensions list client libraries for C#, Clojure, Go, Java, JavaScript, Python, Ruby, TypeScript, and Swift, along with Grunt, Gradle, and Maven plugins. Stateful simulation, fault injection, and record-and-replay are supported. By default, mountebank stores everything in memory, which its site says can become a performance bottleneck at scale. Security guidance warns that JavaScript injection can permit code execution on the machine and recommends localhost-only access or an IP whitelist. CORS is disabled by default, and safe origins can be enabled explicitly.

Spec sheet

Purpose
mountebank provides cross-platform, multi-protocol test doubles over the wire for testing applications in place of real dependencies.Read 4 Oct 2026 · mbtest.dev
Audience
The site describes mountebank as a platform for developers to test applications against on-demand test doubles instead of real dependencies.Read 4 Oct 2026 · mbtest.dev
Security
The security page warns that enabling JavaScript injection can allow attackers to run code on the machine and recommends protections such as localhost-only access or an IP whitelist.Read 4 Oct 2026 · mbtest.dev
Support
The support page directs users to a Google group for help.Read 4 Oct 2026 · mbtest.dev
API key option
The command-line documentation describes an optional API key that requires a matching x-api-key header for API requests.Read 4 Oct 2026 · mbtest.dev
Build integrations
Listed build tool plugins include Grunt, Gradle, and Maven.Read 4 Oct 2026 · mbtest.dev
Built-in protocols
The site lists HTTP, HTTPS, TCP, and SMTP as built-in protocols.Read 4 Oct 2026 · mbtest.dev
Client libraries
The community extensions page lists client libraries for languages including C#, Clojure, Go, Java, JavaScript, Python, Ruby, TypeScript, and Swift.Read 4 Oct 2026 · mbtest.dev
Community protocols
The site lists LDAP, WebSockets, GraphQL, SNMP, Telnet, SSH, and NETCONF as community plugins.Read 4 Oct 2026 · mbtest.dev
CORS
CORS is disabled by default to prevent CSRF attacks, and safe origins can be explicitly enabled with a command-line flag.Read 4 Oct 2026 · mbtest.dev
Installation
The getting started guide documents installation through npm or running a Docker image.Read 4 Oct 2026 · mbtest.dev
Persistence limit
By default, mountebank stores everything in memory; the page says this can become a performance bottleneck at scale.Read 4 Oct 2026 · mbtest.dev
Testing workflow
Tests use its HTTP API to set up stubs, record and replay proxies, and verify mock expectations.Read 4 Oct 2026 · mbtest.dev

Plans and prices

Free Free Open source service virtualization · No platform constraints stated Read 4 Oct 2026 · mbtest.dev

Every mountebank plan and price →

Strong points and limits

Strong points

  • Free open-source service virtualization
  • Supports four built-in protocols
  • Offers record and replay
  • Provides stateful simulation and fault injection
  • npm and Docker installation options

Limits

  • In-memory storage can bottleneck at scale
  • JavaScript injection can enable code execution
  • CORS requires explicit origin enablement

Who it suits

It suits developers testing applications against controlled, on-demand substitutes for external services. Self-hosted deployment fits teams managing their own test infrastructure.

Verdict

mountebank covers common protocols and offers an extensive plugin and client-library ecosystem for self-hosted testing. Teams should plan storage and carefully restrict JavaScript injection and API exposure.

Where Specifiction places it

Alternatives to mountebankAll alternatives →