Sponsor MCPSafe10 founding slots
Registry/Aimock MCP Server

Aimock MCP Server

v1.38.0
Verified

Mock everything your AI app talks to — LLM APIs, MCP, A2A, AG-UI, vector DBs, search. One package, one port, zero dependencies.

MIT
typescript
data processing
953stars
3.6Mdownloads
75forks
Scanned Oct 2, 2026
WebsiteRepositoryGITHUB
Automated scan (limited checks) · 2026-10-02

This grade comes from an automated MCPSafe scan of the server's JavaScript, TypeScript and Python source on 2026-10-02. It read the whole repository (111 files). It checks for leaked credentials, shell or code injection from function inputs, unsafe deserialization, malware signatures, install-time scripts, and weak password handling. It does not check for path traversal, server-side request forgery, prompt injection in tool descriptions, network exposure, SQL injection, cross-site scripting, or vulnerable dependencies. It has not been manually reviewed, and the code may have changed since the scan.

A+100%
Scanned 1w ago

Excellent Security

Vulnerabilities Found
0Crit
0High
0Med
0Low
0Info

Trust Score 84

Review required
Trust grade B

Trust is stricter than security: it combines reviewed security, MCP capability risk, supply-chain metadata, quality, popularity, freshness, and penalties for unknowns.

Security
100
MCP risk
42
Supply chain
100
Maintenance
67
Docs
100
Freshness
80
Risk traits
Runs shell commands
Filesystem access
Network/API access
Requires secrets
Remote transport
Why it scores well
  • • No reviewed severe vulnerabilities published
  • • Strong project quality signals
  • • Good documentation surface
  • • Solid supply-chain metadata
  • • Recently scanned
What reduces confidence
  • • MCP risk traits: Runs shell commands, Filesystem access, Network/API access

Security ScoreA+

100
out of 100

Vulnerabilities Found

0
Crit
0
High
0
Medi
0
Low
0
Info
Last scanned: 10/2/2026

Quality ScoreB

82
out of 100
67
Maint.
87
Popular
100
Docs
78
Compat
Maintenance67%
Popularity87%
Documentation100%
Compatibility78%

Maintenance67

Unknown
Commit Frequency65%
Release Frequency70%
Issue Response65%

Popularity87

953
Stars
3.6M
Downloads
75
Forks
Stars Score83%
Downloads Score100%
Forks Score66%

Documentation100

README Quality100%

Available Documentation

API DocsExamplesChangelog

Compatibility78

MCP Spec Compliance80%
Transport Support75%

Features

TypeScript

Supported Transports

STDIO

Vulnerabilities(0)

This grade comes from an automated scan. Individual findings from automated scans are not published.

READMEAimock MCP Server

View source

<div align="center">

aimock

Mock infrastructure for AI application testing — point your SDK at one local port and every provider, protocol, and service answers deterministically.

**Quick start** · **The suite** · **Record & replay** · **Docs**

![npm](https://www.npmjs.com/package/@copilotkit/aimock)

![Unit Tests](https://github.com/CopilotKit/aimock/actions/workflows/test-unit.yml)

![Drift Tests](https://github.com/CopilotKit/aimock/actions/workflows/test-drift.yml)

![License: MIT](./LICENSE)

</div>

https://github.com/user-attachments/assets/76815122-574a-48e1-b275-edae0a014667

<div align="center">

One package, one port, zero dependencies. LLM APIs, image generation and

editing, text-to-speech, transcription, audio translation and generation, video

generation, embeddings, MCP tools, A2A agents, AG-UI event streams, vector

databases, search, rerank, and moderation — no keys, no network, no surprise

bills.

