VirtuProbe Studio
v1.2.1 · macOS · Linux · Windows
Ship a flow, verify it at the wire, break it before production does — all in one chain across HTTP, SMTP, IMAP, LDAP, DNS, SMB, Kerberos. Hand-rolled stacks so you can bend the protocol when you need to.
Built by one engineer — 20+ years from core-banking to high-scale ad-tech — who hit the limits of every testing tool and built the one that wasn't there. The story →
New in v1.2
A built-in assistant — wired to your own model — builds chains and scripts on request, then runs them only when you approve. It suggests; the real protocol stack decides what's true. Bring your own key; we never charge for tokens, and the key never leaves your machine.
Just shipped · v1.2
An in-app AI assistant that builds and runs your tests — bring your own key, approve every write and run. A complete authentication overhaul: a unified credential store with OAuth2 (every flow), AWS SigV4, NTLM/Pass-the-Hash, SPNEGO/Kerberos, Basic, Bearer, API key and Digest — secrets stored apart from the probe. Service virtualization: turn the proxy into a mock server with match-and-respond rules. GraphQL requests, a real Groovy code editor with autocomplete & linting, and directory-backed workspaces you can share through your own git. Full notes in the changelog.
Screenshots
A quick tour of the actual app — no marketing mockups. Probes for shaping a single request, chains for stitching them into a flow, a proxy that catches whatever's on the wire, and the rest of the v1.2 toolkit.
Three jobs, one workbench
A Probe is one request on one protocol. A Chain is a flow of probes that pass data between steps. Iterate over a list, branch on a Groovy condition, fan out in parallel, or call a sub-chain. Mix protocols freely — fire an HTTP call, read the resulting email over IMAP, look the user up in LDAP, all in one runnable artefact.
The signup chain that touches HTTP, SMTP, IMAP and LDAP — captured once, replayable forever. One artefact instead of a folder of curl scripts.
Audit your mail server's edge cases without spinning up three CLI tools and a junk inbox. Score, bind, retrieve, resolve — all probes.
Implementations are written from scratch against the RFCs — so when you need to send something the spec forbids, the wire stays quiet and the bytes go out.
Capabilities
A probe is a request. A chain is probes in sequence. A script drives probes programmatically. A fuzzer fires a probe in a loop. Intercept captures traffic as probes. The model is the same everywhere — which means anything you learn in one place applies everywhere else.
One probe = one request, on one protocol. HTTP, SMTP, IMAP, LDAP, DNS, SMB, Kerberos — with hand-rolled stacks so you can send what the spec forbids.
A chain is a flow of probes that pipe data between steps. Branch on a response, run steps in parallel, call sub-chains, loop over a list. Cross protocols freely.
Intercept system-wide or scoped to a hostname. Every flow lands in a table you can filter by host, status class or method — and any line promotes to an editable probe, ready to chain, replay or fuzz.
Flip the proxy around. Match on method, host, path, header or body and return a synthetic response — so you can stand in for a service that isn't built yet, or force the edge case a real server won't give you.
One engine across pre/post-scripts, assertions, mutators and chain logic — now with a real code editor: syntax highlighting, autocomplete and linting. The full JVM ecosystem is one import away.
Curated probe packs and reference chains — OAuth flows, SMTP DSN edge cases, LDAP audits, spam-score regressions. Bring your own, share with team.
Point VirtuProbe at a folder and your probes, chains and environments become plain files. Share the workspace through your own git, Dropbox or network share; secrets stay in the local encrypted store. Version-control your tests like code.
Mark any probe field with §payload§, drop in a wordlist, and fire. Results land in a table — status, duration, body preview — so anomalies are obvious at a glance.
Bring your own model — any OpenAI-compatible endpoint, or a local one. It reads your responses, explains what broke, and builds chains and scripts on request. Suggests the chain; you run it on the real wire — and prove it. Every write and run waits for your approval.
Auth is one picker. OAuth2 — every flow — plus Basic, Bearer, API key and Digest are free. Windows & enterprise schemes (NTLM, Pass-the-Hash, SPNEGO/Kerberos, AWS SigV4, scripted, mTLS) unlock with a paid tier. Secrets live apart from the probe and never touch history.
