Changelog

On the horizon

A look at where VirtuProbe is heading next. Plans, not promises — but this is what we’re building toward.

Windows and Linux code-signing (top priority). macOS builds are now signed and notarized, so they open with no Gatekeeper warning. Windows Authenticode and Linux signing come next. Every download ships with a published SHA-256 checksum you can verify.
More authentication — mutual TLS (client certificates), OAuth 1.0a and other long-tail schemes, and automatic credential mapping when you import an API description.
Team collaboration — shared workspaces built on the new directory storage, so a whole team can work from one git-backed source of truth.
Bring your own secrets — reference credentials straight from your password manager or vault instead of storing them in VirtuProbe.
More from the mocking proxy — rewrite live requests and responses, inject faults and latency, script dynamic mock responses, and generate mock rules straight from an API description or a captured session.
Even faster startup — precompile the interface during the build so the app skips in-browser compilation entirely and opens instantly, even on the very first launch.
Run from CI — headless, scriptable test runs with JUnit-style output you can wire straight into a pipeline.
More importers — turn network scans, security templates, API schemas, mail messages, and zone/directory files into ready-to-run probes.
Export everywhere — send your bundles back out to the standard API and capture formats.
gRPC — first-class support for gRPC services.
Freestyle protocol — a build-it-yourself protocol mode for the long tail: define a raw request/response exchange over TCP or UDP and put it straight on the wire, no dedicated module required. And if you’d rather we ship a proper module for the protocol you need, just ask — the ecosystem is built to grow.
Whole-project context for the built-in assistant, so it can reason about everything in your workspace rather than the thing in front of it.
Industrial / OT protocols — starting with Modbus TCP for battery energy storage, inverters and PLCs, with IEC 60870-5-104, IEC 61850 and related protocols further out. Same model as everything else: probes, chains, extractors and run evidence on the wire. Aimed at integration and security testing of energy sites (including work driven by NIS2), not at becoming a SCADA historian.

2.2.2 Latest

The interface opens light by default, and panels now respond the moment you click them.

Changed

Light by default. VirtuProbe starts in the light theme. The palette was rebuilt against measured contrast rather than by eye, so text and controls meet AA on both themes. Dark is one click away in Settings and your choice is remembered. The app bar keeps its dark panel in either theme, which is what the brand mark needs to stay legible at the size it renders.
Motion off. Transitions and ripples are gone. Menus, tooltips and side panels appear the instant you ask for them instead of easing in. Progress spinners and loading bars still animate.
Licence activation by keyboard. The activation dialog now focuses the email field when it opens and submits on Enter.

Added

OAuth2 token visibility. The auth tab on an HTTP probe shows the state of the access token it is holding, so you can see whether a token exists and when it expires without sending a request to find out.

Fixed

Bruno collections import again. Importing a Bruno collection failed on collections that used OAuth2, and the token exchange sent a scope parameter where the flow did not call for one. Both are corrected.
Probes built by a script or an agent send correctly. A probe assembled programmatically leaves out fields the editor always fills in, and the direct send path assumed they were present, so the request came back as a server error instead of going out. It now applies the same defaults a person would have set.
Anonymous SMB share listing. Listing the shares on a server that permits anonymous access now works on its own, without first connecting to a share.
The MCP panel no longer carries state between probes. Switching to another probe resets the stream instead of showing the previous probe’s session.

2.2.1

The first probe editor you open now renders straight away.

Changed

Faster first probe. Opening your first probe used to pause on a brief blank editor while the protocol editors compiled. They now warm up in the background the moment the app is ready, so the first probe you create or open appears instantly. Groundwork for the fully precompiled interface still on the way.

2.2.0

Scripts can now be written in JavaScript. The scripting engine speaks JavaScript on GraalJS alongside Groovy, and new scripts default to JavaScript.

Added

JavaScript scripting. Anywhere VirtuProbe runs a script you can now write it in JavaScript on GraalJS, or stay on Groovy, and a new script starts in JavaScript. It is the same vp.send(...) API and the same probe results you already script against, so the code reads the way the rest of your test does. The choice of language reaches every place a script runs: a standalone script, the condition on a chain step, the script action in a proxy rule, and scripted credential authentication. The editor gives you syntax highlighting, autocomplete and linting for both, and you switch language per script with one control.

Changed

Linux ships as the AppImage only. The .deb package is no longer built. The AppImage runs on any Linux distribution with nothing to install, so one artifact covers what the two used to. If you were on the .deb, download the AppImage from the site instead.

2.1.2

Two fixes to how the desktop app starts and stops.

Fixed

The app always finishes starting. A single saved preference left over in an old format could fail to load while the app was still setting itself up, before the interface had mounted, and the result was a loading screen that stayed up for good. It only happened in the desktop app, and only to a value written by a much older build, but when it happened the app was unusable with nothing on screen to explain why. A saved preference that cannot be read now falls back to nothing selected and is cleared, so one bad value can never hold up the whole app again.
The app shuts down cleanly on a Mac. Quitting could leave the part that runs your requests alive in the background, still holding its port, so the next launch could attach to that stale process instead of starting fresh. Closing the window now quits the app, and quitting waits for that background process to stop before the app exits.

2.1.1

Mostly about what is stored where, and about an agent being able to finish the job without asking you to do part of it by hand.

2.1.0 carried everything below but never reached anyone: it was replaced the same day by this build, which is the one you want on an Apple Mac.

Fixed on Apple Silicon

The app now runs natively on Apple Silicon. VirtuProbe itself was always a native build, but the Java runtime inside it was an Intel one, so the part that actually sends your requests ran under Rosetta translation. It was slower than it needed to be, and it would have stopped working altogether when Apple removes Rosetta. Nothing to do on your side beyond installing this build; the Apple Silicon download is the same link it always was.

