Changelog

On the horizon

A look at where VirtuProbe is heading next. These are plans rather than promises, but this is what we are building toward.

Windows and Linux code-signing (top priority). macOS builds are now signed and notarized, so they open with no Gatekeeper warning. Windows Authenticode and Linux signing come next. Every download ships with a published SHA-256 checksum you can verify.
More authentication: mutual TLS (client certificates), OAuth 1.0a and other long-tail schemes, and automatic credential mapping when you import an API description.
Team collaboration: shared workspaces built on the new directory storage, so a whole team can work from one git-backed source of truth.
Bring your own secrets: reference credentials straight from your password manager or vault instead of storing them in VirtuProbe.
More from the mocking proxy: generate mock rules straight from an API description, so a stand-in for a service you do not control is a matter of pointing at its spec.
Even faster startup: prepare the interface during the build so the app has no work left to do at startup and opens instantly, even on the very first launch.
More importers: turn network scans, security templates, API schemas, mail messages, and zone/directory files into ready-to-run probes.
Export everywhere: send your bundles back out to the standard API and capture formats.
gRPC: first-class support for gRPC services.
Whole-project context for the built-in assistant, so it can reason about everything in your workspace rather than the thing in front of it.
Industrial / OT protocols: starting with Modbus TCP for battery energy storage, inverters and PLCs, with IEC 60870-5-104, IEC 61850 and related protocols further out. Same model as everything else: probes, chains, extractors and run evidence. Aimed at integration and security testing of energy sites (including work driven by NIS2), not at becoming a SCADA historian.

2.9.3 Latest

More from webhook testing, and a round of fixes to suites and the out-of-band tools.

Added

Waiting for a webhook keeps listening for a short window after the first delivery. A chain holds the window open for anything that arrives late, then asserts on the exact number of callbacks, so a duplicate the system under test should not have sent fails the test.
The out-of-band interface is available in Czech.

Fixed

A failed chain in a suite report names the step that failed it, following a container down to the step inside.
The variables a suite’s setup produced are shown with secret-looking values masked, instead of in the clear.
A sub-chain that waits for a callback receives the one its parent registered for.
A suite built in the editor names its steps in the JUnit report, rather than raw identifiers.
A suite’s chain runs are saved to each chain’s own run history, so a step-level result stays readable in the chain editor afterward.

2.9.2

Fixes across the tabs, the editor and the Explorer, and webhook delivery becomes something a test can wait for.

Added

Webhook testing with the callback catcher. A chain or suite can aim a webhook at VirtuProbe’s own callback URL, wait for the delivery to arrive, and read a field out of its JSON body, so a step can assert on exactly what the system under test sent. A suite run starts a catcher for the run with a shared token.

Fixed

A response stays with the probe it was sent from. Switching to another probe while one was still sending put the response, and the spinner, on whichever probe was on screen.
A rejected licence says why. Every rejection was reported as not being able to reach the licence server, even when the server had answered with a reason.
The Out-of-band tab can be reopened after you navigate away from it.
Something written to the workspace over the API shows up in an open Explorer, instead of staying invisible until a manual refresh.
Renaming in the Explorer is Shift+F6, which works in the desktop app where the old key was taken by the window shortcut.
A routing or request mistake returns a client error, not a server error. An unknown path, the wrong method or an unreadable body came back as a server fault.
A counted regex works in an assertion. A pattern like {64} in an ASSERT MATCHES, a regex extractor or a condition was mistaken for a malformed variable and rejected.
Double-clicking a tree item reliably pins its tab, even when the machine is busy and the two clicks arrive a little apart.

2.9.1

Stored procedures, finished. 2.9.0 shipped the half that runs and left the half you look at.

Added

Procedure parameters in the probe editor Engineering. Bind what a procedure takes and returns, with a direction on each row, on the SQL Server, PostgreSQL and MySQL probes. Values are bound rather than pasted into the query, so a value carrying a quote stays a value, and the rows reorder, because a procedure’s signature is positional.
The whole response, not the first part of it. A batch that returns several result sets shows all of them, one tab each. What the server printed on its message channel appears under them, and so do the values a procedure returned through its OUT parameters, beside the row that asked for each one.

Fixed

An extractor that could only come back empty. MSSQL_OUT_PARAM and its PostgreSQL and MySQL counterparts were offered when building a chain while nothing could bind a parameter for them to read, so a chain asserting on one went green against nothing.

2.9.0

Two more protocols, SQL Server and FTP, and stored procedures become something a chain can read.

Added

SQL Server probe Engineering. Run a T-SQL batch or call a stored procedure and keep everything that comes back: every result set rather than the first, the messages the server printed, and the values returned through OUT parameters. Eleven extractors feed those into the next step. Named instances are supported, and the error code an extractor returns is the message number every Microsoft reference is indexed by.
FTP probe Engineering. List a directory, download a file and read its contents, upload one, or drive the control connection command by command and read every reply. The directory listing comes out one entry per line, so an iteration step walks whatever the server actually holds instead of a list of paths written in advance.
Every result set, and what the server said Engineering. A PostgreSQL, MySQL or SQL Server batch that returns several result sets gives you all of them rather than the first, and whatever the server printed on its message channel is something a chain can extract and assert on. Binding a procedure’s IN, OUT and INOUT parameters is carried by the probe and has no field in the editor yet.
SMB with Kerberos. Authenticate to a share with a Kerberos ticket rather than a password or a hash, against a domain controller that requires it.
The OAuth2 device code grant, for the flow where the browser sign-in happens on another device.
The proxy reads SQL Server, which makes it the twelfth protocol it can intercept and mock rather than relay blind.
Mail testing got three pieces it was missing: matching a DNS answer against what you expect, extractors for the SpamAssassin report, and a composer that builds a full message with a valid Date header.

Changed

MongoDB and PostgreSQL now require the Engineering tier, which is the tier they have always been sold at. A gap in the license check let both run on any tier, including Free.
The MCP interception lens reads invisible characters. An instruction hidden in Unicode tag characters renders as nothing at all, and until now it scanned clean through every category. It is decoded and analyzed as the text it really is.

Fixed

A target that is down is reported as a failed probe rather than a server error. HTTP, MySQL, PostgreSQL and SpamAssassin returned an error that looked like a fault in VirtuProbe itself, which also suppressed the guidance about a missing credential, the commonest cause.
Listing a share root works against Windows. Every attempt was refused, so a Windows target looked like a host with nothing on it.
A mock applies to a probe sent from the editor in eight more protocols. The rule was accepted and saved and then did nothing, so the run was unchanged and every assertion over it meant nothing.
A spam verdict is not shown for a probe that never reached the server. The panel printed a score and a verdict for a connection that failed.
A Redis password is masked in the probe’s own history, the way it already was in the proxy.
Saving a probe no longer moves it. A probe moved to another bundle came back to the old one on the next save, and a copy was created outside the bundle the original lives in.
The SpamAssassin report is readable again. The extractor for its lines returned empty for every command, and the rules it matched were unreachable after a report.
A DNS probe refuses a record type it does not know instead of quietly asking for ANY, which returns something plausible and answers a different question.
The Explorer no longer stalls while it loads. A workspace with many bundles froze the interface for several seconds on every refresh.

2.8.0

A thirteenth protocol: Redis.

Added

Redis probe Engineering. Drive a Redis server with an ordered sequence of commands and see the reply to each one. Action mode covers the everyday jobs, reading a key, writing one with an expiry, reading INFO, finding keys with SCAN; Advanced mode is the command sequence itself. Seven extractors pull a reply, its RESP type, an integer, the elements of an array, one INFO field or a server error out for the next step to use, so a cache is something a chain can assert on rather than something you check by hand afterwards.
A Redis server to test against, in the bundled docker targets, seeded with one key of each type and protected with a password so a probe exercises the authentication exchange.

2.7.1

Chain steps can be rearranged, the Burp Suite bridge works in both directions, and a new check answers whether your assertions would have noticed a broken response.

Added

A check that asks whether your test would have caught the bug Engineering. It runs your chain against a target that misbehaves on command and reports which assertions never noticed. An assertion that passes whatever comes back is not testing anything, and until now nothing told you which ones those were. Steps it cannot perturb are named in the result, so you can see how much of the chain the answer covers.
The Burp Suite bridge works in both directions. Send a probe from VirtuProbe into Repeater, Intruder, the Organizer or the target site map, with your variables already resolved against the active environment. Coming the other way, a captured request now asks where it should land, in which project and bundle, and remembers that choice for the next one.
A capture can become a regression test in one step. Import a request together with the response Burp saw, and VirtuProbe builds a chain beside the probe that runs it and asserts the same status. Something you found by hand becomes something you can run again, in a suite and in your CI/CD processes.

Fixed

Chain steps can be reordered. Up and down in the step header. There was no way to change the order at all before, short of deleting steps and adding them back in the sequence you wanted.
A step inside a container shows its binding. A step nested in an iteration, a condition or a parallel block now shows whether it is linked to a probe and offers to detach it into an editable copy, which only top-level steps could do. A linked step ignores edits when it runs, so a nested one gave no way to change it and no explanation.
The Explorer shows a request the moment it arrives from Burp. An imported request reached the workspace but stayed invisible in the tree until you refreshed by hand.