Bring existing work in — OpenAPI, Postman, Bruno, HAR, .http or Insomnia — or paste a cURL/wget command onto a probe. Export back out as cURL, wget, Python or PowerShell. Switch tools without leaving your collection behind.
A first-class Query + Variables editor on the HTTP probe — your query and variables serialize into the request body and round-trip cleanly. Chain it, script it, fuzz it like any other request.
Free isn't a trial
The free workbench is a real tool, not a 14-day tease. We only charge for things that earn their keep for professional engineers and security pros — the heavy machinery. Everyday request work that other tools hide behind a login or a monthly bill stays free here, forever.
Students & academics: the full Security tier is free with verification — Academic License →
The library · preview it right now
Don't start from a blank request. The bundled library ships recon sweeps, fuzzing payloads, kerberoasting, JWT brute-force, AD enumeration and integration smoke tests — plus curated multi-step chains. Find one, import it into a bundle, run it at the wire level.
And you can search the whole catalog right here — no download, no signup. See exactly what ships, free and paid, before you install a thing.
Anatomy of a chain
A chain is a sequence of steps that pass data between each other via {{variables}}. Iterate over a list, branch on a response, fan steps out in parallel, or call another chain as a sub-routine. Cross protocols freely. Replay anywhere — desktop, CI, or the execution server inside your network.
Testing in the age of AI
When an AI can ship an integration in an afternoon, the bottleneck stops being "write the code." The bottleneck is knowing it actually works — under load, against malformed input, on the protocol that doesn't quite follow the spec.
An AI happily writes the happy path. It will not, on its own, send a CRLF in a header field to see what your reverse proxy does. That part is on you. That part is what we're for.
Generated code ships in minutes. The bugs ship at the same pace — and nobody on the team read them carefully enough to know.
Tests that exercise the wire, not the function signature, become the only artefact that proves what was actually shipped.
Models are trained on code that works. They generate clients that respect the spec, requests the server expects, fields the SDK exposes.
Adversarial input, undocumented protocol corners, deliberately broken envelopes — none of it is in the training set. That's where production breaks.
Our HTTP, SMTP, IMAP, LDAP, DNS, SMB and Kerberos are written from scratch against the RFCs — so you can send what the spec forbids, fuzz with §payload§, intercept what's really on the wire.
An AI can write the chain that proves your signup flow works. We make sure you can run it — and prove it didn't.
Three ways to run it
VirtuProbe Studio is a UI and an execution server. Bundle them into one desktop app on your laptop, or deploy the execution server inside the network where your targets live — so probes fire from inside, not over a VPN.
UI and execution bundled in one Electron app. Open it, probe things, close it.
Deploy the execution server where your targets live. Browser UI connects to it — probes fire from inside, not over VPN.
UI server central, browser-based clients, execution server deployed per engagement or environment.
Why you can install it
VirtuProbe handles your credentials and fires at your infrastructure. That only works on trust, so we earn it the boring way: keep your data on your machine, ship from a disciplined pipeline, and stay reachable by a human.
Built by a small team in Prague — an independent product, not a VC growth experiment that pivots away next quarter. The people who make it answer the mail. Meet the team →
Every installer comes out of an automated CI/CD pipeline — no hand-built binaries. Even the backend it talks to runs as containerized services defined entirely in code (Terraform + Ansible), so nothing is configured by hand. SHA-256 checksums ship with every download, the changelog is public, and code-signed installers are landing soon.
No cloud, no telemetry, no account. Workspaces live on your disk. Credentials sit in a local encrypted store, apart from your probes and never in run history. The app only phones home to validate a license and check for updates.
Security reports go straight to a human who wants to hear them — security@virtuprobe.studio. We'd rather hear it from you than read about it elsewhere.
v1.2.1 · current build
One-time install. No cloud, no telemetry. License unlocks all features. Execution stays on your machine — or inside the network where your targets are.
v1.2.1 · macOS & Windows builds are unsigned in this release — your OS will show a security warning on first launch. How to proceed → · Code-signed installers are top of our roadmap — see what's coming →