</div>

Quick Start

bash
npm install @copilotkit/aimock
typescript
// The class is still named `LLMock` for back-compat after the v1.7.0 package
// rename from `@copilotkit/llmock` to `@copilotkit/aimock`.
import { LLMock } from "@copilotkit/aimock";

const mock = new LLMock({ port: 0 });
mock.onMessage("hello", { content: "Hi there!" });
await mock.start();

// Set env BEFORE importing/constructing the OpenAI (or other provider) client.
// Many SDKs cache the base URL at construction time — if the client is built
// before these are set, it will talk to the real API (surprise bills) instead
// of aimock.
process.env.OPENAI_BASE_URL = `${mock.url}/v1`;
process.env.OPENAI_API_KEY = "mock"; // SDK requires a value, even when base URL is mocked

// ... run your tests ...

await mock.stop();

The aimock Suite

aimock mocks everything your AI app talks to:

| Tool | What it mocks | Docs |

| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |

| LLMock | OpenAI (Chat/Responses/Realtime GA+Beta), Claude, Gemini (REST/Live/Interactions/Embeddings), Bedrock, Azure, Vertex AI, Ollama (chat/embeddings), Cohere (chat/embed), OpenRouter (chat/router), ElevenLabs TTS | Providers |

| MCPMock | MCP tools, resources, prompts with session management | MCP |

| A2AMock | Agent-to-agent protocol with SSE streaming | A2A |

| AGUIMock | AG-UI agent-to-UI event streams for frontend testing | AG-UI |

| VectorMock | Pinecone, Qdrant, ChromaDB compatible endpoints | Vector |

| Services | Tavily search, Cohere rerank, OpenAI moderation, ElevenLabs TTS | Services |

Run them all on one port with npx @copilotkit/aimock --config aimock.json, or use the programmatic API to compose exactly what you need.