Added

Optional encryption of environment values in a shared folder Directory storage. Environment variables are workspace content, so they travel with the folder and land in your git history. That is right for a base URL and wrong for a token. You can now turn on a workspace password and have the values written wrapped instead. Variable names stay readable, so the tree still reviews and merges as a text diff, and a value you did not touch is left byte for byte as it was, so a commit shows only what actually moved. The password stays on your machine and is never written into the folder. Anyone opening the workspace is asked for it, and until they enter it VirtuProbe will not load or write the folder, because carrying on would mean putting every value back in the clear. Off by default. It protects future commits only: anything already shared in plain text stays in the history, so rotate it. See Workspace storage.
An agent can create a project and a suite. It could read both and author neither, so a task would stop halfway and ask you to go and make one by hand. It can also propose a skill from a chain you already have, and the proposal is handed to you for review rather than saved, because deciding which inputs are secret is yours to make.
An agent can aim a run at an environment. Chains, suites and probes an agent runs now resolve {{variables}} against the environment you have selected, which is what pressing Run does. It can name a different one if it needs to, and then it gets that environment’s variables but never its stored credentials. Choosing what a credential points at stays with you, which is also why an agent cannot change the environment you are working in.

Security

Your credential store now has a key of its own. It was protected by a key that shipped inside the application, identical in every copy, so anyone who unpacked a download held the key to any installation’s stored credentials. Each installation now generates its own, or takes one from your operating system’s keychain on the desktop. Existing stores are re-keyed on first start and the previous file is kept alongside. Nothing is asked of you.
The API key for the built-in assistant, and your licence key, moved into that encrypted store. They were in the general database, which is not protected in the same way.
Everything VirtuProbe writes for itself is now readable only by you. The databases and the proxy’s certificate authority were readable by any other account on the machine. The proxy one matters most: it is the private key behind a certificate you install in your own trust store.
The Linux .deb keeps the browser sandbox on. It was being switched off for every Linux build, including the package that never needed it. The AppImage still needs it off, which is a limitation of that format rather than a choice.

Fixed

Your plan is shown correctly the moment you activate it. Everything unlocked properly, but the licence card kept saying Free until you restarted.
You can see which step of a chain failed. Opening a run from history, or jumping in from Agent Activity, left the step list looking identical whatever the run did, so finding the failure meant scrolling to the results and matching by name. Steps are now marked with their result and a restored run scrolls to the first failure.
A run in Agent Activity is named. It showed a raw identifier for exactly the runs you most need to read, the ones an agent created while you were watching, and repeated runs of the same chain were indistinguishable. They now carry the name and the time.
A project you create for an agent appears in the approval dialog instead of only after a restart. Approving also pre-selects unassigned bundles and offers a one-click full access, so approving an agent you trust is not a row of checkboxes.
A chain step can point at a saved probe again. Referring to a probe rather than copying the request into the step failed outright, so an agent building a chain had to duplicate every request and the probes became dead weight.
The chain linter stops flagging something it cannot see. When a step referred to a saved probe, the linter could not read inside it, so it reported a variable as unused when the probe was using it, and following that advice broke the chain. It also means a skill proposed from such a chain now arrives with its inputs filled in rather than empty.
A step with nothing to send is reported before you run it, naming the step, instead of failing mid-run with a message about internal state.
Wrong input is answered as wrong input. Supplying an incorrect workspace password reported a server error rather than telling you the password was wrong.

2.0.1

A follow-up to 2.0.0, fixing the things a brand new workspace ran into first.

Fixed

Opening something from outside the Explorer now actually opens it. A dashboard counter, a global search result, a keyboard shortcut and a failed step in Agent Activity all changed the address without opening the thing they named. With a tab already open you never noticed, because the view was mounted anyway. With nothing open, which is every fresh install, they appeared to do nothing at all.
A fresh install opens the Dashboard instead of the placeholder that tells you to open something from the Explorer, which was the first screen a new user ever saw.
The Dashboard shows current figures. It read its counts once at startup, so anything you created afterwards was missing until you restarted.
The first chain saved into a new workspace no longer fails. Saving a chain, script, suite or skill into a workspace that had no Default bundle yet returned a server error, so on a brand new install the first thing you authored could not be saved.
The REGEX extractor can see the response it is matching against. Against every protocol whose response is structured rather than plain text, it was handed an object reference instead of the data, so no pattern could ever match and the step failed with “No match for regex”. That reads as though your pattern were wrong, when the extractor had never been shown the response.
Function keys no longer swallow the combinations built on them. A bare F-key shortcut also captured the same key pressed with a modifier.
A dropped connection to the run event stream no longer writes a stack trace to the log. A subscriber going away is ordinary, not an error.

