We're on Microlaunch through the end of August.  Come and back VirtuProbe with an upvote. Upvote on Microlaunch →
v2.3.1 is out · UI performance improvements
VirtuProbe Studio
Get the app

v2.3.1 · macOS · Linux · Windows

The request manager that chains every protocol
and integrates with your agents.

Eleven protocols in one workbench, chained into a flow that passes data from one step to the next. An agent connects over MCP and can build and run the same things you can, using your stored credentials without receiving their values. Its runs appear in the app while they happen, and anything it builds is an ordinary chain you can open and change.

Download v2.3.1 → Browse the library Read the docs

Started by one engineer (20+ years from core-banking to big data) who hit the limits of every testing tool and built the one that wasn't there, now built with a small team. The story →

HTTP · SMTP · IMAP · LDAP · DNS · SMB · Kerberos · SpamAssassin · MySQL · MongoDB · PostgreSQL No cloud · runs where your targets are
VirtuProbe Studio v2.3.1 More videos on YouTube
Switching? Bring your whole collection and you're working in under a minute.
import OpenAPI · Postman · Bruno · HAR · .http · Insomnia · cURL

Agents

Agents work in the same workspace you do.

VirtuProbe runs an MCP server, so an agent can build and run tests in your workspace instead of improvising its own. What it makes is an ordinary chain in an ordinary bundle. You can open it, change it, rerun it, and it is still there tomorrow.

01 · connect

An agent connects over MCP.

The MCP server is an endpoint on the API server, not a separate process. An agent connects and gets 26 tools: list and inspect bundles, probes, chains, suites and environments, then create a probe, save a chain, run a chain or a suite, run a fuzz sweep, create an environment, run a script, import a collection.

Those tools call the same services the interface calls. No second implementation, and no separate permission model.

An agent inherits your tier. There is no separate agent licence.
02 · consent

You decide what it may touch.

A new agent can read the workspace, but it cannot change or run anything until you approve it, and approving is a choice of which projects it may reach.

Every write and every run resolves its target back to the projects that own it, and is refused outside the grant. You can revoke an agent while it is working.

Reading is free. Writing and running need your consent.
03 · watch

Its runs appear while they happen.

Connected agents are listed with the runs they start, step by step as they execute. MCP over HTTP holds no connection open, so connected means an agent sent a request recently rather than that a socket is live.

Attempts that were refused appear too, with the reason they were refused, so a missing grant or an unlicensed protocol is never a silent failure.

The same view you get from a run you started yourself.
04 · step in

Open what it is working on.

A failed step is a link. Clicking it opens that chain at that step in the editor, with the same tools you would have if you had written it yourself.

This does not interrupt the agent. It hands you the artefact while it is still being worked on.

Nothing an agent makes is a second class object.
05 · skills

Hand over a capability, not the workspace.

A skill publishes a chain or a script under a fixed contract: typed inputs, declared outputs, one pinned environment. An input marked secret carries the name of a credential binding, never a value.

The environment cannot be passed in, because choosing it is choosing what a stored credential gets pointed at. Point at a chain you already have and the contract is derived for you to review.

Arguments in. Never secrets.
06 · events

Every run, on a stream.

Runs are published as Server-Sent Events, whether you started them, a schedule did, or an agent did. Filter to agent-driven runs, to a single chain, or to failures only.

Not gated on any tier. Watching what your own instance is doing carries nothing the run history does not already hold.

Wire it into whatever you already watch.

Screenshots

A quick tour of the app

HTTP probe editor with body, params, headers, cookies tabs and live response
Probe editor

You can see the method, the URL, the headers, the body and the response at the same time. Variables resolve when you send, so a secret never has to sit in the file, and what comes back is the status, the latency and the raw bytes.

Chain editor showing a multi-step flow passing data between protocols
Chain editor

Drop probes into a sequence and pass data between steps with {{variables}}. Branch on a response, loop over a list, fan out in parallel. HTTP → IMAP → LDAP in a single artefact you can replay in CI.

