Testland
Browse all skills & agents

mountebank-imposters

Authors Mountebank imposters (multi-protocol mock servers - HTTP, HTTPS, TCP, SMTP, LDAP, gRPC, WebSockets, GraphQL, and more) by POSTing JSON definitions to the Mountebank control API on port 2525, configures stubs with predicates and responses, and uses record-playback proxy mode to capture upstream traffic. Use when the project needs a multi-protocol mock server beyond HTTP-only tools like WireMock or MSW.

Install with skills.sh (any agent)

npx skills add testland/qa --skill mountebank-imposters
View source

mountebank-imposters

Overview

Mountebank is a multi-protocol service-virtualization (mock server) tool: stand up on-demand mocks across many protocols by POSTing JSON imposter definitions to its control API on port 2525, so tests run against deterministic stubs instead of live dependencies.

Per mountebank-readme (opens in new window), supported protocols include:

  • HTTP / HTTPS
  • TCP (text and binary)
  • SMTP
  • LDAP
  • gRPC
  • WebSockets
  • GraphQL
  • SNMP
  • Telnet / SSH
  • NETCONF

Docs-domain note (verified 2026-05-04): the canonical mbtest.org domain was hijacked (redirects to an unrelated site), so this skill cites the GitHub repo bbyars/mountebank (opens in new window); mbtest.dev is the project's alternate docs domain. Verify both URLs before linking from authored content.

When to use

  • The project mocks non-HTTP protocols (TCP, SMTP, LDAP, gRPC). WireMock and MSW are HTTP-only; Mountebank covers the long tail.
  • The team wants record-playback proxying - Mountebank can proxy to a real upstream during recording, then replay the captured responses in subsequent test runs.
  • The team needs JavaScript injection for dynamic response computation per request.

If the team is HTTP-only on the JVM, wiremock-stubs is the lighter fit. For Node / browser HTTP-only, use msw-handlers. Mountebank's strength is multi-protocol breadth; pay the operational cost (a separate process, port 2525) only when you need it.

How to use

  1. Start Mountebank (mb start or the Docker image); the control API listens on port 2525.
  2. POST a JSON imposter to /imposters with a port, a protocol, and one or more stubs.
  3. Give each stub predicates (path / method / header / body matchers) and responses (the reply to send).
  4. Verify: GET http://localhost:2525/imposters/<port> and assert HTTP 200 with your stubs listed before pointing tests at it. If it 404s or the stub is missing, the POST body was malformed - fix the JSON and re-POST.
  5. Point the system under test at the imposter's port and run the tests.
  6. For an unrecorded upstream, use a proxyOnce proxy response to capture real traffic, then replay offline.
  7. DELETE /imposters/<port> in teardown (or restart Mountebank) so stale stubs don't leak between runs.

Install

npm install -g @mbtest/mountebank

(Per mountebank-readme (opens in new window).)

For Docker-based CI (preferred for runner cleanliness):

docker run --rm -p 2525:2525 -p 4545:4545 bbyars/mountebank:latest start

The control API listens on port 2525; imposter ports (4545 in the example) are configured per imposter.

Authoring imposters

Mountebank's data model uses these layers:

LayerPurpose
ImposterOne mock server bound to a port and protocol.
StubA request matcher attached to an imposter - the response triggered when matched.
PredicateA condition on the incoming request (path, method, header, body, JSON path).
ResponseThe reply Mountebank sends when a stub's predicates match.

Create an HTTP imposter

POST to the control API:

curl -X POST http://localhost:2525/imposters \
  -H 'Content-Type: application/json' \
  -d '{
    "port": 4545,
    "protocol": "http",
    "stubs": [{
      "predicates": [{
        "and": [
          { "equals": { "method": "GET", "path": "/orders/42" } }
        ]
      }],
      "responses": [{
        "is": {
          "statusCode": 200,
          "headers": { "Content-Type": "application/json" },
          "body": "{\"order_id\": 42, \"status\": \"shipped\"}"
        }
      }]
    }]
  }'

After this POST, GET http://localhost:4545/orders/42 returns the stubbed response.

