Beeceptor vs mountebank

Beeceptor is a developer-focused API simulation platform for mocking services, virtualizing them, testing contracts, and simulating failures. It supports HTTP, HTTPS, HTTP/2, mTLS, REST/OpenAPI, SOAP, GraphQL, and gRPC. Users can build no-code mocks with request-matching rules and set response status codes, headers, and bodies. Uploading an OpenAPI specification can create a populated mock server with AI-generated data. Beeceptor can proxy requests to live backends, record traffic, and switch to mock behavior when a backend is unavailable. Latency, timeouts, and errors can be simulated to check client resilience. Its CLI exposes a localhost service through a public HTTPS URL and runs on Windows, macOS, and Linux. Management APIs support mock-server configuration, while MCP connectivity supports AI agents including Claude and Cursor. API Connections store OAuth credentials and generate tokens for outbound requests. Beeceptor says it is SOC 2 Type II audited, adheres to ISO 27001, and complies with GDPR; it also says data is encrypted in transit and at rest. The free plan has public endpoints, a 1 MB request payload limit, and cleanup rules for unclaimed endpoints.

mountebank is a free, self-hosted service-virtualization tool that supplies test doubles instead of real application dependencies. Through its HTTP API, developers configure stubs, record and replay proxies, and verify mock expectations. HTTP, HTTPS, TCP, and SMTP are built in; community plugins add LDAP, WebSockets, GraphQL, SNMP, Telnet, SSH, and NETCONF. Installation documentation covers npm and Docker. Community extensions list client libraries for C#, Clojure, Go, Java, JavaScript, Python, Ruby, TypeScript, and Swift, along with Grunt, Gradle, and Maven plugins. Stateful simulation, fault injection, and record-and-replay are supported. By default, mountebank stores everything in memory, which its site says can become a performance bottleneck at scale. Security guidance warns that JavaScript injection can permit code execution on the machine and recommends localhost-only access or an IP whitelist. CORS is disabled by default, and safe origins can be enabled explicitly.