Credential store dialog with the auth scheme picker open
Credential store

Every scheme sits behind one picker, and the probe stores only which credential to use. The panel shows you which one resolved and where it came from before you send.

HTTP probe Body tab in GraphQL mode with Query and Variables editors
GraphQL

The query and the variables get an editor each, and they serialize into the request body and come back unchanged. After that you can chain it, script it or fuzz it like any other HTTP call.

MITM proxy view showing intercepted requests with raw HTTP request and response
MITM proxy

Drop in the CA cert, point your client at :1080, watch every flow land in the table. Filter by host, status class, method. Promote any line to a saved probe and it's part of your chain.

Proxy interception rules editor with a MOCK rule returning a synthetic response
Service virtualization

Rules are evaluated top to bottom and the first match wins, so the order is the logic. A rule that matches answers from here and the request never leaves your machine.

CodeMirror script editor with JavaScript and Groovy support in the Scripts view
Script editor

A script is JavaScript or Groovy, chosen per script, and a new one starts in JavaScript. The editor highlights, completes and checks as you type, and the script drives probes through vp.send(…), then asserts on what comes back.

Agent Activity panel showing a connected coding agent scoped to one project, with the chain it ran and each step passing
Agent Activity

An agent connected over MCP shows up here with the runs it starts, step by step as they happen. You approve which projects it can reach before it can change or run anything, and you can block it while it is working.

Three jobs, one workbench

Every protocol you test, in one place

Iterate over a list, branch on a JavaScript or Groovy condition, fan out in parallel, or call a sub-chain. Mix protocols freely: fire an HTTP call, read the resulting email over IMAP, look the user up in LDAP, all in one runnable artefact.

Integration testing

End-to-end flows you can run in CI.

A signup flow touches HTTP, SMTP, IMAP and LDAP. You build it once as a chain, and it runs the same way on your machine and in CI.

  • Cross-protocol assertionsAssert that the API call produced a verification email carrying the right token, inside a time limit you set.
  • Iterators & fixturesDrive a chain from a CSV, a vault, or another probe's response.
  • MCP clientThe HTTP probe speaks Model Context Protocol, so it can call an MCP server, thread the session through a chain, and assert on the tools that server exposes.
  • Reproducible artefactsA chain exports as a single file you can commit next to the code it tests.
Mail & identity infra

Mail, directory and identity protocols in one place.

Check a mail server's edge cases without a junk inbox and a pile of command line tools. Scoring, binding, retrieving and resolving are all probes, so they chain with everything else.

  • SMTP & IMAP probesSend a malformed envelope, read what actually arrived, and compare it against what you expected.
  • LDAP queries & bindsQuery a domain controller and assert on directory state part way through a chain.
  • DNS resolutionQuery any resolver for A, AAAA, MX or TXT records, assert on the RCODE, and pass an address to the next step.
  • SpamAssassin scoringScore a message from inside the chain, so a deliverability regression fails the run.
Security research

The requests a normal client will not send.

The protocol implementations are written from scratch against the RFCs, so a request that breaks the spec goes out exactly as you wrote it.

  • Hand-rolled stacksHTTP, SMTP, IMAP, LDAP, DNS, SpamAssassin, SMB and Kerberos are ours, so nothing normalises a request before it is sent.
  • Built-in MITMCaptured traffic becomes an editable probe you can replay, mutate or fuzz.
  • Chain libraryCurated probe packs for the checks you would otherwise write again on every engagement.

Capabilities

Every feature is built on probes

A probe is a request. A chain is probes in sequence. A script drives probes programmatically. A fuzzer fires a probe in a loop. Intercept captures traffic as probes. The model is the same everywhere, so anything you learn in one place applies everywhere else.

01

Probes

One probe = one request, on one protocol. Eleven of them, and the eight we wrote by hand let you send what the spec forbids.