2.0.0

Added

One workspace tree. Chains, scripts, suites and skills now live in bundles, the same containers as probes, instead of being owned directly by a project. A bundle belongs to zero or more projects, and everything inside it inherits that scope: an artifact is visible when its bundle is free or belongs to the active project. The Project Explorer is a single bundle tree, with no separate Chains, Scripts, Suites or Skills lists. Each project has a Default bundle where new work lands, there is a global Default for free artifacts, and moving an artifact to another bundle is how you re-scope it. Existing workspaces migrate automatically: a project’s items move into that project’s Default bundle, and anything that was unowned becomes free. See Bundles.
VirtuProbe can be driven by an external AI agent. Connecting one is not a paid capability and carries no tier of its own: an agent inherits exactly the licence you hold, so the free HTTP workbench has a real agent story and each capability keeps whatever tier it already had. It speaks the Model Context Protocol, so an agent in a tool you already use can discover what this instance can do and run it. It can do what you can do: create a probe and send it, save a chain and run it, run a suite, create an environment, run a script, import a collection, and read the workspace to find its way around. That is a fixed set of tools rather than one tool per capability you own, because an MCP client loads every tool definition into the agent’s context before the conversation starts, and a tool per capability would put your whole library there on every request. Your licence still decides what actually runs, through the same checks the interface goes through, and secrets are the one thing an agent can never be handed. See Driving VirtuProbe from an agent.
Skills, the unit an agent actually calls Engineering tier to run. Authoring one and listing what exists stays open on every tier. A skill is a named capability with a declared contract, typed inputs and named outputs, wrapping a chain or script you authored and reviewed. Arguments are validated before anything runs, and arguments you did not declare are ignored. An input marked secret takes the name of a credential binding, never a secret value, so there is no route for an agent to pull a real credential into its own context.
A guidance document generated per instance. An agent connecting to VirtuProbe can read what this installation can do, how to interpret a result, and when to stop and involve a person. It is assembled from your licence, so it never advertises something you would be refused, and it cannot go stale the way a bundled file would.
An API access token, in Settings, with reveal, copy and rotate. It is required whenever the server is reachable beyond your own machine, so exposing the server switches authentication on by itself rather than leaving it to a second setting you might forget.
You can watch what an agent is doing. Every run an agent triggers is streamed live and tagged as agent-driven, and you can subscribe to that stream without knowing anything about the run in advance. Ask for everything, or only for the failures, which is the shape supervision is meant to take: not sitting and watching, but being told when something breaks.
Agent Activity, the in-app view of the above. Connected agents are listed with the runs they start, step by step as they execute. A new agent can read your workspace but cannot change or run anything until you approve it, and approving is a choice of which projects it may reach: anything outside that is refused, and the refusal shows up in the list with its reason rather than failing silently. You can block an agent while it is working. A failed step is a link that opens that chain at that step in the editor, so you can take the work over without interrupting the agent.
A chain linter. Static analysis that answers the question a green run cannot: is this a good test? It flags a chain with no assert, an assert on a variable nothing produces, an extractor whose output nothing reads, a condition that can never fire, a reference cycle, and more. It runs in the chain editor, and on the approval card when the built-in assistant offers you a chain.
The Project Dashboard is built around bundles, matching the Explorer: what is in the active project, what is available to it, and what each bundle holds. Clicking a bundle reveals it in the Explorer instead of opening an empty view.
The desktop app no longer fails to start when port 10100 is taken. It takes the first free port in a small range and reports it, and the footer shows the port the server and the agent endpoint are actually on.
Test suites Engineering tier — the layer above a chain. A suite runs an ordered set of chains together, with setup chains that build the state the tests need, teardown chains that always run afterwards, and one aggregated verdict. Setup output feeds the tests; test chains stay isolated from each other, so none can quietly depend on another; a failing setup skips the tests instead of producing confidently wrong results; a failing teardown does not turn a passing suite red. Suites live in bundles like chains and scripts, and open as an editor tab. See Suites overview.
Live run progress. Chain and suite runs now execute in the background and stream progress back as they go: each step, and for a suite each chain, is marked running, passed or failed the moment it happens, instead of a spinner until the whole thing finishes.
Suite reports. JSON evidence of the run you just watched (nothing re-runs), JUnit XML for CI with one testsuite per chain and skipped chains reported as skipped, and the last 20 runs kept in history.
The dashboard now leads with test health — pass rate over recent runs, the latest chain and suite runs, and what regressed — instead of counting how many probes you own. A regression means something that used to pass and now fails, with the failing streak and when it last passed; something that never passed is unfinished work, not a regression.

Fixed

The Project Explorer could come up empty. A missing import meant loading it threw, and because the failure happened while the tree was being built, nothing appeared at all: no bundles, no chains, no scripts. The application still rendered, so it looked like an empty workspace rather than an error.
The server now listens on your machine only. It previously accepted connections from any device on the same network, with no authentication, which meant anyone on an office or cafe network could read your workspace and run chains using your stored credentials. Deployments that are meant to be reachable set one environment variable, and that also turns the access token on.
The condition hint taught a comparison that never matches. The example alongside a CONDITION step showed an unquoted placeholder, which compares a number against text and is therefore always false. Anyone following it got a branch that silently never fired while the chain still passed.
The interactive API browser no longer ships in released builds. It published a complete map of every endpoint, which an installed application has no reason to hand out.
An unresolved variable now says so. A probe URL of {{baseUrl}}/health used to fail with “not a valid HTTP URL”, which pointed at the symptom. The error now names the variable and the field, and tells you to check that the right environment is active and saved.
Unsaved environment changes are visible. Variables only take effect once the environment is saved; the editor now marks unsaved changes and says what that means, instead of leaving them looking active.
A request an agent wrote now sends its headers. Headers, query parameters and cookies carry an enabled switch that the editor sets on every row. A request built by an agent does not have it, and those rows were being treated as switched off, so an agent’s JSON POST arrived without its content type and came back rejected.
Deleting a project no longer strands its bundles. They become free and stay visible, instead of disappearing along with the project.
The assistant button only appears once the assistant is configured, rather than inviting you to open something that cannot answer.

1.5.0

Broader reach and fewer surprises: signed macOS installers, a new PostgreSQL database probe, environment-scoped credentials, and the ability to trust self-signed certificates on any TLS probe.

