We're on Microlaunch through the end of August.  Come and back VirtuProbe with an upvote. Upvote on Microlaunch →
v2.2.2 is out · the workbench now opens light by default, with motion switched off so panels respond the instant you click
Image VirtuProbe Studio
Pricing Get the app

v2.2.2 · macOS · Linux · Windows

The request manager that chains every protocol
and integrates with your agents.

Eleven protocols in one workbench, chained into a flow that passes data from one step to the next. An agent connects over MCP and can build and run the same things you can, using your stored credentials without receiving their values. Its runs appear in the app while they happen, and anything it builds is an ordinary chain you can open and change.

Download v2.2.2 → Browse the library Read the docs

Started by one engineer (20+ years from core-banking to big data) who hit the limits of every testing tool and built the one that wasn't there, now built with a small team. The story →

HTTP · SMTP · IMAP · LDAP · DNS · SMB · Kerberos · SpamAssassin · MySQL · MongoDB · PostgreSQL No cloud · runs where your targets are

Agents, supervised

An agent works in your workspace, not around it.

It connects over MCP and calls the same services the interface calls, so it inherits exactly the tier you hold and there is no second permission model. You approve which projects it may touch before it can change or run anything, and you can revoke it mid-run. It uses your stored credentials without ever receiving their values.

VirtuProbe Studio/Dashboard
server live · :10101
VirtuProbe Studio dashboard — projects, probes, chains, recent activity
VirtuProbe Studio v2.2.2
Switching? Bring your whole collection — you're working in under a minute.
import OpenAPI · Postman · Bruno · HAR · .http · Insomnia · cURL

Agents

Agents work in the same workspace you do.

VirtuProbe runs an MCP server, so an agent can build and run tests in your workspace instead of improvising its own. What it makes is an ordinary chain in an ordinary bundle. You can open it, change it, rerun it, and it is still there tomorrow.

01 · connect

An agent connects over MCP.

The MCP server is an endpoint on the API server, not a separate process. An agent connects and gets 22 tools: list and inspect bundles, probes, chains, suites and environments, then create a probe, save a chain, run a chain or a suite, run a fuzz sweep, create an environment, run a script, import a collection.

Those tools call the same services the interface calls. No second implementation, and no separate permission model.

An agent inherits your tier. There is no separate agent licence.
02 · consent

You decide what it may touch.

A new agent can read the workspace, but it cannot change or run anything until you approve it, and approving is a choice of which projects it may reach.

Every write and every run resolves its target back to the projects that own it, and is refused outside the grant. You can revoke an agent while it is working.

Reading is free. Writing and running need your consent.
03 · watch

Its runs appear while they happen.

Connected agents are listed with the runs they start, step by step as they execute. MCP over HTTP holds no connection open, so connected means an agent sent a request recently rather than that a socket is live.

Attempts that were refused appear too, with the reason they were refused, so a missing grant or an unlicensed protocol is never a silent failure.

The same view you get from a run you started yourself.
04 · step in

Open what it is working on.

A failed step is a link. Clicking it opens that chain at that step in the editor, with the same tools you would have if you had written it yourself.

This does not interrupt the agent. It hands you the artefact while it is still being worked on.

Nothing an agent makes is a second class object.
05 · skills

Hand over a capability, not the workspace.

A skill publishes a chain or a script under a fixed contract: typed inputs, declared outputs, one pinned environment. An input marked secret carries the name of a credential binding, never a value.

The environment cannot be passed in, because choosing it is choosing what a stored credential gets pointed at. Point at a chain you already have and the contract is derived for you to review.

Arguments in. Never secrets.
06 · events

Every run, on a stream.

Runs are published as Server-Sent Events, whether you started them, a schedule did, or an agent did. Filter to agent-driven runs, to a single chain, or to failures only.

Not gated on any tier. Watching what your own instance is doing carries nothing the run history does not already hold.

Wire it into whatever you already watch.

Just shipped · v2.0

What's new in 2.0

Agents can work in your workspace. The MCP surface grew from a fixed menu into the full authoring toolset, so a connected agent can build and run whatever you can, inheriting your tier and never receiving a secret. Agent Activity is the other half: approve an agent per project, watch its runs arrive step by step, open a failed step in the editor while it is still working, and revoke it mid-run. Skills publish a chain or a script under a fixed contract, with a pinned environment and secrets named rather than passed. Everything you author now lives in a bundle, so chains, scripts, suites and skills sit beside their probes in one Explorer tree instead of separate lists. Full notes in the changelog.