Predicate operators

Beyond equals, Mountebank offers deepEquals, contains, startsWith / endsWith, matches (regex), exists, the boolean not / or / and, and inject for a custom JavaScript predicate. Full operator table: references/predicates-and-proxying.md.

Multi-stub responses (cycle through)

If a stub has multiple responses, Mountebank cycles through them in order on subsequent matching requests:

{
  "stubs": [{
    "predicates": [{ "equals": { "method": "GET", "path": "/poll" } }],
    "responses": [
      { "is": { "statusCode": 202 } },
      { "is": { "statusCode": 202 } },
      { "is": { "statusCode": 200, "body": "DONE" } }
    ]
  }]
}

Three calls: 202, 202, 200, then it cycles back. Useful for modeling polling endpoints.

Proxying for record-playback

Point an imposter's response at a real upstream with a proxy block. proxyOnce records the first response as a stub then replays it, proxyAlways records every call, and proxyTransparent passes through without recording. The record-playback config and the full mode table are in references/predicates-and-proxying.md.

Test framework integration

For Node.js test suites, use the mountebank npm package programmatically:

import mb from 'mountebank';

const mbServer = await mb.create({ port: 2525, allowInjection: true });

// POST imposter via fetch / axios / the mb client lib
await fetch('http://localhost:2525/imposters', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ port: 4545, protocol: 'http', stubs: [...] }),
});

// Run tests against http://localhost:4545

// Tear down
await fetch('http://localhost:2525/imposters/4545', { method: 'DELETE' });
await mbServer.close();

CI integration

# .github/workflows/integration.yml
- name: Start Mountebank
  run: |
    npx -p @mbtest/mountebank mb start &
    npx wait-on http://localhost:2525

- name: Seed imposters
  run: bash scripts/seed-mountebank.sh

- run: npm test

- name: Stop Mountebank
  if: always()
  run: pkill -f 'mountebank' || true

For a more robust pattern, run Mountebank in Docker as a sidecar service rather than a background process - kills + cleanup are cleaner.

Worked example

A test suite depends on a flaky third-party payments API. Record it once, then run offline. Create a proxy imposter that forwards every path to the real upstream in proxyOnce mode:

{
  "port": 4545,
  "protocol": "http",
  "stubs": [{
    "predicates": [{ "matches": { "path": ".*" } }],
    "responses": [{ "proxy": {
      "to": "https://payments.example.com",
      "mode": "proxyOnce"
    }}]
  }]
}

Run the suite once with the real upstream reachable: each distinct request hits payments.example.com and Mountebank stores the response as a stub. On every later run the stored stubs answer and the real API is never called - the suite is deterministic and offline.

Anti-patterns

Anti-patternWhy it failsFix
Hard-coded imposter ports across many testsPort collisions under parallel CI execution.Use dynamic ports; capture them from the control API's response.
Predicates with regex that match unintended pathsTest passes because the wrong stub responded.Anchor regexes (^/$); prefer equals over matches when possible.
allowInjection: true in production-adjacent envsJS injection is powerful; allows arbitrary code execution.Only enable for local / CI; never on a shared mock server.
Forgetting to delete imposters between test runsStale imposters persist across runs; tests interfere.DELETE /imposters/<port> in test teardown OR restart Mountebank.
Recording in proxyAlways mode and committing the capturesCaptures may include real PII / tokens.Use proxyOnce; review captured stubs before committing; scrub PII via JSON Schema or jq pre-commit.

Limitations

  • Operational overhead. A separate process / container per CI run; harder to set up than in-process WireMock or MSW.
  • JSON-heavy authoring. Imposter definitions are JSON-by-API; there's no fluent DSL like WireMock's stubFor.
  • Documentation domain reliability. See the docs-domain note in the Overview: cite the GitHub README and mbtest.dev.

References

  • mountebank-readme (opens in new window) - main repo: install, supported protocols, key features.
  • mbtest.dev - alternate documentation domain (verify before linking).
  • wiremock-stubs - HTTP-only alternative on the JVM.
  • msw-handlers - HTTP-only alternative for browser + Node.

Mountebank predicate operators and proxying

View source (opens in new window)

Mountebank predicate operators and proxying

Reference detail for mountebank-imposters (opens in new window): the full predicate-operator set and the record-playback proxy modes.