Added

PostgreSQL probe Engineering tier — VirtuProbe’s third database protocol, after MySQL and MongoDB. Connect to a PostgreSQL server, run a SQL statement, and get back a result-set table, an affected-row count, or the server’s error. Authentication uses the credential store (a Basic credential — no password on the probe), with the full transparency panel (effective credential, reveal-on-demand, per-run override). PostgreSQL is a first-class chain step, with extractors POSTGRES_SUCCESS, POSTGRES_ROW_COUNT, POSTGRES_AFFECTED_ROWS, POSTGRES_COLUMN, POSTGRES_ERROR_CODE (the SQLSTATE), and POSTGRES_JSON. Connections are pooled and reused. See PostgreSQL probe.
Environment-scoped credentials. Credentials can now travel with your environments, the same way variables already do. An environment binds a name to a credential; a probe references that name in its Auth, and switching the active environment swaps the whole credential (scheme, config and secrets) without editing the probe. This is the prod-vs-staging case in one probe instead of two. Bindings resolve for a direct send, in chains and in scripts, and the effective-credential summary shows exactly which credential each environment resolves to. Chain and script runs now also carry the active environment’s variables, so {{variables}} resolve on a chain run as they do on a direct send.
Compare environments. A new diff view (toolbar action in the Project Dashboard) shows two environments side by side, for both variables and credential bindings: what is only on one side, what differs, and what matches. Copy any entry either direction, or copy every missing entry at once, to bring a new environment up to date or reconcile two that have drifted.
Trust self-signed certificates: a per-probe toggle on the HTTP, SMTP, IMAP, and LDAP probes. Point at a server that presents a self-signed or private-CA certificate (implicit TLS, STARTTLS, or MCP over HTTPS) and the probe connects instead of failing the handshake. Off by default, set per probe.
Signed macOS installers: the macOS builds are now Developer ID signed and notarized, so they open without a Gatekeeper warning. (Windows installers are not yet code-signed and still show a SmartScreen warning on first launch.)

Fixed

The app now opens in about a second. Previously the first load could take ten seconds or more while the entire editor interface compiled up front; the protocol editors now load on demand.
Deleting a probe from the toolbar now refreshes the Project Explorer straight away.
Explorer menu actions that open a dialog now close the menu first, instead of leaving it open behind the dialog.
Folder-based workspace export now writes one file per probe (it was writing one per stored revision), which fixes scrambled folders and a phantom “Error sending request” after an export.

1.4.0

The theme is doing more without hand-driving the protocol: outcome-level forms for email and directory probes, first-class MCP testing, and a new database — with the Kerberos roasting path fixed end-to-end.

Added

Action Mode for SMTP, IMAP and LDAP — you no longer have to hand-drive the protocol conversation to do the common thing. Each of these probes now opens in an Action form:
- SMTP → Send email — fill From / To / Subject / Body (with a Plain/HTML toggle) and VirtuProbe runs the whole EHLO → STARTTLS → AUTH → MAIL FROM → RCPT TO → DATA → QUIT handshake.
- IMAP → Find / verify message — set a mailbox and search filters, and get back whether a message exists, a match count, or the latest message/header. Two new extractors — IMAP_MATCH_COUNT and IMAP_MESSAGE — make the classic email-verification chain trivial: sign up over HTTP, find the mail, and pull the confirmation code out with a REGEX.
- LDAP → Check login / Find entry — validate a DN + password, or search a base + filter for entries (new LDAP_MATCH_COUNT extractor).
Authentication uses the shared credential store — the password never touches the probe — and every field takes {{variables}}, so actions chain and script like any other step. The raw command editor is still one click away as Advanced mode (and Edit as commands converts an action into it), so fuzzing and exact wire control are untouched. See the SMTP, IMAP and LDAP docs.
MCP requests — the HTTP probe can now test Model Context Protocol servers. A new MCP mode on the Body tab (alongside Raw and GraphQL) gives you transport (Streamable HTTP or legacy HTTP + SSE), method and JSON params pickers, and serialises a JSON-RPC 2.0 request for you. Streaming responses are shown live in the response panel, the session threads through a chain with the new MCP_SESSION_ID, MCP_TOOL_NAMES, MCP_RESULT and MCP_ERROR_CODE extractors, and every MCP response is scanned for tool-poisoning prompt injection. Sending needs the Engineering tier. See the HTTP probe docs.
MongoDB probe — a new database protocol (Engineering tier). Connect by host/port or a full mongodb:// / mongodb+srv:// connection string, authenticate from the credential store, and run any of eight operations: find, insert, update, delete, aggregate, count, run-command, and list-collections. Results come back as pretty-printed documents or a write summary. MongoDB is a first-class chain step, with extractors MONGO_SUCCESS, MONGO_DOC_COUNT, MONGO_FIELD (reach any document with [n] / [*]), MONGO_ERROR_CODE, and MONGO_JSON. A Form / Shell toggle lets you paste a full db.collection.find(...).sort(...) query verbatim instead of filling fields. See the MongoDB probe docs.

Fixed

Kerberoasting and SPNEGO now work against live KDCs — three RC4-HMAC conformance bugs in the hand-rolled Kerberos stack (the RFC 4757 key-usage translation, the missing TGS request-body checksum, and a mis-tagged authenticator field) are fixed, so Kerberoast returns a real $krb5tgs$23$ hash and SPNEGO / Negotiate authentication completes.
Live MCP streaming works across a split UI / execution deployment — the streaming request header is now allowed cross-origin, so text/event-stream MCP responses stream into the panel even when the UI and execution servers run on different origins (a same-origin desktop install was already fine).