Download v2.2.2 ↓ Read the changelog →

Screenshots

A quick tour of the actual app

No marketing mockups — the real thing. Probes for shaping a single request, chains for stitching them into a flow, a proxy that catches the real traffic, and the rest of the toolkit.

HTTP probe editor with body, params, headers, cookies tabs and live response
Probe editor

One protocol. One screen. Zero ceremony.

Method, URL, headers, body, response — all visible. Test variables resolve at send time so you can keep secrets out of the file. Status, latency, raw bytes; no chrome between you and the response.

Chain editor showing a multi-step flow passing data between protocols
Chain editor

Stitch protocols into one runnable flow.

Drop probes into a sequence and pass data between steps with {{variables}}. Branch on a response, loop over a list, fan out in parallel. HTTP → IMAP → LDAP in a single artefact you can replay in CI.

Credential store dialog with the auth scheme picker open
Credential store

Auth, solved once.

OAuth2 — every flow — plus NTLM, Pass-the-Hash, SPNEGO/Kerberos, AWS SigV4, Basic, Bearer and more, behind one picker. Secrets live apart from the probe and never touch run history.

HTTP probe Body tab in GraphQL mode with Query and Variables editors
GraphQL

First-class queries and variables.

Dedicated Query + Variables editors that serialize into the request body and round-trip cleanly. Then chain it, script it or fuzz it like any other HTTP call.

MITM proxy view showing intercepted requests with raw HTTP request and response
MITM proxy

Catch traffic. Save it as a probe.

Drop in the CA cert, point your client at :1080, watch every flow land in the table. Filter by host, status class, method. Promote any line to a saved probe — now it's part of your chain.

Proxy interception rules editor with a MOCK rule returning a synthetic response
Service virtualization

Mock what isn't built yet.

Match on method, host, path, header or body and return a synthetic response. Stand in for a service that doesn't exist, or force the edge case a real server won't hand you.

CodeMirror script editor with JavaScript and Groovy support in the Scripts view
Script editor

Real code, real editor.

Write in JavaScript or Groovy, your pick per script, with JavaScript the new default. Syntax highlighting, autocomplete and linting, and the full runtime one import away. Drive probes programmatically with vp.send(…) and assert on what comes back.

AI assistant proposing a generated chain with an Approve / Reject confirmation card
AI assistant

Bring your own model.

Connect it to any OpenAI-compatible or local endpoint. It reads responses, explains what broke and builds chains on request — and waits for your approval before any write or run. The key never leaves your machine.

Three jobs, one workbench

Every protocol you test, in one place

A Probe is one request on one protocol. A Chain is a flow of probes that pass data between steps. Iterate over a list, branch on a JavaScript or Groovy condition, fan out in parallel, or call a sub-chain. Mix protocols freely — fire an HTTP call, read the resulting email over IMAP, look the user up in LDAP, all in one runnable artefact.

Integration testing

End-to-end flows your CI can actually run.

The signup chain that touches HTTP, SMTP, IMAP and LDAP — captured once, replayable forever. One artefact instead of a folder of curl scripts.

  • Cross-protocol assertionsDid the API call land a verify email with the correct token within 30s?
  • Iterators & fixturesDrive a chain from a CSV, a vault, or another probe's response.
  • MCP serversPoint the HTTP probe at a Model Context Protocol server — chain the handshake, stream the reply live, assert on the tools it exposes.
  • Reproducible artefactsEvery chain exports as a single file. Check it into the repo.
Mail & identity infra

SMTP, IMAP, LDAP, DNS, SMB, Kerberos and SpamAssassin in one place.

Audit your mail server's edge cases without spinning up three CLI tools and a junk inbox. Score, bind, retrieve, resolve — all probes.

