MockServer vs mountebank

MockServer is a free, self-hosted tool for mocking and proxying HTTP, HTTPS, and gRPC services during isolated testing. It can verify requests as well as stand in for services. Teams can generate mocks and validate traffic against OpenAPI or Swagger contracts, or import recorded sessions from browser HAR files and Postman collections. Beyond HTTP services, it can mock gRPC, AsyncAPI brokers such as Kafka, MQTT, and AMQP, and OAuth2/OIDC providers. Its protocol coverage includes HTTP/1.1, HTTP/2, HTTPS, SOCKS, and experimental HTTP/3, which uses a separate UDP port. For fault-oriented testing, it can add latency, errors, dropped connections, and malformed responses to mocked or proxied traffic. Deployment options include Docker, an executable JAR, Helm/Kubernetes, Testcontainers, Homebrew, and a JVM-less bundle. A web dashboard displays logs, expectations, and recorded traffic; Prometheus metrics and OpenTelemetry tracing are available for shared environments. Each instance includes an MCP server at /mockserver/mcp. The /mockserver/status and /mockserver/ready probes remain reachable without authentication or authorization.

mountebank is a free, self-hosted service-virtualization tool that supplies test doubles instead of real application dependencies. Through its HTTP API, developers configure stubs, record and replay proxies, and verify mock expectations. HTTP, HTTPS, TCP, and SMTP are built in; community plugins add LDAP, WebSockets, GraphQL, SNMP, Telnet, SSH, and NETCONF. Installation documentation covers npm and Docker. Community extensions list client libraries for C#, Clojure, Go, Java, JavaScript, Python, Ruby, TypeScript, and Swift, along with Grunt, Gradle, and Maven plugins. Stateful simulation, fault injection, and record-and-replay are supported. By default, mountebank stores everything in memory, which its site says can become a performance bottleneck at scale. Security guidance warns that JavaScript injection can permit code execution on the machine and recommends localhost-only access or an IP whitelist. CORS is disabled by default, and safe origins can be enabled explicitly.