1.3.1

A reliability release: a probe against an unreachable host no longer hangs the run, plus a couple of smaller fixes.

Added

Network timeouts — the SMTP, IMAP, LDAP and SpamAssassin probes now apply a connection and a read timeout, so a probe against a firewalled or unreachable host fails in seconds instead of hanging indefinitely. The limits are configurable under Settings → Network timeouts (default 10s connect / 30s read; set to 0 for no limit). The HTTP, DNS, SMB, Kerberos and MySQL probes already enforced their own timeouts.

Fixed

The Project Explorer refreshes after the AI assistant creates or moves something — a chain, script or bundle the assistant builds now shows up in the tree straight away, instead of staying hidden until a manual refresh.
The update check only runs in the packaged desktop app — it no longer fires during local development or in the browser.

1.3.0

A reorganised, editor-style workspace with keyboard-first navigation, MySQL — the first database protocol, plus raw, wire-level HTTP requests and a real malformed-packet fuzzing engine.

Added

MySQL probe Engineering tier — VirtuProbe’s first database protocol. Connect to MySQL or MariaDB, run a SQL statement, and get back a result-set table, an affected-row count, or the server’s error — so a chain can finally confirm the row an API call was supposed to write actually landed. Authentication uses the credential store (a Basic credential — no password on the probe), with the full transparency panel (effective credential, reveal-on-demand, per-run override). New extractors MYSQL_SUCCESS, MYSQL_ROW_COUNT, MYSQL_AFFECTED_ROWS, MYSQL_COLUMN, MYSQL_ERROR_CODE, and MYSQL_JSON pull values into the chain. Connections are pooled and reused. See MySQL probe.
A unified workspace — VirtuProbe is now organised like a code editor: a single Project Explorer on the left (bundles, chains and scripts in one tree, visible on every screen) and browser-style editor tabs. Whole views — the Dashboard, Project Dashboard, Proxy and Library — open as tabs too and can only be open once. Your open tabs are remembered per project. See The workspace.
Reveal in Explorer — press Alt+F1, or turn on autoscroll, to locate the active document in the Explorer tree.
A zoned top bar — the navigation drawer is gone; app-view launchers sit by the logo, the active tab’s actions in the middle, and a single New Probe menu replaces the row of protocol buttons.
Keyboard-first navigation — a reworked shortcut set modelled on a modern IDE: focus the Explorer or editor, cycle and close tabs, jump to any bundle/chain/script, and run a Find Action command palette (Ctrl+Shift+A) — all from the keyboard. Every icon-only button now carries a tooltip, and shortcut-bearing ones show the key hint. See Keyboard shortcuts.
A smarter mocking proxy Engineering tier. Proxy rules gain three new actions beyond mock-and-forward: rewrite a live request or response, inject faults (error status or latency), and script a dynamic mock response. Build a service virtualization layer that reacts to real traffic.
Raw request mode Security tier — send the literal bytes of an HTTP request: a malformed request line, duplicate or conflicting headers, a Content-Length + Transfer-Encoding mismatch, bare-LF framing. The URL still supplies the connection target; {{variables}} and §payload§ resolve in the raw request. See Raw mode.
Transport outcomes — when an exchange fails below HTTP, the response shows a typed outcome (RST, TIMEOUT, EOF, MALFORMED_RESPONSE, PARTIAL) instead of a generic error — often the real signal after a crafted request.
Fuzz modes Security tier — the Fuzz tab adds Library mode (curated payload lists: CRLF, path traversal, SQL injection, XSS) and Mutation mode (generates structurally-malformed variants of the request) alongside the original payload Substitution. See Fuzzing.
Anomaly detection — fuzz results are scored against a baseline derived from the run; transport failures, differing statuses and length outliers are flagged so the leads stand out.
Fuzz run history and evidence export — each run is saved with the probe (latest 20); export a full run as JSON for reporting.
Request-smuggling desync detection Security tier — a new Smuggle tab on the HTTP probe runs a one-click check for HTTP request desync (CL.TE and TE.CL), comparing crafted requests against a clean baseline. It’s non-destructive — timing and framing only — and reports a clear verdict per variant (DESYNC / INCONCLUSIVE / NORMAL). See Request smuggling / desync detection.

Fixed

Importing a chain from the Library now asks for a target project (defaulting to your active project) and adds the chain there, so it shows up in the Chains view right away. Previously chain imports had no project and stayed hidden.
Cancelling a probe send now works on every protocol — the Cancel button stops the in-flight request instead of only appearing to. Non-HTTP probes gained the button too, and a running send can no longer be fired twice.
Project environment variables always resolve on send — {{variables}} are now substituted whenever a probe is opened, including straight from the Explorer tree, so they no longer occasionally reach the server unresolved.
Editing and deleting credentials is cleaner — you can edit a credential in place from the probe picker, and deleting a credential that a project used as its default no longer leaves a dangling reference.

1.2.1

A maintenance release that fixes a license-validation error at startup.

Fixed

License validation handles an unrecognised license cleanly — when the licensing service reported that a license was unknown or inactive, the app could surface an internal error during the startup license check instead of quietly falling back to the free tier. Every server response is now handled correctly, so startup stays clean and entitlements always reflect the licensing service’s actual answer.

1.2.0

The biggest release yet — an in-app AI assistant that builds and runs your tests, a complete authentication overhaul, and team-shareable workspaces.