2.7.0

Scripts become a full part of a test rather than something you run beside one, the proxy handles the protocols it always claimed to, and a very large response no longer brings the app to a halt.

Added

A script can be a step in a chain and an entry in a suite Engineering. Put a script wherever you would put a chain: as setup, as a test, as teardown, in whatever order you need. A chain can call one as a step. This is for the checks a single assertion cannot express, like a rule that has to hold over every row of a result rather than over one value.
Scripts hand values on, and state a verdict Engineering. vp.set passes a value to whatever runs next, so a setup script can mint a token the rest of the suite uses. vp.check records a pass or a fail that counts toward the run’s result. A script that checks nothing is not treated as a pass: the run reports that it reached no verdict, so a pipeline cannot go green on a test that tested nothing.
Named API tokens. Settings now manages API tokens by name, so an integration can have its own token that you can see and revoke on its own, rather than one shared secret for everything.
An HTML report from a headless run. A run started outside the app writes report.html beside the JUnit XML and the JSON evidence, for reading a build artifact directly. Choose which files you want with VP_FORMATS.
Credentials for a headless run. A run in a pipeline takes its secrets from a credentials file or from per-credential environment variables, both of which overlay the stored credential and stay out of the run’s variables. Values passed as run variables are recorded in the evidence, so secrets do not belong there.
Licensing without a connection. An installation with no route to the internet can be licensed from a signed license file placed in its data directory.
Suites and skills are searchable. Global search finds them, and the project dashboard counts them alongside everything else.

Changed

A very large response no longer freezes the app. Reading a response is now bounded, and so is what a probe stores in its history. The response panel shows the beginning of an oversized body instead of laying out all of it, and says so, with the real size beside it and a button to save the whole thing to a file. Nothing is shortened silently: wherever you see part of a body, the record tells you how much there was.
Probe history stays bounded. Every probe keeps its most recent runs rather than growing without limit, and a stored response no longer carries a whole body or a whole result set. What a probe returns to you is unchanged; this is only what gets kept.

Fixed

The proxy now intercepts database and binary protocols. PostgreSQL, MySQL, MongoDB, SMB and Kerberos connections could not complete a single exchange through the proxy, and a protocol whose server speaks first could not start at all. Both are fixed, so the adapters work through the tunnel as intended.
Reading a file over SMB works for files over 64 KB. Any larger file failed outright rather than returning what it could, which made reading a real file off a share impossible.
A response cut short no longer pins a CPU core. If a server hung up in the middle of a chunked reply, the probe would spin at full CPU indefinitely, and kept doing so after the request was abandoned.
SQL results show every row they returned. The PostgreSQL and MySQL result grids displayed four rows whatever the query returned, while the count beside them read the real total, so a large result looked almost empty.
A script in a suite is reported correctly to CI. In the JUnit report a script entry was recorded as a failure whether it passed or failed, so the report said nothing useful about it.

2.6.1

The mocking proxy gets simpler and more precise: one mode instead of two, mocks you can switch on for a single run, and rules that can answer VirtuProbe’s own requests as well as traffic passing through.

Added

Mocks for one run only Engineering. A chain or a script can name the mock rule sets that apply while it runs, so a rule set can stay switched off everywhere else. Useful when one test needs a payment service to decline and nothing else should see that. Pick the rule sets in the chain or script editor under Enable Mocks.
Rules can answer VirtuProbe’s own requests Engineering. A rule set has an “Also apply to outgoing traffic” setting, on by default, so a probe you send is matched against your mock rules before it reaches the wire. A mocked dependency now answers a probe directly, with nothing to re-point and no proxy in the path.
Save a captured exchange as a probe. Anything the proxy captured can become a probe in your workspace, in whatever protocol it was captured in, and it arrives in the project explorer ready to edit and chain.

Changed

The proxy has one mode. The SOCKS5 and HTTP intercept modes are now a single tunnel, and the mode switch is gone. Everything the HTTP mode did, including rule matching, mocking and the MCP lens, happens through the tunnel, so there is no longer a setting that decides how much the proxy can see. Point your client at the proxy as a SOCKS5 proxy.

Fixed

The proxy Start and Stop buttons now update when you press them. They used to keep their previous state until something else on the page changed, so starting the proxy left Start looking available and stopping it left Stop lit.

2.6.0

The intercepting proxy now decodes every protocol VirtuProbe supports, an official Burp Suite extension sends a captured request into the workbench, and the execution server image can run a suite in a pipeline and report a pass or fail. SMB gains a real DCSync.

Added

The intercepting proxy reads every protocol Engineering. It used to decode HTTP and relay everything else as raw bytes. It now recognizes SMTP, IMAP, DNS over TCP, MySQL, PostgreSQL, MongoDB, SMB and Kerberos as well, so the capture feed tags each exchange by protocol and decodes it, with a hex view for the binary ones. This works through the SOCKS5 tunnel too, which used to pass those bytes straight through. See Proxy.
Add Mock, from a captured exchange Engineering. Select an exchange in the capture feed and draft a matching mock rule from it in one click, pre-filled and ready to review. It covers HTTP, SMTP, IMAP, DNS and the database protocols. A database mock stands in for the login only, returning a canned authentication error rather than a synthesized result set. SMB and Kerberos are observe only, so they carry no Add Mock.
A Burp Suite extension. Right-click a request in Burp and send it into VirtuProbe as an HTTP probe, structured or byte for byte. From there it is a probe like any other: chain it, run it, fuzz it. The bridge stays off until you turn it on, so enable the Burp Suite bridge in Settings first. See Burp Suite bridge.
Run a suite or a chain in CI. The execution server image can run one suite or chain and exit with a pass or fail code, writing a JUnit report and a JSON evidence file. Point it at a git-versioned workspace folder, name the suite, and wire the exit code into your pipeline. See Run in CI.
A real DCSync on SMB Security. The SMB probe can replicate one account from a domain controller and recover its password to the NT hash, with krbtgt the suggested target. It runs as a probe or a chain step, and you assert on the result like any other command. It finishes what the DCSync rights check started: that one answers whether an account could replicate secrets, this one does it.

Changed

Feedback and support move to a hosted form. Reporting a bug or sending feedback now goes through a hosted help form, reachable from the app and from these docs, so a report lands somewhere it can be tracked.

2.5.1

A maintenance release: six fixes. Most are in the LDAP and SMB paths, several of them against a real Active Directory server, and one restores renaming and moving a probe.

Fixed

Renaming or moving a probe works. Both actions failed with a server error instead of saving. They persist now.
LDAP subtree searches against Active Directory return results. A subtree search against an AD server came back empty, because the server’s referral replies were not handled. They are skipped now, so the search returns what it found.
LDAP results show when the probe uses variables. An LDAP probe whose fields carried variables ran, but its command results came up blank. They render now.
The DCSync rights check reaches Windows domain controllers. The replication-rights probe added in 2.5.0 could not finish against a Windows domain controller, which serves that interface over a different transport. It takes that route now, so the check works where it is most likely to be pointed.
A fault partway through an SMB probe no longer discards the rest. When one command in an SMB probe came back with a fault, access denied being the common one, the probe stopped there and dropped both the fault and every command after it. The fault is often the answer you are after, so it now lands as its own row with its status, and the probe carries on.
Two SMB extractors stop coming back empty. In a chain or a script, reading the RPC output lines or the domain SID out of an SMB response returned nothing every time. The probe editor showed the same data correctly, which is what hid it. Both extractors read the response they are given now.

2.5.0

A protocol you write yourself, callbacks VirtuProbe catches on your behalf, and a longer reach into SMB. Underneath that, a pass over everywhere the app used to guess: a value it cannot read now stops the probe rather than quietly meaning something else, an import keeps only what it can load, and the interface got its own pass over type and color.