HTTP · SMTP · IMAP · LDAP · DNS · SMB · Kerberos · SpamAssassin
02

Chains

A chain is a flow of probes that pipe data between steps. Branch on a response, run steps in parallel, call sub-chains, loop over a list. Cross protocols freely.

IF {{status}}=='200' → then / else · PARALLEL · CHAIN_REF
03

MITM proxy

Intercept system-wide or scoped to a hostname. Every flow lands in a table you can filter by host, status class or method, and any line promotes to an editable probe, ready to chain, replay or fuzz.

intercept · filter · capture → probe
04

Service virtualization

Flip the proxy around. Match on method, host, path, header or body and return a synthetic response, so you can stand in for a service that isn't built yet, or force the edge case a real server won't give you.

match rules · mock responses · stand-in services
05

JavaScript and Groovy scripting

Two engines across pre and post scripts, assertions, mutators and chain logic, with a real code editor: syntax highlighting, autocomplete and linting. JavaScript on GraalJS or Groovy on the JVM, your pick.

vp.send("Login", "SMTP auth", vars) · r.extract("SMTP_SUCCESS")
06

Library

Curated probe packs and reference chains: OAuth flows, SMTP DSN edge cases, LDAP audits, spam-score regressions. Bring your own, share with team.

1,100+ probes & chains · 14 collections · actively maintained
07

Directory-backed workspaces FREE

Point VirtuProbe at a folder and your probes, chains and environments become plain files. Share the workspace through your own git, Dropbox or network share; secrets stay in the local encrypted store. Version-control your tests like code.

folder · GIT-backed · diff & review in your own repo
08

Fuzzing

Mark any probe field with §payload§, drop in a wordlist, and fire. Results land in a table with status, duration and body preview, so anomalies are obvious at a glance.

§payload§ · 200 runs · 3 anomalies
09

AI assistant FREE · BYOK

Bring your own model, any OpenAI-compatible endpoint or a local one. It reads your responses, explains what broke, and builds chains and scripts on request. Suggests the chain; you run it against the real thing and prove it. Every write and run waits for your approval.

BYOK · approve / run · your keys, your infra
10

Unified credential store

Auth is one picker. OAuth2 in every flow, plus Basic, Bearer, API key and Digest, are free. Windows & enterprise schemes (NTLM, Pass-the-Hash, SPNEGO/Kerberos, AWS SigV4, scripted) unlock with a paid tier. Secrets live apart from the probe and never touch history.

OAuth2 · SigV4 · NTLM / SPNEGO · per-project, per-run
11

Import & export anything

Bring existing work in from OpenAPI, Postman, Bruno, HAR, .http or Insomnia, or paste a cURL/wget command onto a probe. Export back out as cURL, wget, Python or PowerShell. Switch tools without leaving your collection behind.

OpenAPI · Postman · Bruno · HAR · Insomnia
12

GraphQL

A first-class Query + Variables editor on the HTTP probe, so your query and variables serialize into the request body and round-trip cleanly. Chain it, script it, fuzz it like any other request.

query · variables · runs as HTTP
13

Action Mode

Test the outcome, not the protocol. Send an email, find a message, check a login as a plain form, and VirtuProbe drives the whole EHLO / SELECT / BIND conversation for you. Drop to Advanced for exact command control the moment you need it.

send email · find message · check login
14

MCP testing

Point the HTTP probe at a Model Context Protocol server, over Streamable HTTP or legacy SSE. Chain the handshake, stream events live, and read every response for tool-poisoning. Fuzz the JSON-RPC like any other request.

initialize · tools/call · tool-poisoning scan
15

Databases

Run SQL against MySQL / MariaDB and PostgreSQL, and queries against MongoDB, all as probes. Pull out a column or a document field, chain it into the next step, and assert on the result. Fill the form, or paste a full mongo shell query verbatim.