AI assistant Free — bring your own key

In-app AI chat and agent — a built-in assistant you connect to your own model: any OpenAI-compatible endpoint (OpenAI, Gemini-compatible gateways, or a local Ollama). You bring the key; VirtuProbe never charges for tokens and your key stays on your machine.
It builds and runs your tests — ask it to create a chain or script and it will, then run it on request. Every step that writes or executes is gated behind an Approve / Reject card, with a ⚡ auto-approve toggle for when you want it to move fast.
Project-aware — it knows your active project, your tier, and which protocols you’re entitled to, and puts new work in the right place.
Hands on the workbench — it can search and import from the library, import collections (OpenAPI / Postman / Bruno / HAR and more), send a probe (resolving your environment variables), run a fuzz job, and move chains and scripts between projects.
Context-aware — attach a probe’s real request and response to the conversation, and get findings written up report-style (title · severity · target · evidence · recommendation).

Authentication

Unified credential store — HTTP authentication is now a single Credential picker. NTLM and Pass-the-Hash, previously a separate toggle, are now credential schemes alongside Basic, Bearer, API Key, Digest, OAuth2, AWS SigV4, Scripted, and SPNEGO. Secrets are stored apart from the probe and never appear in history.
SPNEGO / Kerberos for HTTP Security tier — authenticate to Kerberos-protected web services with an Authorization: Negotiate ticket obtained from the KDC for HTTP/<host>.
Project-scoped credentials — credentials can be Global or scoped to a project; new credentials default to the active project. The picker shows the active project’s credentials plus globals, and a project’s default credential is applied when a probe sets none (resolution order: chain step override → probe credential → project default).
Redesigned the New credential dialog (clearer layout, scope selector).
Auth transparency — the probe editor now shows the effective credential under the picker: name, scheme, a source chip (this probe vs project default), config values inline, and which secrets are set (masked) with a per-secret reveal on demand.
Per-run overrides — change credential config/secret values, or any {{variable}}, for a single send without editing the stored credential or saving the probe. The Variables panel also shows an effective table with each value’s source (environment < inline < this run).

Workspace storage

Directory-backed (“guerrilla”) workspace — point VirtuProbe at a folder and it stores your bundles, probes, projects, chains, scripts and environments there as plaintext files, so a team can share the workspace through its own git, Dropbox, or network share. Switch under Settings → Workspace storage; an empty folder asks whether to initialize a new workspace or clone your current one. Secrets always stay in the local encrypted store and are never written to the folder. Desktop only.

Proxy & service virtualization

HTTP interception mode — the proxy gains a second mode alongside the SOCKS5 tunnel: point a client’s http_proxy at VirtuProbe and it now terminates and parses each HTTP/1.1 request (HTTPS via CONNECT and an on-the-fly leaf certificate), so it can act on whole requests instead of raw bytes. With no rules defined it forwards transparently and still feeds the DevTools-style capture view.
Mock rules — build an ordered list of interception rules that match on method, host, path template, headers, or body (first match wins). A matching rule can return a synthetic response you define — status, reason, headers, body — without the request ever reaching the real server, so you can stand in for a service that isn’t ready yet. Rulesets are saved alongside the rest of your workspace and managed from the new Interception Rules editor in the proxy view.

HTTP & GraphQL

GraphQL requests — the HTTP probe’s Body tab has a new GraphQL mode with separate Query and Variables editors; VirtuProbe serialises them into the request and sets Content-Type: application/json for you. Existing GraphQL bodies are detected automatically, so probes round-trip unchanged.

Scripting & reliability

A real script editor — the Scripts view now has a proper code editor: Groovy syntax highlighting, context-aware autocomplete (your bundle and probe names inside vp.send(...), extractor IDs inside .extract(...), environment variables after {{, and VpProbeResult members), and live syntax checking that underlines errors as you type. Ctrl+S saves, Ctrl+Enter runs.
Scripts read responses naturally — vp.send(...) now targets the latest saved version of a probe, and results expose statusCode / headers / body directly so you can assert on them.
Tier limits enforced everywhere — running a chain or script that uses a gated protocol is now correctly licence-checked (building and saving such a chain stays allowed, so the assistant can still help you design one).
Resilient licensing — a subscription-server hiccup no longer drops a paying user to the free tier; the last validated entitlements are kept until the server is reachable again.

Interface

Project Dashboard is back in the left navigation, at the top of the drawer.

1.1.0

A big one — a new protocol, pentest-grade chains, import/export across the board, and a redesigned project workspace.

New protocols & authentication

Kerberos probe Security tier — a new probe type that talks directly to a KDC over port 88 with a hand-rolled RFC 4120 / RFC 4757 implementation (no GSSAPI, no third-party library). Three modes: credential validation (AS_REQ) with structured KDC error reporting; AS-REP Roasting for accounts with pre-auth disabled (hashcat $krb5asrep$23$, mode 18200); and Kerberoasting of any SPN-bearing account ($krb5tgs$23$, mode 13100). Hashes render on a copy-ready card; the Exchanges panel shows raw DER hex
Windows authentication in the HTTP probe — the Auth section now supports NTLM (username + password) and Pass-the-Hash (32-char hex NT hash) for IIS, Exchange OWA, SharePoint, ADFS, and any Windows Integrated Authentication endpoint; all fields support {{variables}}. New HTTP_AUTH_SUCCESS extractor for spray chains

Chains & scripting

Kerberos and SMB in chains and scripts — both can now be used as chain steps and via vp.send(...); placeholders resolve in host/auth/SPN and per-command paths. New extractors: KERBEROS_SUCCESS / KERBEROS_HASH / KERBEROS_ERROR_CODE and SMB_SUCCESS / SMB_LAST_STATUS / SMB_SHARE_LIST / SMB_FILE_CONTENT
Chain run history, comparison & JSON evidence — every run is auto-saved (up to 20 per chain); restore any past run, Compare two runs in a step-level diff, and export a run as structured JSON evidence for reports and audit trails
ITERATE: wordlists, rate control & stop conditions — drive an ITERATE step from a file on the server (one item per line); add a randomised jitter delay between iterations; stop on first success for credential-stuffing flows; and max failures to abort early