Changed

A mode VirtuProbe does not recognize now stops the probe. TLS mode, LDAP search scope, Mongo query mode, SMTP body type and IMAP return mode used to fall back to a default when the value was not one they knew, and the probe ran anyway. The error now names the field, the value and what it accepts. Leaving one of these unset is unchanged and still means what it always did, so a probe that does not set them is unaffected. The case worth knowing about is a misspelled TLS mode: it connected in the clear and reported success, which gave you every reason to believe the connection was encrypted.
Chain steps are numbered. A nine step chain was nine identical bars, so the order was only visible by reading every name. Numbering is on the top-level steps, because those are the ones that run in the order you see. The children of a parallel, conditional or repeating step do not, so a number on them would be wrong rather than merely unhelpful. With a run on screen, a step that never ran has its number dimmed.
A chain run reads as a run. The results sat in the same kind of panel as the steps above them, at the same size and with the same heading, so they looked like one more step in the chain you were editing. They now sit on their own recessed ground with nothing step shaped about them.
Keyboard. Ctrl+N opens the new probe list, having been bound to nothing at all. Alt+Insert offers what this workspace can create, instead of firing whichever action the view you were standing in happened to list first, or nothing when no tab was open. Ctrl+Tab switches to the tab you were last in and keeps walking back while you hold it, which is what makes it useful past three or four tabs; Alt+Left and Alt+Right still step along the strip. F9 opens Agent Activity, which the interface had been advertising while nothing was bound to it. Find Action, go to by name and recent items are three different things now rather than three ways to open one dialog. And with the Explorer tree focused, F2 and Delete reach it: the tree used to swallow both.
The dashboard drops its counter row. Six tiles counting things the Explorer already shows, at the top of the page, with nothing to click. The active project panel and the health panel are unchanged.
The interface honors the font you pick. Roboto is the default face, with Geist and your system font still on offer in Settings. Small labels used to ignore that choice and rendered in whatever face your operating system supplied, so the same screen could look different from one machine to the next.
Protocols carry a color. Probe icons, protocol tags and Explorer rows are colored by protocol family, so the database protocols share one color, the mail protocols another, and so on. Twelve separate colors are not tellable apart at icon size, which is why a family shares one and the icon separates the protocols inside it. MySQL and PostgreSQL had been sharing an icon as well, so PostgreSQL now has its own. Color in the Explorer tree means protocol and nothing else.
The top of a probe editor is one row. The connection line comes first, because the address is what a probe is about, and the name, description and tags fold into a single summary line above it. The block above the request tabs had grown to take more of a small screen than the request itself. The name stays readable in the summary line, and an HTTP probe moves its test variables into the same fold. The credential row stays in the open, because a request going out with no credential is not something to put behind a caret.

Added

Freestyle, a protocol you write yourself Security. When what you need to test has no module, a Freestyle probe sends the bytes. Host, port, TCP or UDP, optional TLS, and an ordered list of exchanges, each with its own payload and its own rule for where the reply ends. Payloads are written as text, hex or base64, so a binary framing is as workable as a line protocol, and a length prefix is one of the read rules, which is what makes a framed protocol testable at all. Exchanges rather than one request, because a handshake is the usual shape: read the banner, send a command, read the reply. It takes variables, it works as a chain step, and it has its own extractors, including one that slices bytes out of a reply by offset.
Out-of-band callback detection Security. Some findings announce themselves by nothing happening: the payload goes out and the response looks the same whether or not it worked. VirtuProbe can now listen for the callback itself. A chain gets a step that waits for one and returns what arrived, so running out of time is an answer rather than an error, and eight extractors put the caller, the path and the timing into variables you can assert on. A fresh install listens on HTTP, which needs nothing arranged; the DNS and SMTP channels are switches of their own, and the panel says which channel started and which did not.
See what an agent’s tools actually say Engineering. Point the interception proxy at an MCP server and the proxy view shows the tool definitions and calls going past, and marks a definition carrying the shapes used to steer an agent into doing something it was not asked to do. A proxy rule can also alter a tool description on the way through, so you can find out whether your own agent resists a server that has been tampered with. The panel now also tells you when it is listening but has nothing to show, which is what you get in the proxy’s other mode.
How an exchange ended, on SMTP, IMAP and LDAP. Each exchange reports its transport outcome, and the reason now lands on the command that died instead of on a nameless row at the end. An LDAP probe also keeps the bytes that arrived before a frame ran out, because a truncated response is often the finding. Three extractors let a chain assert on how an exchange ended, and they are offered in the chain editor.
HEAD and TRACE. Both are ordinary HTTP methods and neither could be named on a probe, so an imported collection containing one did not send what it said. They are on the method list now.
An agent connection can be allowed to create projects. Approving an agent now offers this as its own permission, and a project the agent creates joins what it was granted, so it can work in what it just made. Previously the agent was refused, and the permission could not be given from the app at all.
Deeper SMB, up to a DCSync rights check Security. Four more SMB commands. A replication-rights check opens the sealed channel a domain controller demands and asks whether the account could replicate directory secrets, answering “can this account DCSync” without pulling one. A non-destructive PrintNightmare check reads the error a spooler gives back to an unresolvable driver. A named-pipe sweep reports which DCE/RPC endpoints a host exposes, which fingerprints the services it runs. And a scheduled-task command drives the classic remote-execution path, reporting the job id so you can remove what it created. Each names its exact status, because with these the finding is usually in which error a server returns.

Fixed

A chain step linked to a probe opens, instead of taking the window with it. Expanding the first step of a chain an agent had written threw, and the interface stopped responding, with nowhere left to click that did anything. Once it opened, the fields underneath came up blank, because a linked step keeps no request of its own. It now shows the request it will actually send, read only, taken from the probe it is linked to.
The Explorer keeps up with a connected agent. Bundles and chains written over MCP did not reach the tree until somebody pressed refresh, so a workspace holding four bundles and eleven chains still read as empty for the whole nine minutes an agent spent building it. The tree follows the same live stream Agent Activity does, whether or not that view is open.
A DNS probe that reached nothing is no longer green. A query to a resolver that was not there came back as a success with an empty answer, which looks exactly like a lookup that worked, in the one tool whose job is telling those apart.
The Explorer offers the protocols your license includes. After activating a license, Add Probe in the Explorer kept offering the free three until the app was restarted.
A placeholder VirtuProbe cannot resolve is now named. A variable written in a form the runtime does not accept, {{ spaced }} being the one that catches people, was silently treated as text. It is reported where you can act on it, and a skill drafted from a chain no longer asks for an input that could never have been supplied.
An agent keeps access to a project it is working in. Deleting the project that happened to be active locked a connected agent out of its own bundle. Separately, moving a bundle from one project to another now needs permission for both ends rather than either one.
An agent can import a collection into the project it was granted. The import landed outside every project, so a connection approved for one project was refused, and the only way through was approving the entire workspace in order to import a handful of operations. The whole imported tree joins the project now, not only the bundle at the top of it.
A chain saved by anything other than the editor keeps its steps apart. Steps written by an agent arrived with no identifier, so a correct twenty two step chain reported an error on every one of them, and comparing two runs could pair the wrong steps against each other. An identifier is assigned on save, and any that are already there are left alone.
Agent Activity names what an action touched. A row carried a raw identifier in the middle of the sentence. It names the chain, probe or bundle instead, with a short identifier in brackets for matching against something elsewhere, and the full value on hover.
An import keeps what it can read and tells you what it skipped. A collection containing one probe VirtuProbe could not load used to report failure and still leave a partly filled bundle behind, including the unreadable probe, which then appeared in your workspace and could never be opened. Everything after it was dropped without a word. An import now stores only the probes it can load, carries on through the rest, and reports what it left out and why.
A probe that is not there says so. Opening, copying or exporting a probe id that no longer exists reported a server error. It answers not found, which is what a stale tab or an old link deserves.
The interface size setting reaches body text and input boxes. Paragraphs and the text inside every field ignored the setting, and an input was rendering larger than anything around it. Both follow the size you pick now, and nothing moves at the default.
Small text has a floor. The smallest font size in Settings scaled captions down to nine pixels, and captions carry whole sentences, such as the warning that a request will be sent with no credential. They now stop shrinking at a readable size and still grow with the larger settings.
Adding or duplicating a probe from the Explorer opens it. Both created the probe and left it in the tree for you to go and find. They open it in its own tab now, the way everything else you create from the Explorer already did.
Protocol editors keep their structure in the light theme. The lines that separate one entry from the next in the DNS query list, and in the SMTP, IMAP, LDAP and SMB command lists, were drawn in white. On the light theme they were invisible and the list ran together.
Added lines in a response diff have a color. Removed lines showed in red while added lines took whatever color happened to surround them.
An authentication scheme your license does not include cannot be selected. It was marked as out of reach and stayed selectable anyway, in the credential dialogs of several protocol editors.
The Save button in a credential dialog matches every other primary action. It rendered in a different green from the rest of the product, in seven protocol editors at once.

2.3.1

A polish release, all about how the interface feels to use.

Changed

A smoother interface. We got rid of unnecessary animations, so menus, dropdowns and dialogs are simply there the moment you ask for them instead of sliding into place.

Fixed

Fields on the same row line up. A dropdown sat a little higher than the text field beside it, and a hint under one field pushed its neighbors out of line.
Connection hints are readable again. In the Mongo, SMB and SMTP editors some hints never appeared at all. They now sit behind an info icon on the field itself.
A response keeps one font while it loads. The body briefly rendered in a different typeface and size before settling.

2.3.0

OAuth2 flows that VirtuProbe could not express before now work, and you can read back every leg of the exchange.

