- Home
- Service Virtualization Software
- mountebank
mountebank
What it is
mountebank is a free tool for developers who need applications to interact with test doubles instead of real dependencies. Tests use its HTTP API to configure stubs, record and replay proxies, and verify mock expectations. Built-in protocols are HTTP, HTTPS, TCP and SMTP; community plugins add LDAP, WebSockets, GraphQL, SNMP, Telnet, SSH and NETCONF. Installation instructions cover npm and running a Docker image. Community extensions list client libraries for C#, Clojure, Go, Java, JavaScript, Python, Ruby, TypeScript and Swift, as well as build tool plugins for Grunt, Gradle and Maven. By default, mountebank keeps data in memory, which can become a performance bottleneck at scale. Its security guidance warns that JavaScript injection can let attackers run code on the machine and recommends protections such as localhost-only access or an IP whitelist. CORS is disabled by default to help prevent CSRF attacks; safe origins can be enabled with a command-line flag. An optional API key requires a matching x-api-key header for API requests.
For and against
For
- Free open-source service virtualization
- HTTP API configures stubs and mock expectations
- Built-in HTTP, HTTPS, TCP and SMTP protocols
- Record and replay proxies
- Client libraries cover several programming languages
Against
- Default in-memory storage can bottleneck at scale
- JavaScript injection can allow code execution on the machine
- CORS is disabled by default
The verdict
mountebank provides protocol-spanning test doubles and an HTTP API for configuring and checking them. Consider its in-memory storage behavior and security guidance when planning a deployment.
Who it suits
It suits developers who need on-demand test doubles for application testing. It is self-hosted and supports multiple protocols and client languages.
Plans and prices
Free
Open source service virtualization · No platform constraints stated
Read 4 Oct 2026 · mbtest.dev
On the record
- API key option
- The command-line documentation describes an optional API key that requires a matching x-api-key header for API requests.mbtest.dev · read 4 Oct 2026
- Audience
- The site describes mountebank as a platform for developers to test applications against on-demand test doubles instead of real dependencies.mbtest.dev · read 4 Oct 2026
- Build integrations
- Listed build tool plugins include Grunt, Gradle, and Maven.mbtest.dev · read 4 Oct 2026
- Built-in protocols
- The site lists HTTP, HTTPS, TCP, and SMTP as built-in protocols.mbtest.dev · read 4 Oct 2026
- Client libraries
- The community extensions page lists client libraries for languages including C#, Clojure, Go, Java, JavaScript, Python, Ruby, TypeScript, and Swift.mbtest.dev · read 4 Oct 2026
- Community protocols
- The site lists LDAP, WebSockets, GraphQL, SNMP, Telnet, SSH, and NETCONF as community plugins.mbtest.dev · read 4 Oct 2026
- CORS
- CORS is disabled by default to prevent CSRF attacks, and safe origins can be explicitly enabled with a command-line flag.mbtest.dev · read 4 Oct 2026
- Installation
- The getting started guide documents installation through npm or running a Docker image.mbtest.dev · read 4 Oct 2026
- Persistence limit
- By default, mountebank stores everything in memory; the page says this can become a performance bottleneck at scale.mbtest.dev · read 4 Oct 2026
- Purpose
- mountebank provides cross-platform, multi-protocol test doubles over the wire for testing applications in place of real dependencies.mbtest.dev · read 4 Oct 2026
- Security
- The security page warns that enabling JavaScript injection can allow attackers to run code on the machine and recommends protections such as localhost-only access or an IP whitelist.mbtest.dev · read 4 Oct 2026
- Support
- The support page directs users to a Google group for help.mbtest.dev · read 4 Oct 2026
- Testing workflow
- Tests use its HTTP API to set up stubs, record and replay proxies, and verify mock expectations.mbtest.dev · read 4 Oct 2026