Import & export

Import Collection — generate a bundle of HTTP probes from OpenAPI 3.x / Swagger 2.0, Postman (v2.1), Bruno, HAR, .http / .rest files, or Insomnia exports; folders/tags become a nested bundle tree; provide a file, pasted text, or (OpenAPI) a URL
cURL / wget — in and out — paste a curl or wget command onto an HTTP probe’s URL field to fill it in (with Undo); and export any HTTP probe to cURL, wget, Python (requests), or PowerShell from the toolbar
Environment import & export — export an environment as a standard environment file; import standard environment exports, dotenv (.env), and Bruno environments
HTTP response diff — Compare any two entries in a probe’s history to see status, changed headers, and a line-level body diff

Bundles, projects & environments

Sub-bundle tree & project scoping — nest bundles into a tree (⋯ → Add Sub-bundle, or Move bundle); scope a bundle to zero or more projects so you only see what’s relevant. Delete a bundle (and its subtree) or Clone & Link it into a project
Redesigned project dashboard — the environment editor is now the main panel, with each environment on its own tab; linked bundles, probes, chains and scripts sit in a side panel (“Project Bundles” is now Linked Bundles). Per-environment toolbar actions: Save · Clone · Rename · Delete · Export · Import

Dashboard from the logo — the Dashboard now opens by clicking the VirtuProbe logo (removed from the menu)
Quick Help on empty screens & tidier toolbars — every empty view (Bundles, Chains, Scripts, Library, Proxy) now shows a short “how it works” panel; the Library’s Add Collection and Import all, and the Proxy’s Port, moved into the action toolbar

Pentesting library

Kerberos collection Security tier. Ready-made Kerberos probes and chains: credential validation, username enumeration, AS-REP roasting, Kerberoasting, recon, and multi-step roast/spray chains

1.0.1

UX overhaul: response panels, sidebar navigation, font settings, toolbar actions, global search, and a complete probe form redesign.

Context-sensitive toolbar — a row of icon buttons between the logo and the project selector updates based on the current view; Bundles shows New Bundle, New Probe, Save, Send, and Delete; Chains and Scripts show New, Save, Run (with a live spinner), and Delete; Proxy shows Start, Stop, Download CA Certificate, Clear, and Save as Probe
Global search — press Ctrl+Shift+F (or click the search bar in the header) to search across all projects, bundles, probes, chains, and scripts; filter by category; navigate results with ↑ ↓ and Enter
All protocol probe forms redesigned — HTTP, SMTP, IMAP, LDAP, DNS, SpamAssassin, and SMB probe forms now share a consistent three-row layout: name on the first row; connection settings and Send on the second; description and tags on the third; fields have proper gutter spacing; Save and Delete are removed from each form and handled by the toolbar
HTTP response panel redesigned — a compact status bar shows status code (colour-coded), round-trip timing, body size, and Content-Type at a glance; the body area is now a tabbed panel with a Body tab (Pretty / Raw / Preview toggle, word wrap, syntax highlighting for JSON, XML, and HTML) and a Headers tab (searchable key/value table)
SpamAssassin response panel redesigned — clean status bar with OK/Fail and Spam/Not Spam chips and score inline; matched rules as a chip group; Report and Content Analysis in a tabbed card with a shared search field; raw response in a collapsible section
Chains and Scripts: permanent sidebar — both views now have a permanent left sidebar; clicking an item opens the editor on the right without navigating to a separate screen
Project view: inline environment editor — the environment editor is embedded directly in the project view instead of opening in a dialog
Navigation sidebar: manual toggle — the drawer no longer auto-expands on hover; a toggle button at the bottom collapses or expands it and remembers the preference; tooltips appear in collapsed mode
Probe list: kebab menu — five inline action buttons per probe replaced by a single ⋯ menu on hover
Loading screen with tips — a spinner and a randomly selected product tip appear while the app is initialising
Compact footer — height reduced to 24 px; breadcrumbs rendered inline
Font settings — font size (12–16 px) and font face (Geist, Roboto, System UI) are configurable in Settings → Typography; changes apply immediately and persist
Settings dialog: sections — three labelled sections: Display, Typography, and Advanced
External links open in system browser — help, documentation, and update links open in the system browser instead of a new Electron window
Validation — inline errors in Add Probe (name + protocol required) and Add Chain / Script (name required) dialogs
Bug fix: dirty probe after delete — deleting a modified probe no longer triggers the unsaved-changes warning

1.0.0

Projects, environments, new navigation, and a complete UX overhaul.