Added

Provider settings for OAuth2. Three shapes that used to make a flow impossible are now yours to set per credential. PKCE is a switch, still on by default, so a confidential client registered against a provider that rejects code_challenge can complete the exchange at all. Extra parameters on the authorization and token requests go out exactly as you write them, which is what Auth0 needs for audience and ADFS for resource. And where the issued token belongs is the provider’s call, so you can place it as a bearer with an optional prefix or as an API key in the query. Every setting is absent by default, and absent means the behavior you already had, so an existing credential sends identical bytes.
A record of the OAuth2 exchange. Each leg of a flow is kept per credential with its status and its body, so a failed token exchange shows you which request failed and what came back. Stored secrets are replaced on the way in and issued tokens are cut down to a prefix and a length, so the record is safe to read and safe to put in a report.
Search inside a response body. Response bodies open in a viewer with a find panel and match highlighting, so you can search a large payload where it sits. This is new in the desktop app, which had no in-place search before.
Syntax highlighting in the query editors. The MySQL, PostgreSQL and Mongo probe editors highlight what you type. MySQL and PostgreSQL get their own dialects, because # opens a comment in one and not the other, so a single shared dialect paints valid SQL as broken. Ctrl+Enter still sends.
Real domain group enumeration and RID cycling over SMB Security. SAMR_DOMAIN_GROUPS returns the domain’s groups, and SAMR_RID_CYCLE walks a RID range you choose, defaulting to 500 through 1500 so the built-in Administrator and every account created since fall inside it. Around them, this release also brings the domain SID from LSA, server, share and session enumeration, a print spooler pipe check, and named pipe and DCE/RPC bind commands you can drive directly.
More to extract from an SMB step. Chains can now pull the domain SID out of an LSA answer and the lines of an RPC result into a variable, which is what makes an enumerated list drivable by a following ITERATE step.
DNS response flags. A DNS answer now reports the header flags it came back with, so a chain can assert on recursion or truncation as well as on the records.
A demo license tells you where it stands. An evaluation shows the days remaining and stops on its end date, without waiting for a restart or for the next background check.

Fixed

Mongo probes reach the network again. Every Mongo probe failed before it sent anything, because the bundled MongoDB driver resolved to an older version than the client was built against. The driver is pinned correctly now, verified through to a real send.
The app no longer hangs on the loading screen when it cannot reach its server. An unreachable execution server is meant to bring up the connection dialog. The dialog was mounting underneath the loading screen, so the app looked frozen with nothing on screen to explain why. The dialog now comes to the front and lets you point the app at the right server.
SAMR_DOMAIN_GROUPS and SAMR_RID_CYCLE return real results. Both previously returned the domain user list under a different label and reported success. They now perform the enumeration they name, and the SMB commands that are not yet implemented report that plainly, so anything you get back is an answer the server actually gave.
Opening a probe no longer stalls the interface. The first probe that used a code editor could hold the window for several seconds while the editor loaded. It opens immediately now, and the response viewer went from about seven seconds to under a tenth of one.
SMB command names are readable. The command dropdown in an SMB probe was narrow enough that almost every name showed only its first few characters, and TREE_CONNECT against TREE_DISCONNECT truncated to the same prefix. It is wider, and every entry carries its full name on hover.
Clicking a dashboard no longer closes the probe you just opened. A single-click preview tab could be evicted by a permanently open view, so one click on Project Dashboard silently took the probe with it.
Hints that show a variable reference render properly. Several labels and examples that spell out a {{placeholder}} displayed the raw text of the label. The effective-variables count on an HTTP probe did the same and showed its label in place of the number.
The find panel in an editor is laid out the way you expect. Previous now sits to the left of next, and the controls line up on one baseline.

2.2.2

The interface opens light by default, and panels now respond the moment you click them.

Changed

Light by default. VirtuProbe starts in the light theme. The palette was rebuilt against measured contrast rather than by eye, so text and controls meet AA on both themes. Dark is one click away in Settings and your choice is remembered. The app bar keeps its dark panel in either theme, which is what the brand mark needs to stay legible at the size it renders.
Motion off. Transitions and ripples are gone. Menus, tooltips and side panels appear the instant you ask for them instead of easing in. Progress spinners and loading bars still animate.
License activation by keyboard. The activation dialog now focuses the email field when it opens and submits on Enter.

Added

OAuth2 token visibility. The auth tab on an HTTP probe shows the state of the access token it is holding, so you can see whether a token exists and when it expires without sending a request to find out.

Fixed

Bruno collections import again. Importing a Bruno collection failed on collections that used OAuth2, and the token exchange sent a scope parameter where the flow did not call for one. Both are corrected.
Probes built by a script or an agent send correctly. A probe assembled programmatically leaves out fields the editor always fills in, and the direct send path assumed they were present, so the request came back as a server error instead of going out. It now applies the same defaults a person would have set.
Anonymous SMB share listing. Listing the shares on a server that permits anonymous access now works on its own, without first connecting to a share.
The MCP panel no longer carries state between probes. Switching to another probe resets the stream instead of showing the previous probe’s session.

2.2.1

The first probe editor you open now renders straight away.

Changed

Faster first probe. Opening your first probe used to pause on a brief blank editor while the protocol editors compiled. They now warm up in the background the moment the app is ready, so the first probe you create or open appears instantly. Groundwork for the fully precompiled interface still on the way.

2.2.0

Scripts can now be written in JavaScript. The scripting engine speaks JavaScript on GraalJS alongside Groovy, and new scripts default to JavaScript.

Added

JavaScript scripting. Anywhere VirtuProbe runs a script you can now write it in JavaScript on GraalJS, or stay on Groovy, and a new script starts in JavaScript. It is the same vp.send(...) API and the same probe results you already script against, so the code reads the way the rest of your test does. The choice of language reaches every place a script runs: a standalone script, the condition on a chain step, the script action in a proxy rule, and scripted credential authentication. The editor gives you syntax highlighting, autocomplete and linting for both, and you switch language per script with one control.

Changed

Linux ships as the AppImage only. The .deb package is no longer built. The AppImage runs on any Linux distribution with nothing to install, so one artifact covers what the two used to. If you were on the .deb, download the AppImage from the site instead.

2.1.2

Two fixes to how the desktop app starts and stops.

Fixed

The app always finishes starting. A single saved preference left over in an old format could fail to load while the app was still setting itself up, before the interface had mounted, and the result was a loading screen that stayed up for good. It only happened in the desktop app, and only to a value written by a much older build, but when it happened the app was unusable with nothing on screen to explain why. A saved preference that cannot be read now falls back to nothing selected and is cleared, so one bad value can never hold up the whole app again.
The app shuts down cleanly on a Mac. Quitting could leave the part that runs your requests alive in the background, still holding its port, so the next launch could attach to that stale process instead of starting fresh. Closing the window now quits the app, and quitting waits for that background process to stop before the app exits.

2.1.1

Mostly about what is stored where, and about an agent being able to finish the job without asking you to do part of it by hand.

2.1.0 carried everything below but never reached anyone: it was replaced the same day by this build, which is the one you want on an Apple Mac.

Fixed on Apple Silicon

The app now runs natively on Apple Silicon. VirtuProbe itself was always a native build, but the Java runtime inside it was an Intel one, so the part that actually sends your requests ran under Rosetta translation. It was slower than it needed to be, and it would have stopped working altogether when Apple removes Rosetta. Nothing to do on your side beyond installing this build; the Apple Silicon download is the same link it always was.

Added

Optional encryption of environment values in a shared folder Directory storage. Environment variables are workspace content, so they travel with the folder and land in your git history. That is right for a base URL and wrong for a token. You can now turn on a workspace password and have the values written wrapped instead. Variable names stay readable, so the tree still reviews and merges as a text diff, and a value you did not touch is left byte for byte as it was, so a commit shows only what actually moved. The password stays on your machine and is never written into the folder. Anyone opening the workspace is asked for it, and until they enter it VirtuProbe will not load or write the folder, because carrying on would mean putting every value back in the clear. Off by default. It protects future commits only: anything already shared in plain text stays in the history, so rotate it. See Workspace storage.
An agent can create a project and a suite. It could read both and author neither, so a task would stop halfway and ask you to go and make one by hand. It can also propose a skill from a chain you already have, and the proposal is handed to you for review rather than saved, because deciding which inputs are secret is yours to make.
An agent can aim a run at an environment. Chains, suites and probes an agent runs now resolve {{variables}} against the environment you have selected, which is what pressing Run does. It can name a different one if it needs to, and then it gets that environment’s variables but never its stored credentials. Choosing what a credential points at stays with you, which is also why an agent cannot change the environment you are working in.

Security

Your credential store now has a key of its own. It was protected by a key that shipped inside the application, identical in every copy, so anyone who unpacked a download held the key to any installation’s stored credentials. Each installation now generates its own, or takes one from your operating system’s keychain on the desktop. Existing stores are re-keyed on first start and the previous file is kept alongside. Nothing is asked of you.
The API key for the built-in assistant, and your license key, moved into that encrypted store. They were in the general database, which is not protected in the same way.
Everything VirtuProbe writes for itself is now readable only by you. The databases and the proxy’s certificate authority were readable by any other account on the machine. The proxy one matters most: it is the private key behind a certificate you install in your own trust store.
The Linux .deb keeps the browser sandbox on. It was being switched off for every Linux build, including the package that never needed it. The AppImage still needs it off, which is a limitation of that format rather than a choice.