MySQL · MariaDB · PostgreSQL · MongoDB

Free and paid

We charge for the heavy machinery.

Three protocols, request chaining and agent access over MCP are free. The paid tiers add the other eight protocols, the proxy, scripting, test suites and the fuzzer.

Free, forever NO ACCOUNT

  • ✓Protocols: HTTP, DNS & SMTP (send, chain & assert on the response)
  • ✓Agent access over MCP: point your coding agent at the workbench and let it author probes, chains and suites, run them, and read back the evidence
  • ✓AI assistant: bring your own key, we never charge for tokens
  • ✓No cloud, no account, no run limits: runs where your targets are
  • ✓Directory-backed GIT workspaces: version your tests in your own repo
  • ✓Import from everywhere: OpenAPI, Postman, Bruno, HAR, Insomnia, cURL
  • ✓OAuth2, every flow: plus Basic, Bearer, API key & Digest
  • ✓GraphQL requests, first-class
  • ✓Request chaining: the output of one step feeds the next
  • ✓Run history, diff & JSON evidence export

Worth paying for

Two tiers, sold separately. Pick the one that matches the work you do.

Engineering · for shipping integrations

  • →More protocols: IMAP, LDAP, MySQL/MariaDB, MongoDB & PostgreSQL (query & assert on the response)
  • →JavaScript and Groovy scripting: programmatic chains, loops & custom logic
  • →MITM proxy & service-virtualization mocks
  • →Enterprise & Windows auth: NTLM, PtH, SPNEGO/Kerberos, AWS SigV4
  • →Test suites: ordered chains with setup and teardown, one verdict, JUnit output for CI
  • →Skills: publish a chain or script under a fixed contract an agent can call

Security · for breaking them

Everything in Engineering, plus:

  • →Fuzzing & wordlist iterators: malformed packets, byte for byte
  • →Security protocols: SMB & Kerberos, for Active Directory work
  • →Pentest libraries: Active Directory, API, per-protocol packs

Students & academics: the full Security tier is free with verification. Academic License →

The library · preview it right now

A thousand ready-made tests to start from

The bundled library ships recon sweeps, fuzzing payloads, kerberoasting, JWT brute-force, AD enumeration and integration smoke tests, plus curated multi-step chains. Find one, import it into a bundle, run it. The whole catalogue is searchable below.

1,000+ ready-made tests 14 collections 130+ multi-step chains recon · fuzzing · AD · API · integrations
Search the library → What unlocks the packs

Anatomy of a chain

register → mail → verify → directory. One file.

Steps pass data to each other through {{variables}}. Iterate over a list, branch on a response, fan steps out in parallel, or call another chain as a sub-routine. Cross protocols freely. Replay it on your desktop, in CI, or on the execution server inside your network.

HTTP POST /v1/users · register extract $.id → vault.user
→
IMAP INBOX · FROM noreply@ extract token from body
→
HTTP PUT /v1/verify?t={{token}} assert 200 · verified
final step: LDAP bind to dc.target · assert cn=user in OU=Verified · exported as signup-flow.chain.json
VirtuProbe Studio/Chain editor
4 steps · passing
The chain editor: a multi-step HTTP → IMAP → LDAP flow with per-step extractors and assertions in one runnable file
Every step, extractor and assertion in one file you can replay in CI
Browse ready-made chains → How chaining works

Testing in the age of AI

Why testing the real thing matters more in the AI era

When an AI can ship an integration in an afternoon, the bottleneck stops being "write the code." The bottleneck is knowing it actually works, under load, against malformed input, on the protocol that doesn't quite follow the spec.

An AI happily writes the happy path. It will not, on its own, send a CRLF in a header field to see what your reverse proxy does. That part is on you, and it is what this is for.

Code review shows intent.
Running it shows behavior. Especially after the model writes the code.
01 · the shift

Writing the code stopped being the slow part.

Generated code ships in minutes. The bugs ship at the same pace, and nobody on the team read them carefully enough to know.