  • SMTP & IMAP probesSend malformed envelopes. Read what arrived. Diff against expectation.
  • LDAP queries & bindsHit your DC, assert directory state mid-chain.
  • DNS resolutionQuery any resolver — A, AAAA, MX, TXT. Assert RCODEs, extract IPs for downstream steps.
  • SpamAssassin scoringScore any payload from the chain itself — regression-test deliverability.
Security research

The unhappy paths most tools won't speak.

Implementations are written from scratch against the RFCs — so when you need to send something the spec forbids, nothing gets in the way — the exact bytes go out.

  • Hand-rolled stacksHTTP, SMTP, IMAP, LDAP, DNS, SMB, Kerberos — ours. Bend the protocol. The library won't push back.
  • Built-in MITMCaptured traffic lands as editable probes. Replay, mutate, or fuzz from what the server actually sent back.
  • Chain libraryCurated probe packs for the work you keep doing twice.

Capabilities

Every feature is built on probes

A probe is a request. A chain is probes in sequence. A script drives probes programmatically. A fuzzer fires a probe in a loop. Intercept captures traffic as probes. The model is the same everywhere — which means anything you learn in one place applies everywhere else.

01

Probes

One probe = one request, on one protocol. HTTP, SMTP, IMAP, LDAP, DNS, SMB, Kerberos — with hand-rolled stacks so you can send what the spec forbids.

HTTP · SMTP · IMAP · LDAP · DNS · SMB · Kerberos · SpamAssassin
02

Chains

A chain is a flow of probes that pipe data between steps. Branch on a response, run steps in parallel, call sub-chains, loop over a list. Cross protocols freely.

IF {{status}}=='200' → then / else · PARALLEL · CHAIN_REF
03

MITM proxy

Intercept system-wide or scoped to a hostname. Every flow lands in a table you can filter by host, status class or method — and any line promotes to an editable probe, ready to chain, replay or fuzz.

intercept · filter · capture → probe
04

Service virtualization

Flip the proxy around. Match on method, host, path, header or body and return a synthetic response — so you can stand in for a service that isn't built yet, or force the edge case a real server won't give you.

match rules · mock responses · stand-in services
05

JavaScript and Groovy scripting

Two engines across pre and post scripts, assertions, mutators and chain logic, with a real code editor: syntax highlighting, autocomplete and linting. JavaScript on GraalJS or Groovy on the JVM, your pick.

vp.send("Login", "SMTP auth", vars) · r.extract("SMTP_SUCCESS")
06

Library

Curated probe packs and reference chains — OAuth flows, SMTP DSN edge cases, LDAP audits, spam-score regressions. Bring your own, share with team.

479+ probes & chains · 10 collections · actively maintained
07

Directory-backed workspaces FREE

Point VirtuProbe at a folder and your probes, chains and environments become plain files. Share the workspace through your own git, Dropbox or network share; secrets stay in the local encrypted store. Version-control your tests like code.

folder · GIT-backed · diff & review in your own repo
08

Fuzzing

Mark any probe field with §payload§, drop in a wordlist, and fire. Results land in a table — status, duration, body preview — so anomalies are obvious at a glance.

§payload§ · 200 runs · 3 anomalies
09

AI assistant FREE · BYOK

Bring your own model — any OpenAI-compatible endpoint, or a local one. It reads your responses, explains what broke, and builds chains and scripts on request. Suggests the chain; you run it against the real thing — and prove it. Every write and run waits for your approval.

BYOK · approve / run · your keys, your infra
10

Unified credential store

Auth is one picker. OAuth2 — every flow — plus Basic, Bearer, API key and Digest are free. Windows & enterprise schemes (NTLM, Pass-the-Hash, SPNEGO/Kerberos, AWS SigV4, scripted) unlock with a paid tier. Secrets live apart from the probe and never touch history.

OAuth2 · SigV4 · NTLM / SPNEGO · per-project, per-run
11

Import & export anything

Bring existing work in — OpenAPI, Postman, Bruno, HAR, .http or Insomnia — or paste a cURL/wget command onto a probe. Export back out as cURL, wget, Python or PowerShell. Switch tools without leaving your collection behind.