Fixed

Your plan is shown correctly the moment you activate it. Everything unlocked properly, but the license card kept saying Free until you restarted.
You can see which step of a chain failed. Opening a run from history, or jumping in from Agent Activity, left the step list looking identical whatever the run did, so finding the failure meant scrolling to the results and matching by name. Steps are now marked with their result and a restored run scrolls to the first failure.
A run in Agent Activity is named. It showed a raw identifier for exactly the runs you most need to read, the ones an agent created while you were watching, and repeated runs of the same chain were indistinguishable. They now carry the name and the time.
A project you create for an agent appears in the approval dialog instead of only after a restart. Approving also pre-selects unassigned bundles and offers a one-click full access, so approving an agent you trust is not a row of checkboxes.
A chain step can point at a saved probe again. Referring to a probe rather than copying the request into the step failed outright, so an agent building a chain had to duplicate every request and the probes became dead weight.
The chain linter stops flagging something it cannot see. When a step referred to a saved probe, the linter could not read inside it, so it reported a variable as unused when the probe was using it, and following that advice broke the chain. It also means a skill proposed from such a chain now arrives with its inputs filled in rather than empty.
A step with nothing to send is reported before you run it, naming the step, instead of failing mid-run with a message about internal state.
Wrong input is answered as wrong input. Supplying an incorrect workspace password reported a server error rather than telling you the password was wrong.

2.0.1

A follow-up to 2.0.0, fixing the things a brand new workspace ran into first.

Fixed

Opening something from outside the Explorer now actually opens it. A dashboard counter, a global search result, a keyboard shortcut and a failed step in Agent Activity all changed the address without opening the thing they named. With a tab already open you never noticed, because the view was mounted anyway. With nothing open, which is every fresh install, they appeared to do nothing at all.
A fresh install opens the Dashboard instead of the placeholder that tells you to open something from the Explorer, which was the first screen a new user ever saw.
The Dashboard shows current figures. It read its counts once at startup, so anything you created afterwards was missing until you restarted.
The first chain saved into a new workspace no longer fails. Saving a chain, script, suite or skill into a workspace that had no Default bundle yet returned a server error, so on a brand new install the first thing you authored could not be saved.
The REGEX extractor can see the response it is matching against. Against every protocol whose response is structured rather than plain text, it was handed an object reference instead of the data, so no pattern could ever match and the step failed with “No match for regex”. That reads as though your pattern were wrong, when the extractor had never been shown the response.
Function keys no longer swallow the combinations built on them. A bare F-key shortcut also captured the same key pressed with a modifier.
A dropped connection to the run event stream no longer writes a stack trace to the log. A subscriber going away is ordinary, not an error.

2.0.0

Added

One workspace tree. Chains, scripts, suites and skills now live in bundles, the same containers as probes, instead of being owned directly by a project. A bundle belongs to zero or more projects, and everything inside it inherits that scope: an artifact is visible when its bundle is free or belongs to the active project. The Project Explorer is a single bundle tree, with no separate Chains, Scripts, Suites or Skills lists. Each project has a Default bundle where new work lands, there is a global Default for free artifacts, and moving an artifact to another bundle is how you re-scope it. Existing workspaces migrate automatically: a project’s items move into that project’s Default bundle, and anything that was unowned becomes free. See Bundles.
VirtuProbe can be driven by an external AI agent. Connecting one is not a paid capability and carries no tier of its own: an agent inherits exactly the license you hold, so the free HTTP workbench has a real agent story and each capability keeps whatever tier it already had. It speaks the Model Context Protocol, so an agent in a tool you already use can discover what this instance can do and run it. It can do what you can do: create a probe and send it, save a chain and run it, run a suite, create an environment, run a script, import a collection, and read the workspace to find its way around. That is a fixed set of tools rather than one tool per capability you own, because an MCP client loads every tool definition into the agent’s context before the conversation starts, and a tool per capability would put your whole library there on every request. Your license still decides what actually runs, through the same checks the interface goes through, and secrets are the one thing an agent can never be handed. See Driving VirtuProbe from an agent.
Skills, the unit an agent actually calls Engineering tier to run. Authoring one and listing what exists stays open on every tier. A skill is a named capability with a declared contract, typed inputs and named outputs, wrapping a chain or script you authored and reviewed. Arguments are validated before anything runs, and arguments you did not declare are ignored. An input marked secret takes the name of a credential binding, never a secret value, so there is no route for an agent to pull a real credential into its own context.
A guidance document generated per instance. An agent connecting to VirtuProbe can read what this installation can do, how to interpret a result, and when to stop and involve a person. It is assembled from your license, so it never advertises something you would be refused, and it cannot go stale the way a bundled file would.
An API access token, in Settings, with reveal, copy and rotate. It is required whenever the server is reachable beyond your own machine, so exposing the server switches authentication on by itself rather than leaving it to a second setting you might forget.
You can watch what an agent is doing. Every run an agent triggers is streamed live and tagged as agent-driven, and you can subscribe to that stream without knowing anything about the run in advance. Ask for everything, or only for the failures, so you are told when something breaks instead of sitting and watching.
Agent Activity, the in-app view of the above. Connected agents are listed with the runs they start, step by step as they execute. A new agent can read your workspace but cannot change or run anything until you approve it, and approving is a choice of which projects it may reach: anything outside that is refused, and the refusal shows up in the list with its reason rather than failing silently. You can block an agent while it is working. A failed step is a link that opens that chain at that step in the editor, so you can take the work over without interrupting the agent.
A chain linter. Static analysis that answers the question a green run cannot: is this a good test? It flags a chain with no assert, an assert on a variable nothing produces, an extractor whose output nothing reads, a condition that can never fire, a reference cycle, and more. It runs in the chain editor, and on the approval card when the built-in assistant offers you a chain.
The Project Dashboard is built around bundles, matching the Explorer: what is in the active project, what is available to it, and what each bundle holds. Clicking a bundle reveals it in the Explorer instead of opening an empty view.
The desktop app no longer fails to start when port 10100 is taken. It takes the first free port in a small range and reports it, and the footer shows the port the server and the agent endpoint are actually on.
Test suites Engineering tier: the layer above a chain. A suite runs an ordered set of chains together, with setup chains that build the state the tests need, teardown chains that always run afterwards, and one aggregated verdict. Setup output feeds the tests; test chains stay isolated from each other, so none can quietly depend on another; a failing setup skips the tests instead of producing confidently wrong results; a failing teardown does not turn a passing suite red. Suites live in bundles like chains and scripts, and open as an editor tab. See Suites overview.
Live run progress. Chain and suite runs now execute in the background and stream progress back as they go: each step, and for a suite each chain, is marked running, passed or failed the moment it happens, instead of a spinner until the whole thing finishes.
Suite reports. JSON evidence of the run you just watched (nothing re-runs), JUnit XML for CI with one testsuite per chain and skipped chains reported as skipped, and the last 20 runs kept in history.
The dashboard now leads with test health: pass rate over recent runs, the latest chain and suite runs, and what regressed, instead of counting how many probes you own. A regression means something that used to pass and now fails, with the failing streak and when it last passed; something that never passed is unfinished work, not a regression.

Fixed

The Project Explorer could come up empty. A missing import meant loading it threw, and because the failure happened while the tree was being built, nothing appeared at all: no bundles, no chains, no scripts. The application still rendered, so it looked like an empty workspace rather than an error.
The server now listens on your machine only. It previously accepted connections from any device on the same network, with no authentication, which meant anyone on an office or cafe network could read your workspace and run chains using your stored credentials. Deployments that are meant to be reachable set one environment variable, and that also turns the access token on.
The condition hint taught a comparison that never matches. The example alongside a CONDITION step showed an unquoted placeholder, which compares a number against text and is therefore always false. Anyone following it got a branch that silently never fired while the chain still passed.
The interactive API browser no longer ships in released builds. It published a complete map of every endpoint, which an installed application has no reason to hand out.
An unresolved variable now says so. A probe URL of {{baseUrl}}/health used to fail with “not a valid HTTP URL”, which pointed at the symptom. The error now names the variable and the field, and tells you to check that the right environment is active and saved.
Unsaved environment changes are visible. Variables only take effect once the environment is saved; the editor now marks unsaved changes and says what that means, instead of leaving them looking active.
A request an agent wrote now sends its headers. Headers, query parameters and cookies carry an enabled switch that the editor sets on every row. A request built by an agent does not have it, and those rows were being treated as switched off, so an agent’s JSON POST arrived without its content type and came back rejected.
Deleting a project no longer strands its bundles. They become free and stay visible, instead of disappearing along with the project.
The assistant button only appears once the assistant is configured, rather than inviting you to open something that cannot answer.

1.5.0

Broader reach and fewer surprises: signed macOS installers, a new PostgreSQL database probe, environment-scoped credentials, and the ability to trust self-signed certificates on any TLS probe.