A test that exercises the running system is the thing that tells you what actually shipped, and it is the part nobody generated for you.

Verify at the boundary. Anything else is a hot take.
02 · the blind spot

A model writes the request the server expects.

Models are trained on code that works. They generate clients that respect the spec, requests the server expects, fields the SDK exposes.

Adversarial input, undocumented protocol corners, deliberately broken envelopes: none of it is in the training set. That's where production breaks.

The unhappy path is the human's job again.
03 · the workbench

We wrote the protocol stacks ourselves.

Our HTTP, SMTP, IMAP, LDAP, DNS, SMB, Kerberos and SpamAssassin are written from scratch against the RFCs, so you can send what the spec forbids, fuzz with §payload§, and see the real traffic.

An AI can write the chain that says your signup flow works. Running it against the real thing is how you find out whether it does.

Composable probes the model can suggest, and a real run can confirm.

Three ways to run it

Desktop app or distributed. Always on your infrastructure.

VirtuProbe Studio is a desktop application, and by default everything it needs runs on your laptop. When the systems you have to reach sit somewhere your laptop does not, the execution server goes into that network instead and the application connects to it, so probes fire from inside rather than over a VPN.

Standalone

Desktop app

One install, nothing to stand up alongside it. Open it, probe things, close it.

[ your machine ] VirtuProbe Studio ↓ targets
  • macOS, Linux, Windows
  • Workspaces stored locally on disk
  • Nothing to deploy or maintain
Split execution

Execution server inside the target network

Put the execution server where your targets live. You keep working in the same application, and the probes fire from inside that network.

[ your machine ] [ target network ] VirtuProbe → execution server ↓ targets
  • Reach internal services with no VPN required
  • The execution server ships as a container image
  • One port between the application and execution
Team

One workspace, the whole team

Point the app at a folder instead of its own database. Probes, chains and suites become plain files you can put in git and review like code.

git repository ↓ workspace folder ← everyone's app
  • Branch, diff and review a test like source
  • Pull a teammate's change and the app reloads
  • Environment values encrypt before they are written

Why you can install it

How we handle your credentials and data

VirtuProbe handles your credentials and fires at your infrastructure. That only works on trust, so here is how we treat it.

The makers

A small team, an independent business.

Built by a small team in Prague, an independent product rather than a VC growth experiment that pivots away next quarter. The people who make it answer the mail. Meet the team →

The build

Disciplined, reproducible releases.

Every installer comes out of an automated CI/CD pipeline, with no hand-built binaries. Even the backend it talks to runs as containerized services defined entirely in code (Terraform + Ansible), so nothing is configured by hand. SHA-256 checksums ship with every download, the changelog is public, and macOS builds are signed and notarized (Windows signing is next).

Your data

Nothing leaves your machine.

No cloud, no telemetry, no account. Workspaces live on your disk. Credentials sit in a local encrypted store, apart from your probes and never in run history. The app only phones home to validate a license and check for updates.

Disclosure

If you find something, tell us.

Security reports go straight to a human who wants to hear them, at security@virtuprobe.studio. We'd rather hear it from you than read about it elsewhere.

v2.3.1 · current build

Download VirtuProbe Studio.

You install it once. There is no cloud and no telemetry, a licence turns on the rest of the features, and execution stays on your machine or inside the network where your targets are.

v2.3.1 · macOS builds are signed and notarized; Windows builds are not yet code-signed, so Windows shows a security warning on first launch. How to proceed → · Windows code-signing is next on our roadmap · see what's coming →

SHA256: mac-arm64 · mac-x64 · AppImage · win-x64

Stay in the loop

New releases & protocol deep-dives.

Low volume, no marketing fluff, just releases, protocol notes and the occasional war story. Unsubscribe in one click. Your address stays with us and Buttondown, never sold.

No spam. No tracking pixels. GDPR-friendly, hosted in the EU.

Join our Discord