Chains and Scripts scoped to the active project — the Chains and Scripts views now show only items belonging to the active project; switching the active project instantly refreshes both views
Environment restored on project switch — switching to a project automatically restores its last-selected environment and loads the variable values; no manual re-selection needed
New project → Chains view — creating a project sets it active and navigates directly to its Chains view so you can start building immediately
Dashboard on startup — the app always opens at the Dashboard on launch, showing the last active project’s summary and counts
Protocol picker improved — protocols in the Add Probe dialog now show as HTTP (Hypertext Transfer Protocol); the list is sorted by your most-used protocols first, then alphabetically
Project picker in the top bar — click the project chip in the app bar to switch the active project, add a new one, or open the project dashboard without leaving your current view
Environment picker in the top bar — a separate chip next to the project shows the active environment; click to switch environments for the active project in one step
Auto-setup on first launch — a “Default” project and “Dev” environment are created automatically the first time the app starts with an empty workspace
Streamlined Chains and Scripts views — the project sidebar is gone; chains and scripts are listed inline, the active project is always applied when adding new items, and clicking any item opens the editor directly
Streamlined Projects view — the project list sidebar is gone; the view shows the active project’s content directly (linked probes, chains, scripts); clicking a chain or script name opens it in the editor
Dialogs replace slide-in panels — Settings, License, Help, and Feedback now open as standard centered dialogs instead of bottom sheets with an overlay behind them
Simplified license screen — the activation form is now the only content; status details moved to the dashboard
Clickable dashboard cards — the summary tiles (Bundles, Chains, Scripts, etc.) navigate directly to the relevant view; the active-project counters do the same
Navigation reordered — menu order: Bundles · Chains · Scripts · Library · Proxy, then Dashboard · Settings · License, then Feedback · Help; Projects removed from the sidebar (accessed via the top-bar chip)
Cluster renamed to Bundle — the term “Cluster” has been replaced by “Bundle” throughout the app; existing data is migrated automatically

0.0.21

UX polish, new extractor, SPAMD and DNS in chains.

HTTP_HEADER extractor — extract any response header value by name (case-insensitive) in chain steps, alongside existing JSON path, status, and body extractors
Placeholder typo detection — single-brace {var} instead of {{var}} now surfaces a clear error with the variable name, instead of silently passing through unresolved
SPAMD and DNS as chain steps — both protocols can now be used in chains with full extractor support; DNS_ANSWER_VALUE and DNS_SUCCESS extractors included
Unsaved changes warning — navigating away from a modified probe prompts to Save, Save as copy, Discard, or Cancel; dirty state shown as a dot in the sidebar
Error propagation — backend errors now surface their actual message in the UI toast and debug panel instead of a generic failure
F12 DevTools toggle in the desktop app
Auto-select on create — newly created probes, chains, and scripts are immediately selected and ready to edit

0.0.9

Desktop app, SMB protocol, library import, keyboard navigation.

Electron desktop app — single-JAR bundle for macOS, Windows, and Linux; no separate server process needed
Automatic update notifications — the app checks for newer versions on startup and shows a prompt in the footer
SMB protocol Security tier — SMB1/2/3 probe with NTLM auth, pass-the-hash, share listing, file read/write/delete/rename, directory operations, and ACL read/write; message signing (AES-128-CMAC) and encryption (AES-128-GCM, SMB 3.1.1+)
Batch library import — import an entire library group into a bundle in one click
Keyboard navigation — arrow keys, Enter, and Delete work in the probe sidebar; no mouse required
Probe rename — rename probes directly from the sidebar

0.0.5

License system, design system overhaul, DNS, advanced chains.

License system — full Paddle integration with tier-based feature and protocol gating; Engineering and Security tiers unlock protocols, library access, fuzzing, scripting, and the MITM proxy
DNS protocol — UDP with TCP fallback; A, AAAA, MX, NS, TXT, CNAME, SOA, PTR query types; custom resolver targeting; works as a chain step
Advanced chain steps — CONDITION (Groovy expression), PARALLEL (concurrent branches), CHAIN_REF (reusable sub-chains with input/output variable mapping), and ASSERT (fail chain if value does not match)
Fuzzing Security tier — mark any probe field with §payload§; run a payload list and get status codes, durations, and response previews for each attempt
Design system — Phosphor icon set, Geist + Geist Mono + Chakra Petch fonts, design token layer; consistent across all protocols
Community library: 78+ ready-made probes available on the Free tier; the Engineering tier adds integrations (Slack, Jira, GitHub, Linear, Stripe, AWS, Azure, GCP) and the Security tier adds pentesting collections

0.0.1

Initial release.

Seven protocols — HTTP, SMTP, IMAP, LDAP, SpamAssassin, SOCKS5 proxy (MITM), and a hand-written implementation of each against the relevant RFC; no library constraints means full fuzzing and interoperability control
Chain builder — connect probes into multi-step sequences; HTTP, SMTP, and IMAP steps; extract values (JSON path, status code, regex, constant) and pass them as {{variables}} to subsequent steps; ITERATE over lists
Groovy scripting — write scripts that call probes programmatically, extract results, and drive logic with a full JVM scripting environment
Probe history — every execution is saved with a snapshot of the probe as sent and the full response; history survives restarts
Project environments — define variable sets per project; switch between environments without editing probes
Library — browse, search, and import probes from curated collections directly into your bundles
SOCKS5 MITM proxy — route traffic through VirtuProbe and inspect every exchange in a DevTools-style stream with per-connection decompression (gzip, deflate, Brotli)

Changelog

On the horizon

2.2.2 Latest

Changed

Added

Fixed

2.2.1

Changed

2.2.0

Added

Changed

2.1.2

Fixed

2.1.1

Fixed on Apple Silicon

Added

Security

Fixed

2.0.1

Fixed

2.0.0

Added

Fixed

1.5.0

Added

Fixed

1.4.0

Added

Fixed

1.3.1

Added

Fixed

1.3.0

Added

Fixed

1.2.1

Fixed

1.2.0

AI assistant Free — bring your own key

Authentication

Workspace storage

Proxy & service virtualization

HTTP & GraphQL

Scripting & reliability

Interface

1.1.0

New protocols & authentication

Chains & scripting

Import & export

Bundles, projects & environments

Navigation

Pentesting library

1.0.1

1.0.0

0.0.21

0.0.9

0.0.5

0.0.1