Added

PostgreSQL probe Engineering tier: VirtuProbe’s third database protocol, after MySQL and MongoDB. Connect to a PostgreSQL server, run a SQL statement, and get back a result-set table, an affected-row count, or the server’s error. Authentication uses the credential store (a Basic credential, so no password on the probe), with the full transparency panel (effective credential, reveal-on-demand, per-run override). PostgreSQL is a first-class chain step, with extractors POSTGRES_SUCCESS, POSTGRES_ROW_COUNT, POSTGRES_AFFECTED_ROWS, POSTGRES_COLUMN, POSTGRES_ERROR_CODE (the SQLSTATE), and POSTGRES_JSON. Connections are pooled and reused. See PostgreSQL probe.
Environment-scoped credentials. Credentials can now travel with your environments, the same way variables already do. An environment binds a name to a credential; a probe references that name in its Auth, and switching the active environment swaps the whole credential (scheme, config and secrets) without editing the probe. This is the prod-vs-staging case in one probe instead of two. Bindings resolve for a direct send, in chains and in scripts, and the effective-credential summary shows exactly which credential each environment resolves to. Chain and script runs now also carry the active environment’s variables, so {{variables}} resolve on a chain run as they do on a direct send.
Compare environments. A new diff view (toolbar action in the Project Dashboard) shows two environments side by side, for both variables and credential bindings: what is only on one side, what differs, and what matches. Copy any entry either direction, or copy every missing entry at once, to bring a new environment up to date or reconcile two that have drifted.
Trust self-signed certificates: a per-probe toggle on the HTTP, SMTP, IMAP, and LDAP probes. Point at a server that presents a self-signed or private-CA certificate (implicit TLS, STARTTLS, or MCP over HTTPS) and the probe connects instead of failing the handshake. Off by default, set per probe.
Signed macOS installers: the macOS builds are now Developer ID signed and notarized, so they open without a Gatekeeper warning. (Windows installers are not yet code-signed and still show a SmartScreen warning on first launch.)

Fixed

The app now opens in about a second. Previously the first load could take ten seconds or more while the entire editor interface compiled up front; the protocol editors now load on demand.
Deleting a probe from the toolbar now refreshes the Project Explorer straight away.
Explorer menu actions that open a dialog now close the menu first, instead of leaving it open behind the dialog.
Folder-based workspace export now writes one file per probe (it was writing one per stored revision), which fixes scrambled folders and a phantom “Error sending request” after an export.

1.4.0

The theme is doing more without hand-driving the protocol: outcome-level forms for email and directory probes, first-class MCP testing, and a new database, with the Kerberos roasting path fixed end-to-end.

Added

Action Mode for SMTP, IMAP and LDAP: you no longer have to hand-drive the protocol conversation to do the common thing. Each of these probes now opens in an Action form:
- SMTP → Send email: fill From / To / Subject / Body (with a Plain/HTML toggle) and VirtuProbe runs the whole EHLO → STARTTLS → AUTH → MAIL FROM → RCPT TO → DATA → QUIT handshake.
- IMAP → Find / verify message: set a mailbox and search filters, and get back whether a message exists, a match count, or the latest message/header. Two new extractors, IMAP_MATCH_COUNT and IMAP_MESSAGE, make the classic email-verification chain trivial: sign up over HTTP, find the mail, and pull the confirmation code out with a REGEX.
- LDAP → Check login / Find entry: validate a DN + password, or search a base + filter for entries (new LDAP_MATCH_COUNT extractor).
Authentication uses the shared credential store, so the password never touches the probe, and every field takes {{variables}}, so actions chain and script like any other step. The raw command editor is still one click away as Advanced mode (and Edit as commands converts an action into it), so fuzzing and exact control over the bytes are untouched. See the SMTP, IMAP and LDAP docs.
MCP requests: the HTTP probe can now test Model Context Protocol servers. A new MCP mode on the Body tab (alongside Raw and GraphQL) gives you transport (Streamable HTTP or legacy HTTP + SSE), method and JSON params pickers, and serializes a JSON-RPC 2.0 request for you. Streaming responses are shown live in the response panel, the session threads through a chain with the new MCP_SESSION_ID, MCP_TOOL_NAMES, MCP_RESULT and MCP_ERROR_CODE extractors, and every MCP response is scanned for tool-poisoning prompt injection. Sending needs the Engineering tier. See the HTTP probe docs.
MongoDB probe: a new database protocol (Engineering tier). Connect by host/port or a full mongodb:// / mongodb+srv:// connection string, authenticate from the credential store, and run any of eight operations: find, insert, update, delete, aggregate, count, run-command, and list-collections. Results come back as pretty-printed documents or a write summary. MongoDB is a first-class chain step, with extractors MONGO_SUCCESS, MONGO_DOC_COUNT, MONGO_FIELD (reach any document with [n] / [*]), MONGO_ERROR_CODE, and MONGO_JSON. A Form / Shell toggle lets you paste a full db.collection.find(...).sort(...) query verbatim instead of filling fields. See the MongoDB probe docs.

Fixed

Kerberoasting and SPNEGO now work against live KDCs: three RC4-HMAC conformance bugs in the hand-rolled Kerberos stack (the RFC 4757 key-usage translation, the missing TGS request-body checksum, and a mis-tagged authenticator field) are fixed, so Kerberoast returns a real $krb5tgs$23$ hash and SPNEGO / Negotiate authentication completes.
Live MCP streaming works across a split UI / execution deployment: the streaming request header is now allowed cross-origin, so text/event-stream MCP responses stream into the panel even when the UI and execution servers run on different origins (a same-origin desktop install was already fine).

1.3.1

A reliability release: a probe against an unreachable host no longer hangs the run, plus a couple of smaller fixes.

Added

Network timeouts: the SMTP, IMAP, LDAP and SpamAssassin probes now apply a connection and a read timeout, so a probe against a firewalled or unreachable host fails in seconds instead of hanging indefinitely. The limits are configurable under Settings → Network timeouts (default 10s connect / 30s read; set to 0 for no limit). The HTTP, DNS, SMB, Kerberos and MySQL probes already enforced their own timeouts.

Fixed

The Project Explorer refreshes after the AI assistant creates or moves something: a chain, script or bundle the assistant builds now shows up in the tree straight away, instead of staying hidden until a manual refresh.
The update check only runs in the packaged desktop app: it no longer fires during local development.

1.3.0

A reorganized, editor-style workspace with keyboard-first navigation, MySQL, the first database protocol, plus raw HTTP requests sent byte for byte, and a real malformed-packet fuzzing engine.

Added

MySQL probe Engineering tier: VirtuProbe’s first database protocol. Connect to MySQL or MariaDB, run a SQL statement, and get back a result-set table, an affected-row count, or the server’s error, so a chain can finally confirm the row an API call was supposed to write actually landed. Authentication uses the credential store (a Basic credential, so no password on the probe), with the full transparency panel (effective credential, reveal-on-demand, per-run override). New extractors MYSQL_SUCCESS, MYSQL_ROW_COUNT, MYSQL_AFFECTED_ROWS, MYSQL_COLUMN, MYSQL_ERROR_CODE, and MYSQL_JSON pull values into the chain. Connections are pooled and reused. See MySQL probe.
A unified workspace: VirtuProbe is now organized like a code editor: a single Project Explorer on the left (bundles, chains and scripts in one tree, visible on every screen) and browser-style editor tabs. Whole views open as tabs too, including the Dashboard, Project Dashboard, Proxy and Library, and they and can only be open once. Your open tabs are remembered per project. See The workspace.
Reveal in Explorer: press Alt+F1, or turn on autoscroll, to locate the active document in the Explorer tree.
A zoned top bar: the navigation drawer is gone; app-view launchers sit by the logo, the active tab’s actions in the middle, and a single New Probe menu replaces the row of protocol buttons.
Keyboard-first navigation: a reworked shortcut set modelled on a modern IDE: focus the Explorer or editor, cycle and close tabs, jump to any bundle/chain/script, and run a Find Action command palette (Ctrl+Shift+A), all from the keyboard. Every icon-only button now carries a tooltip, and shortcut-bearing ones show the key hint. See Keyboard shortcuts.
A smarter mocking proxy Engineering tier. Proxy rules gain three new actions beyond mock-and-forward: rewrite a live request or response, inject faults (error status or latency), and script a dynamic mock response. Build a service virtualization layer that reacts to real traffic.
Raw request mode Security tier: send the literal bytes of an HTTP request: a malformed request line, duplicate or conflicting headers, a Content-Length + Transfer-Encoding mismatch, bare-LF framing. The URL still supplies the connection target; {{variables}} and §payload§ resolve in the raw request. See Raw mode.
Transport outcomes: when an exchange fails below HTTP, the response shows a typed outcome (RST, TIMEOUT, EOF, MALFORMED_RESPONSE, PARTIAL) instead of a generic error, which is often the real signal after a crafted request.
Fuzz modes Security tier: the Fuzz tab adds Library mode (curated payload lists: CRLF, path traversal, SQL injection, XSS) and Mutation mode (generates structurally-malformed variants of the request) alongside the original payload Substitution. See Fuzzing.
Anomaly detection: fuzz results are scored against a baseline derived from the run; transport failures, differing statuses and length outliers are flagged so the leads stand out.
Fuzz run history and evidence export: each run is saved with the probe (latest 20); export a full run as JSON for reporting.
Request-smuggling desync detection Security tier: a new Smuggle tab on the HTTP probe runs a one-click check for HTTP request desync (CL.TE and TE.CL), comparing crafted requests against a clean baseline. It’s non-destructive, measuring timing and framing only, and reports a clear verdict per variant (DESYNC / INCONCLUSIVE / NORMAL). See Request smuggling / desync detection.