OpenAPI · Postman · Bruno · HAR · Insomnia
12

GraphQL

A first-class Query + Variables editor on the HTTP probe — your query and variables serialize into the request body and round-trip cleanly. Chain it, script it, fuzz it like any other request.

query · variables · runs as HTTP
13

Action Mode

Test the outcome, not the protocol. Send an email, find a message, check a login as a plain form — VirtuProbe drives the whole EHLO / SELECT / BIND conversation for you. Drop to Advanced for exact command control the moment you need it.

send email · find message · check login
14

MCP testing

Point the HTTP probe at a Model Context Protocol server — Streamable HTTP or legacy SSE. Chain the handshake, stream events live, and read every response for tool-poisoning. Fuzz the JSON-RPC like any other request.

initialize · tools/call · tool-poisoning scan
15

Databases

Run SQL against MySQL / MariaDB and PostgreSQL, and queries against MongoDB — as probes. Pull out a column or a document field, chain it into the next step, and assert on the result. Fill the form, or paste a full mongo shell query verbatim.

MySQL · MariaDB · PostgreSQL · MongoDB

Free isn't a trial

We paywall power, not your experience.

The free workbench is a real tool, not a 14-day tease. We only charge for things that earn their keep for professional engineers and security pros — the heavy machinery. Everyday request work that other tools hide behind a login or a monthly bill stays free here, forever.

Free, forever NO ACCOUNT

  • ✓Agent access over MCP: point your coding agent at the workbench and let it author probes, chains and suites, run them, and read back the evidence
  • ✓AI assistant — bring your own key; we never charge for tokens
  • ✓No cloud, no account, no run limits — runs where your targets are
  • ✓Directory-backed GIT workspaces — version your tests in your own repo
  • ✓Import from everywhere — OpenAPI, Postman, Bruno, HAR, Insomnia, cURL
  • ✓OAuth2 — every flow — plus Basic, Bearer, API key & Digest
  • ✓GraphQL requests, first-class
  • ✓Request chaining across HTTP, DNS & SMTP
  • ✓Run history, diff & JSON evidence export

Worth paying for

  • →More protocols — IMAP, LDAP, MySQL/MariaDB, MongoDB & PostgreSQL (query & assert on the response)
  • →JavaScript and Groovy scripting — programmatic chains, loops & custom logic
  • →MITM proxy & service-virtualization mocks
  • →Fuzzing & wordlist iterators — malformed packets, wire-level
  • →Enterprise & Windows auth — NTLM, PtH, SPNEGO/Kerberos, AWS SigV4
  • →Security protocols — SMB, Kerberos, SpamAssassin
  • →Pentest libraries — Active Directory, API, per-protocol packs

Students & academics: the full Security tier is free with verification — Academic License →

The library · preview it right now

A thousand ready-made tests to start from

Don't start from a blank request. The bundled library ships recon sweeps, fuzzing payloads, kerberoasting, JWT brute-force, AD enumeration and integration smoke tests — plus curated multi-step chains. Find one, import it into a bundle, run it for real.

And you can search the whole catalog right here — no download, no signup. See exactly what ships, free and paid, before you install a thing.

1,000+ ready-made tests 14 collections 130+ multi-step chains recon · fuzzing · AD · API · integrations
Search the library → What unlocks the packs

Anatomy of a chain

register → mail → verify → directory. One file.

A chain is a sequence of steps that pass data between each other via {{variables}}. Iterate over a list, branch on a response, fan steps out in parallel, or call another chain as a sub-routine. Cross protocols freely. Replay anywhere — desktop, CI, or the execution server inside your network.

HTTP POST /v1/users · register extract $.id → vault.user
→
IMAP INBOX · FROM noreply@ extract token from body
→
HTTP PUT /v1/verify?t={{token}} assert 200 · verified
final step: LDAP bind to dc.target · assert cn=user in OU=Verified · exported as signup-flow.chain.json
VirtuProbe Studio/Chain editor
4 steps · passing
The chain editor: a multi-step HTTP → IMAP → LDAP flow with per-step extractors and assertions in one runnable file
The real thing — every step, extractor and assertion in one file you can replay in CI
Browse ready-made chains → How chaining works

Testing in the age of AI

Why testing the real thing matters more in the AI era

When an AI can ship an integration in an afternoon, the bottleneck stops being "write the code." The bottleneck is knowing it actually works — under load, against malformed input, on the protocol that doesn't quite follow the spec.