Predicate operators

Mountebank supports several predicate operators in addition to equals:

OperatorMeaning
equalsExact match.
deepEqualsDeep equality on a nested object (e.g. JSON body).
containsSubstring / partial match.
startsWith / endsWithAffix matchers.
matchesRegex match.
existsWhether a field is present.
notNegate a child predicate.
orBoolean OR.
andBoolean AND.
injectCustom JavaScript predicate.

Proxying for record-playback

Set up an imposter as a proxy to a real upstream:

{
  "port": 4545,
  "protocol": "http",
  "stubs": [{
    "predicates": [{ "matches": { "path": ".*" } }],
    "responses": [{
      "proxy": {
        "to": "https://real-upstream.example.com",
        "mode": "proxyOnce"
      }
    }]
  }]
}
ModeBehavior
proxyOnceFirst request hits upstream; response is stored as a stub; subsequent identical requests replay.
proxyAlwaysEvery request hits upstream; every response is stored.
proxyTransparentPass-through; nothing recorded.

proxyOnce is the canonical record-playback workflow - run tests once against a real upstream to populate the imposter, then run forever offline.

Related skills

bogus-data

Authors .NET test fixtures using the Bogus library - fluent typed `Faker` builders with `.RuleFor` per property, generation via `Generate()` / `GenerateBetween(min, max)` / `GenerateLazy()`, and `UseSeed()` for reproducibility. Provides the Bogus equivalent of Python's Faker / Ruby's FactoryBot. Use when the project is C# / F# / VB.NET and the team needs typed fixture creation.

boundary-value-generator

Generates boundary-value test cases from typed input specifications - for each input field, produces the canonical 6-point set (one below, at, and above the lower bound; one below, at, and above the upper bound) plus equivalence-class representatives. Emits cases as parameterized test inputs (pytest @parametrize / Jest test.each / xUnit InlineData / etc.). Use when a function or endpoint has numeric / string-length / collection-size constraints and the team needs systematic edge-case coverage.

e2e-test-narrative-builder

Assembles a multi-step end-to-end user-journey test from a list of high-level user intents - translates each intent ("user signs up", "user adds product to cart", "user completes checkout with promo code") into the corresponding test-runner step (Playwright / Cypress / Selenium / Karate), wires shared state across steps via test fixtures, and emits the resulting test as a single Scenario in the project's E2E framework. Use when scaffolding an E2E test that exercises a complete user flow rather than a single page.

factory-bot-data

Authors Ruby FactoryBot factories with traits, associations, sequences, and the three build strategies (build / create / build_stubbed); integrates with RSpec / Minitest test suites; pairs with Faker for randomized field values. Use when the project is Ruby / Rails and needs structured fixture creation with referential integrity.

faker-data

Authors test-data factories using Faker: the Python `faker` library, the `@faker-js/faker` JS port, and the `faker-ruby` gem. Owns the library mechanics end to end: install per language, the provider catalogue (person / internet / location / date / finance / lorem), locale selection and multi-locale mode, and seed-based determinism for reproducible runs. Scope is generating fresh values for tests that start from nothing, not replacing values inside an existing dataset that already holds real records, which raises referential-integrity and re-identification concerns this skill does not address. Prefer this skill when the codebase already uses the Faker family or when cross-language consistency across Python, JS, and Ruby matters; use mimesis-data only when deeper Python locale coverage is the primary requirement. Use when authoring fixtures or factories that need realistic-looking field values.

golden-file-conventions

Reference catalog for snapshot / golden file management - naming conventions, directory layout, when to add / update / remove a baseline, sanitization (timestamps, IDs, PII), per-OS / per-runtime variant strategy, and review workflow for snapshot diffs in PRs. Use when designing a snapshot-testing convention or auditing an existing one for drift.

malicious-payload-bank

Reference catalog of curated adversarial input payloads keyed by attack class - SQL injection, XSS, SSRF, path traversal, command injection, XXE, prototype pollution, regex DoS, Unicode confusables, header injection - plus per-context guidance for which payloads apply (URL parameter / form input / JSON body / file upload). Use when authoring negative-test cases for input validation, fuzz targets, or a security-focused test suite that needs to exercise the OWASP Top 10 attack surface.