Fixed

Importing a chain from the Library now asks for a target project (defaulting to your active project) and adds the chain there, so it shows up in the Chains view right away. Previously chain imports had no project and stayed hidden.
Canceling a probe send now works on every protocol: the Cancel button stops the in-flight request instead of only appearing to. Non-HTTP probes gained the button too, and a running send can no longer be fired twice.
Project environment variables always resolve on send: {{variables}} are now substituted whenever a probe is opened, including straight from the Explorer tree, so they no longer occasionally reach the server unresolved.
Editing and deleting credentials is cleaner: you can edit a credential in place from the probe picker, and deleting a credential that a project used as its default no longer leaves a dangling reference.

1.2.1

A maintenance release that fixes a license-validation error at startup.

Fixed

License validation handles an unrecognized license cleanly: when the licensing service reported that a license was unknown or inactive, the app could surface an internal error during the startup license check instead of quietly falling back to the free tier. Every server response is now handled correctly, so startup stays clean and entitlements always reflect the licensing service’s actual answer.

1.2.0

The biggest release yet: an in-app AI assistant that builds and runs your tests, a complete authentication overhaul, and team-shareable workspaces.

AI assistant Free: bring your own key

In-app AI chat and agent: a built-in assistant you connect to your own model: any OpenAI-compatible endpoint (OpenAI, Gemini-compatible gateways, or a local Ollama). You bring the key; VirtuProbe never charges for tokens and your key stays on your machine.
It builds and runs your tests: ask it to create a chain or script and it will, then run it on request. Every step that writes or executes is gated behind an Approve / Reject card, with a ⚡ auto-approve toggle for when you want it to move fast.
Project-aware: it knows your active project, your tier, and which protocols you’re entitled to, and puts new work in the right place.
Hands on the workbench: it can search and import from the library, import collections (OpenAPI / Postman / Bruno / HAR and more), send a probe (resolving your environment variables), run a fuzz job, and move chains and scripts between projects.
Context-aware: attach a probe’s real request and response to the conversation, and get findings written up report-style (title · severity · target · evidence · recommendation).

Authentication

Unified credential store: HTTP authentication is now a single Credential picker. NTLM and Pass-the-Hash, previously a separate toggle, are now credential schemes alongside Basic, Bearer, API Key, Digest, OAuth2, AWS SigV4, Scripted, and SPNEGO. Secrets are stored apart from the probe and never appear in history.
SPNEGO / Kerberos for HTTP Security tier: authenticate to Kerberos-protected web services with an Authorization: Negotiate ticket obtained from the KDC for HTTP/<host>.
Project-scoped credentials: credentials can be Global or scoped to a project; new credentials default to the active project. The picker shows the active project’s credentials plus globals, and a project’s default credential is applied when a probe sets none (resolution order: chain step override → probe credential → project default).
Redesigned the New credential dialog (clearer layout, scope selector).
Auth transparency: the probe editor now shows the effective credential under the picker: name, scheme, a source chip (this probe vs project default), config values inline, and which secrets are set (masked) with a per-secret reveal on demand.
Per-run overrides: change credential config/secret values, or any {{variable}}, for a single send without editing the stored credential or saving the probe. The Variables panel also shows an effective table with each value’s source (environment < inline < this run).

Workspace storage

Directory-backed (“guerrilla”) workspace: point VirtuProbe at a folder and it stores your bundles, probes, projects, chains, scripts and environments there as plaintext files, so a team can share the workspace through its own git, Dropbox, or network share. Switch under Settings → Workspace storage; an empty folder asks whether to initialize a new workspace or clone your current one. Secrets always stay in the local encrypted store and are never written to the folder. Desktop only.

Proxy & service virtualization

HTTP interception mode: the proxy gains a second mode alongside the SOCKS5 tunnel: point a client’s http_proxy at VirtuProbe and it now terminates and parses each HTTP/1.1 request (HTTPS via CONNECT and an on-the-fly leaf certificate), so it can act on whole requests instead of raw bytes. With no rules defined it forwards transparently and still feeds the DevTools-style capture view.
Mock rules: build an ordered list of interception rules that match on method, host, path template, headers, or body (first match wins). A matching rule can return a synthetic response you define, with its own status, reason, headers and body, without the request ever reaching the real server, so you can stand in for a service that isn’t ready yet. Rulesets are saved alongside the rest of your workspace and managed from the new Interception Rules editor in the proxy view.

HTTP & GraphQL

GraphQL requests: the HTTP probe’s Body tab has a new GraphQL mode with separate Query and Variables editors; VirtuProbe serializes them into the request and sets Content-Type: application/json for you. Existing GraphQL bodies are detected automatically, so probes round-trip unchanged.

Scripting & reliability

A real script editor: the Scripts view now has a proper code editor: Groovy syntax highlighting, context-aware autocomplete (your bundle and probe names inside vp.send(...), extractor IDs inside .extract(...), environment variables after {{, and VpProbeResult members), and live syntax checking that underlines errors as you type. Ctrl+S saves, Ctrl+Enter runs.
Scripts read responses naturally: vp.send(...) now targets the latest saved version of a probe, and results expose statusCode / headers / body directly so you can assert on them.
Tier limits enforced everywhere: running a chain or script that uses a gated protocol is now correctly license-checked (building and saving such a chain stays allowed, so the assistant can still help you design one).
Resilient licensing: a subscription-server hiccup no longer drops a paying user to the free tier; the last validated entitlements are kept until the server is reachable again.

Interface

Project Dashboard is back in the left navigation, at the top of the drawer.

1.1.0

A big one: a new protocol, pentest-grade chains, import/export across the board, and a redesigned project workspace.

New protocols & authentication

Kerberos probe Security tier: a new probe type that talks directly to a KDC over port 88 with a hand-rolled RFC 4120 / RFC 4757 implementation (no GSSAPI, no third-party library). Three modes: credential validation (AS_REQ) with structured KDC error reporting; AS-REP Roasting for accounts with pre-auth disabled (hashcat $krb5asrep$23$, mode 18200); and Kerberoasting of any SPN-bearing account ($krb5tgs$23$, mode 13100). Hashes render on a copy-ready card; the Exchanges panel shows raw DER hex
Windows authentication in the HTTP probe: the Auth section now supports NTLM (username + password) and Pass-the-Hash (32-char hex NT hash) for IIS, Exchange OWA, SharePoint, ADFS, and any Windows Integrated Authentication endpoint; all fields support {{variables}}. New HTTP_AUTH_SUCCESS extractor for spray chains

Chains & scripting

Kerberos and SMB in chains and scripts: both can now be used as chain steps and via vp.send(...); placeholders resolve in host/auth/SPN and per-command paths. New extractors: KERBEROS_SUCCESS / KERBEROS_HASH / KERBEROS_ERROR_CODE and SMB_SUCCESS / SMB_LAST_STATUS / SMB_SHARE_LIST / SMB_FILE_CONTENT
Chain run history, comparison & JSON evidence: every run is auto-saved (up to 20 per chain); restore any past run, Compare two runs in a step-level diff, and export a run as structured JSON evidence for reports and audit trails
ITERATE: wordlists, rate control & stop conditions: drive an ITERATE step from a file on the server (one item per line); add a randomized jitter delay between iterations; stop on first success for credential-stuffing flows; and max failures to abort early

Import & export

Import Collection: generate a bundle of HTTP probes from OpenAPI 3.x / Swagger 2.0, Postman (v2.1), Bruno, HAR, .http / .rest files, or Insomnia exports; folders/tags become a nested bundle tree; provide a file, pasted text, or (OpenAPI) a URL
cURL / wget, in and out: paste a curl or wget command onto an HTTP probe’s URL field to fill it in (with Undo); and export any HTTP probe to cURL, wget, Python (requests), or PowerShell from the toolbar
Environment import & export: export an environment as a standard environment file; import standard environment exports, dotenv (.env), and Bruno environments
HTTP response diff: Compare any two entries in a probe’s history to see status, changed headers, and a line-level body diff

Bundles, projects & environments

Sub-bundle tree & project scoping: nest bundles into a tree (⋯ → Add Sub-bundle, or Move bundle); scope a bundle to zero or more projects so you only see what’s relevant. Delete a bundle (and its subtree) or Clone & Link it into a project
Redesigned project dashboard: the environment editor is now the main panel, with each environment on its own tab; linked bundles, probes, chains and scripts sit in a side panel (“Project Bundles” is now Linked Bundles). Per-environment toolbar actions: Save · Clone · Rename · Delete · Export · Import

Dashboard from the logo: the Dashboard now opens by clicking the VirtuProbe logo (removed from the menu)
Quick Help on empty screens & tidier toolbars: every empty view (Bundles, Chains, Scripts, Library, Proxy) now shows a short “how it works” panel; the Library’s Add Collection and Import all, and the Proxy’s Port, moved into the action toolbar

Pentesting library

Kerberos collection Security tier. Ready-made Kerberos probes and chains: credential validation, username enumeration, AS-REP roasting, Kerberoasting, recon, and multi-step roast/spray chains

1.0.1

UX overhaul: response panels, sidebar navigation, font settings, toolbar actions, global search, and a complete probe form redesign.