An AI happily writes the happy path. It will not, on its own, send a CRLF in a header field to see what your reverse proxy does. That part is on you. That part is what we're for.

Code review shows intent.
Running it shows behavior. — after the model writes the code
01 · the shift

Code is cheap.
Confidence isn't.

Generated code ships in minutes. The bugs ship at the same pace — and nobody on the team read them carefully enough to know.

Tests that exercise the running system, not the function signature, become the only artefact that proves what was actually shipped.

Verify at the boundary. Anything else is a hot take.
02 · the blind spot

AI never sends a malformed packet.

Models are trained on code that works. They generate clients that respect the spec, requests the server expects, fields the SDK exposes.

Adversarial input, undocumented protocol corners, deliberately broken envelopes — none of it is in the training set. That's where production breaks.

The unhappy path is the human's job again.
03 · the workbench

Hand-rolled stacks, on purpose.

Our HTTP, SMTP, IMAP, LDAP, DNS, SMB, Kerberos and SpamAssassin are written from scratch against the RFCs — so you can send what the spec forbids, fuzz with §payload§, and see the real traffic.

An AI can write the chain that proves your signup flow works. We make sure you can run it — and prove it didn't.

Composable probes the model can suggest, and a real run can confirm.

Three ways to run it

Desktop app or distributed. Always on your infrastructure.

VirtuProbe Studio is a UI and an execution server. Bundle them into one desktop app on your laptop, or deploy the execution server inside the network where your targets live — so probes fire from inside, not over a VPN.

Standalone

Desktop app

UI and execution bundled in one Electron app. Open it, probe things, close it.

[ desktop app ] ├─ browser UI ├─ ui server └─ execution server
  • macOS, Linux, Windows
  • Workspaces stored locally on disk
  • Nothing to deploy or maintain
Split execution

Execution server inside the target network

Deploy the execution server where your targets live. Browser UI connects to it — probes fire from inside, not over VPN.

[ your machine ] [ target network ] browser UI → execution server ↓ targets
  • Reach internal services with no VPN required
  • Execution server runs as a container or service
  • Only one port exposed between UI and execution
Team

Shared UI, execution where it needs to be

UI server central, browser-based clients, execution server deployed per engagement or environment.

ui server ← browsers (n) ↓ execution server → targets
  • Shared workspaces, roles
  • Multiple execution servers per team
  • On-prem licence server compatible

Why you can install it

How we handle your credentials and data

VirtuProbe handles your credentials and fires at your infrastructure. That only works on trust, so we earn it the boring way: keep your data on your machine, ship from a disciplined pipeline, and stay reachable by a human.

The makers

A small team, an independent business.

Built by a small team in Prague — an independent product, not a VC growth experiment that pivots away next quarter. The people who make it answer the mail. Meet the team →

The build

Disciplined, reproducible releases.

Every installer comes out of an automated CI/CD pipeline — no hand-built binaries. Even the backend it talks to runs as containerized services defined entirely in code (Terraform + Ansible), so nothing is configured by hand. SHA-256 checksums ship with every download, the changelog is public, and macOS builds are signed and notarized (Windows signing is next).

Your data

Nothing leaves your machine.

No cloud, no telemetry, no account. Workspaces live on your disk. Credentials sit in a local encrypted store, apart from your probes and never in run history. The app only phones home to validate a license and check for updates.

Disclosure

Found something? Tell us.

Security reports go straight to a human who wants to hear them — [email protected]. We'd rather hear it from you than read about it elsewhere.

v2.2.2 · current build

Download VirtuProbe Studio.

One-time install. No cloud, no telemetry. License unlocks all features. Execution stays on your machine — or inside the network where your targets are.

v2.2.2 · macOS builds are signed and notarized; Windows builds are not yet code-signed, so Windows shows a security warning on first launch. How to proceed → · Windows code-signing is next on our roadmap · see what's coming →

SHA256: mac-arm64 · mac-x64 · AppImage · win-x64

Stay in the loop

New releases & protocol deep-dives.

Low volume, no marketing fluff — just releases, protocol notes, and the occasional war story. Unsubscribe in one click. Your address stays with us and Buttondown, never sold.

No spam. No tracking pixels. GDPR-friendly, hosted in the EU.

Join our Discord