mimesis-data

Authors Python test fixtures using mimesis - a fast, type-hinted, locale-aware test-data generator with 46 locales - covering Person / Address / Internet / Datetime providers and the Schema/Field pattern for typed-dict generation. Pairs with factory_boy when referential integrity is needed. Use when the project is Python and the team values speed, type hints, or strong locale coverage over Faker's larger ecosystem.

msw-handlers

Authors Mock Service Worker (MSW) request handlers for both browser and Node.js test environments using the `http.get` / `http.post` / `HttpResponse.json` API, wires them via `setupWorker` (browser) or `setupServer` (Node), and manages the test lifecycle (`server.listen` / `resetHandlers` / `close`). Use when the project uses JavaScript / TypeScript and needs to mock fetch / XHR at the network layer for both Vitest / Jest unit tests and Cypress / Playwright integration tests.

negative-test-generator

Generates negative / error-path test cases that mirror happy-path tests - for each happy-path test, produces companions exercising input validation rejection, missing required fields, type mismatches, authorization failures, rate-limit errors, and adversarial payloads from the malicious-payload-bank. Emits cases as parameterized tests in the project's runner format. Use when a feature has happy-path coverage but the rejection / error / unauthorized paths are untested.

pairwise-test-case-generator

Generates parameterized test inputs combining boundary-value, equivalence-class, and pairwise-combinatorial cases from a typed multi-input specification - produces the cross-product of cases up to a configurable strength (1-wise / 2-wise / N-wise) using all-pairs reduction so the test surface stays tractable. Emits cases in the project's test-runner-native parametrize format. Use when a function or endpoint takes 3+ inputs whose interactions matter and full Cartesian product would explode.

seed-data-curator

Builds a reproducible E2E seed dataset for the project's test environments - picks a representative user / org / data-product cross-section, generates the rows via the project's chosen factory library (FactoryBot / mimesis / Bogus / Faker + factory_boy), persists the dataset as a checked-in fixture (SQL dump / JSON / per-engine seed file), and wires it into the test bootstrap. Use when starting E2E coverage on a project that has no seed strategy, or when an existing seed has drifted.

synthetic-data-tool-selector

Chooses between the four mainstream synthetic test-data generators - Faker (JavaScript), FactoryBot (Ruby), mimesis (Python), Bogus (.NET) - picks the right tool by language and use case (raw value generation vs. typed factory orchestration), shows side-by-side equivalents for the same fixture across all four, and emits the language-appropriate code. Use when starting test-data work on a project and the team wants the "which tool should I use" decision documented.

synthetic-pii-generator

Generates realistic-but-fake personally identifiable information (PII) - emails, phone numbers, SSNs / national IDs, addresses, names, credit-card numbers (test BIN ranges), date-of-birth - for non-production environments. Wraps Faker / mimesis with PII-aware constraints so generated values match real format expectations (Luhn-valid card numbers, region-valid phone formats, ITIN/SSN format) without ever generating real-person data. Use when seeding test environments, building demo data, or replacing real PII in copied datasets.

test-data-patterns

Pure reference catalog of the cross-language object-construction patterns for test data - Test Data Builder (Pryce/Freeman), Factory (with traits and associations), Object Mother, Fixture composition (per-test / per-describe / shared), Snapshot (defers to `golden-file-conventions` for the operational details), and Production-Data Anonymisation. Distinct from per-language data wrappers (`factory-bot-data` Ruby, `faker-data` JS, `mimesis-data` Python, `bogus-data` .NET) which document tool-specific configuration; this catalog is the architecture-tier reference for choosing **which pattern** before reaching for the tool. Use when choosing a test-data construction pattern for a new suite, or auditing an existing suite whose fixtures have drifted into shared mutable state.

wiremock-stubs

Authors WireMock stub mappings for HTTP service mocking - `stubFor` with verb/path/header matchers + `willReturn` response shaping, lifecycle via `WireMockServer` (start / stop) or JUnit `WireMockExtension`, request verification via `verify()`, and dynamic-port allocation for parallel tests. Use when the project is JVM-based and tests need to mock HTTP dependencies (third-party APIs, internal microservices) at the network layer.