Context-sensitive toolbar: a row of icon buttons between the logo and the project selector updates based on the current view; Bundles shows New Bundle, New Probe, Save, Send, and Delete; Chains and Scripts show New, Save, Run (with a live spinner), and Delete; Proxy shows Start, Stop, Download CA Certificate, Clear, and Save as Probe
Global search: press Ctrl+Shift+F (or click the search bar in the header) to search across all projects, bundles, probes, chains, and scripts; filter by category; navigate results with ↑ ↓ and Enter
All protocol probe forms redesigned: HTTP, SMTP, IMAP, LDAP, DNS, SpamAssassin, and SMB probe forms now share a consistent three-row layout: name on the first row; connection settings and Send on the second; description and tags on the third; fields have proper gutter spacing; Save and Delete are removed from each form and handled by the toolbar
HTTP response panel redesigned: a compact status bar shows status code (color-coded), round-trip timing, body size, and Content-Type at a glance; the body area is now a tabbed panel with a Body tab (Pretty / Raw / Preview toggle, word wrap, syntax highlighting for JSON, XML, and HTML) and a Headers tab (searchable key/value table)
SpamAssassin response panel redesigned: clean status bar with OK/Fail and Spam/Not Spam chips and score inline; matched rules as a chip group; Report and Content Analysis in a tabbed card with a shared search field; raw response in a collapsible section
Chains and Scripts: permanent sidebar: both views now have a permanent left sidebar; clicking an item opens the editor on the right without navigating to a separate screen
Project view: inline environment editor: the environment editor is embedded directly in the project view instead of opening in a dialog
Navigation sidebar: manual toggle: the drawer no longer auto-expands on hover; a toggle button at the bottom collapses or expands it and remembers the preference; tooltips appear in collapsed mode
Probe list: kebab menu: five inline action buttons per probe replaced by a single ⋯ menu on hover
Loading screen with tips: a spinner and a randomly selected product tip appear while the app is initializing
Compact footer: height reduced to 24 px; breadcrumbs rendered inline
Font settings: font size (12 to 16 px) and font face (Geist, Roboto, System UI) are configurable in Settings → Typography; changes apply immediately and persist
Settings dialog: sections: three labeled sections: Display, Typography, and Advanced
External links open in your own browser: help, documentation and update links open in your default browser instead of a window inside the app
Validation: inline errors in Add Probe (name + protocol required) and Add Chain / Script (name required) dialogs
Bug fix: dirty probe after delete: deleting a modified probe no longer triggers the unsaved-changes warning

1.0.0

Projects, environments, new navigation, and a complete UX overhaul.

Chains and Scripts scoped to the active project: the Chains and Scripts views now show only items belonging to the active project; switching the active project instantly refreshes both views
Environment restored on project switch: switching to a project automatically restores its last-selected environment and loads the variable values; no manual re-selection needed
New project → Chains view: creating a project sets it active and navigates directly to its Chains view so you can start building immediately
Dashboard on startup: the app always opens at the Dashboard on launch, showing the last active project’s summary and counts
Protocol picker improved: protocols in the Add Probe dialog now show as HTTP (Hypertext Transfer Protocol); the list is sorted by your most-used protocols first, then alphabetically
Project picker in the top bar: click the project chip in the app bar to switch the active project, add a new one, or open the project dashboard without leaving your current view
Environment picker in the top bar: a separate chip next to the project shows the active environment; click to switch environments for the active project in one step
Auto-setup on first launch: a “Default” project and “Dev” environment are created automatically the first time the app starts with an empty workspace
Streamlined Chains and Scripts views: the project sidebar is gone; chains and scripts are listed inline, the active project is always applied when adding new items, and clicking any item opens the editor directly
Streamlined Projects view: the project list sidebar is gone; the view shows the active project’s content directly (linked probes, chains, scripts); clicking a chain or script name opens it in the editor
Dialogs replace slide-in panels: Settings, License, Help, and Feedback now open as standard centered dialogs instead of bottom sheets with an overlay behind them
Simplified license screen: the activation form is now the only content; status details moved to the dashboard
Clickable dashboard cards: the summary tiles (Bundles, Chains, Scripts, etc.) navigate directly to the relevant view; the active-project counters do the same
Navigation reordered: menu order: Bundles · Chains · Scripts · Library · Proxy, then Dashboard · Settings · License, then Feedback · Help; Projects removed from the sidebar (accessed via the top-bar chip)
Cluster renamed to Bundle: the term “Cluster” has been replaced by “Bundle” throughout the app; existing data is migrated automatically

0.0.21

UX polish, new extractor, SPAMD and DNS in chains.

HTTP_HEADER extractor: extract any response header value by name (case-insensitive) in chain steps, alongside existing JSON path, status, and body extractors
Placeholder typo detection: single-brace {var} instead of {{var}} now surfaces a clear error with the variable name, instead of silently passing through unresolved
SPAMD and DNS as chain steps: both protocols can now be used in chains with full extractor support; DNS_ANSWER_VALUE and DNS_SUCCESS extractors included
Unsaved changes warning: navigating away from a modified probe prompts to Save, Save as copy, Discard, or Cancel; dirty state shown as a dot in the sidebar
Error propagation: an error now surfaces its actual message in the UI toast and debug panel instead of a generic failure
F12 DevTools toggle in the desktop app
Auto-select on create: newly created probes, chains, and scripts are immediately selected and ready to edit

0.0.9

Desktop app, SMB protocol, library import, keyboard navigation.

Desktop app: a single install for macOS, Windows and Linux, with nothing else to run alongside it
Automatic update notifications: the app checks for newer versions on startup and shows a prompt in the footer
SMB protocol Security tier: SMB1/2/3 probe with NTLM auth, pass-the-hash, share listing, file read/write/delete/rename, directory operations, and ACL read/write; message signing (AES-128-CMAC) and encryption (AES-128-GCM, SMB 3.1.1+)
Batch library import: import an entire library group into a bundle in one click
Keyboard navigation: arrow keys, Enter, and Delete work in the probe sidebar; no mouse required
Probe rename: rename probes directly from the sidebar

0.0.5

License system, design system overhaul, DNS, advanced chains.

License system: full Paddle integration with tier-based feature and protocol gating; Engineering and Security tiers unlock protocols, library access, fuzzing, scripting, and the MITM proxy
DNS protocol: UDP with TCP fallback; A, AAAA, MX, NS, TXT, CNAME, SOA, PTR query types; custom resolver targeting; works as a chain step
Advanced chain steps: CONDITION (Groovy expression), PARALLEL (concurrent branches), CHAIN_REF (reusable sub-chains with input/output variable mapping), and ASSERT (fail chain if value does not match)
Fuzzing Security tier: mark any probe field with §payload§; run a payload list and get status codes, durations, and response previews for each attempt
Design system: Phosphor icon set, Geist + Geist Mono + Chakra Petch fonts, design token layer; consistent across all protocols
Community library: 78+ ready-made probes available on the Free tier; the Engineering tier adds integrations (Slack, Jira, GitHub, Linear, Stripe, AWS, Azure, GCP) and the Security tier adds pentesting collections

0.0.1

Initial release.

Seven protocols: HTTP, SMTP, IMAP, LDAP, SpamAssassin, SOCKS5 proxy (MITM), and a hand-written implementation of each against the relevant RFC; no library constraints means full fuzzing and interoperability control
Chain builder: connect probes into multi-step sequences; HTTP, SMTP, and IMAP steps; extract values (JSON path, status code, regex, constant) and pass them as {{variables}} to subsequent steps; ITERATE over lists
Groovy scripting: write scripts that call probes programmatically, extract results, and drive logic with a full scripting environment
Probe history: every execution is saved with a snapshot of the probe as sent and the full response; history survives restarts
Project environments: define variable sets per project; switch between environments without editing probes
Library: browse, search, and import probes from curated collections directly into your bundles
SOCKS5 MITM proxy: route traffic through VirtuProbe and inspect every exchange in a DevTools-style stream with per-connection decompression (gzip, deflate, Brotli)