Features

  • [Record & Replay](https://aimock.copilotkit.dev/record-replay) — Proxy real APIs, save as fixtures, replay deterministically forever
  • Timing-aware recording and replay — Recorded fixtures capture per-frame arrival timestamps; replay uses recorded timings for approximate timing reproduction based on recorded TTFT and inter-frame cadence (replay chunk count may differ from recording — TTFT and average pace are preserved, not per-token fidelity) with configurable --replay-speed multiplier
  • [Recorded token usage and cost](https://aimock.copilotkit.dev/record-replay) — Recording captures the final usage frame of a streaming completion, so replayed fixtures serve real prompt_tokens / completion_tokens instead of a length estimate; OpenRouter's provider-reported usage.cost and its cost_details / *_tokens_details breakdowns are captured too, so an app that bills from real provider cost can e2e-test its wallet path from a tape
  • [Multi-turn Conversations](https://aimock.copilotkit.dev/multi-turn) — Record and replay multi-turn traces with tool rounds; match distinct turns via turnIndex, hasToolResult, toolCallId, toolResultContains (gate on the tool-result payload), sequenceIndex, systemMessage (gate on host-supplied agent context), or custom predicates
  • [14 providers across 16 API surfaces](https://aimock.copilotkit.dev/docs) — OpenAI Chat, OpenAI Responses, OpenAI Realtime (GA + Beta shim), Claude, Gemini REST, Gemini embedContent, Gemini Live, Gemini Interactions, Azure, Bedrock, Vertex AI, Ollama (chat + embeddings), Cohere (chat + embed), OpenRouter (chat + router failover), BytePlus Ark (OpenAI-compatible chat + images under /api/v3), ElevenLabs TTS — full streaming support
  • Multimedia APIs — image generation (DALL-E, Imagen), image editing (/v1/images/edits), text-to-speech (OpenAI + ElevenLabs), audio transcription, audio translation (/v1/audio/translations), video generation, OpenRouter video generation (/api/v1/videos with async job lifecycle), Google Veo video generation (:predictLongRunning + /v1beta/operations async lifecycle), Grok Imagine video generation (/v1/videos/generations with async job lifecycle), BytePlus Ark video generation (Seedance, /api/v3/contents/generations/tasks with async task lifecycle), fal.ai (image / video / audio with queue lifecycle)
  • [MCP](https://aimock.copilotkit.dev/mcp-mock) / [A2A](https://aimock.copilotkit.dev/a2a-mock) / [AG-UI](https://aimock.copilotkit.dev/agui-mock) / [Vector](https://aimock.copilotkit.dev/vector-mock) — Mock every protocol your AI agents use
  • [Chaos Testing](https://aimock.copilotkit.dev/chaos-testing) — 500 errors, malformed JSON, mid-stream disconnects at any probability; read, set and clear the rates at runtime via GET / POST / DELETE /__aimock/chaos, scoped to the caller's X-Test-Id so one test cannot destabilise the suite running beside it
  • Request journal — GET /__aimock/journal returns every recorded request, filterable by path, method, status, service and testId with limit / offset paging and an X-Total-Count header carrying the pre-pagination total
  • Per-Request Strict Mode — X-AIMock-Strict header overrides the server-level --strict flag per request (true/1 = strict, false/0 = lenient)
  • Context-Based Fixture Routing — X-AIMock-Context header scopes fixtures per integration; fixtures with match.context only match requests carrying that context, fixtures without it remain shared
  • [Drift Detection](https://aimock.copilotkit.dev/drift-detection) — Daily CI validation against real APIs
  • [Streaming Physics](https://aimock.copilotkit.dev/streaming-physics) — Configurable ttft, tps, and jitter
  • [WebSocket APIs](https://aimock.copilotkit.dev/websocket) — OpenAI Realtime (GA protocol with models: gpt-realtime, gpt-realtime-2, gpt-realtime-1.5, gpt-realtime-mini; transcription/translation via gpt-4o-transcribe, gpt-4o-mini-transcribe, whisper-1; image input; commentary phase), Responses WS, Gemini Live
  • [Prometheus Metrics](https://aimock.copilotkit.dev/metrics) — Request counts, latencies, fixture match rates
  • [Docker + Helm](https://aimock.copilotkit.dev/docker) — Container image and Helm chart for CI/CD
  • [Vitest & Jest Plugins](https://aimock.copilotkit.dev/test-plugins) — Zero-config useAimock() with auto lifecycle and env patching
  • [Response Overrides](https://aimock.copilotkit.dev/fixtures) — Control id, model, usage, finishReason in fixture responses
  • [Ordered Blocks](https://aimock.copilotkit.dev/fixtures#ordered-blocks) — A blocks array streams text and tool calls in any order (tool-first or interleaved); blocks-only fixtures are first-class, and the recorder captures order from genuinely tool-first/interleaved streams
  • [Streaming Usage Chunks](https://aimock.copilotkit.dev/streaming-physics) — stream_options.include_usage support emits a final chunk with token counts, matching OpenAI's streaming usage protocol
  • [Rate Limiting Headers](https://aimock.copilotkit.dev/chaos-testing) — x-ratelimit-* headers on every response and Retry-After on 429 errors for testing retry/backoff logic
  • Zero dependencies — Everything from Node.js builtins

GitHub Action

yaml
- uses: CopilotKit/aimock@v1
  with:
    fixtures: ./test/fixtures

- run: npm test
  env:
    OPENAI_BASE_URL: http://127.0.0.1:4010/v1

See the GitHub Action docs for all inputs and examples.

CLI

bash
# LLM mocking only
npx -p @copilotkit/aimock llmock -p 4010 -f ./fixtures

# Remote fixtures — load JSON from an HTTPS URL (repeatable)
npx -p @copilotkit/aimock llmock -p 4010 \
  -f https://raw.githubusercontent.com/acme/mocks/main/openai.json \
  -f ./fixtures/local-overrides.json

# Full suite from config
npx @copilotkit/aimock --config aimock.json

# Record mode: proxy to real APIs, save fixtures
npx -p @copilotkit/aimock llmock --record --provider-openai https://api.openai.com

# Record with extended timeout for reasoning models
npx -p @copilotkit/aimock llmock --record --provider-openai https://api.openai.com \
  --body-timeout-ms 180000

# Replay recorded fixtures at 2× speed
npx -p @copilotkit/aimock llmock -p 4010 -f ./fixtures --replay-speed 2

# Convert fixtures from other tools
npx @copilotkit/aimock convert vidaimock ./templates/ ./fixtures/
npx @copilotkit/aimock convert mockllm ./config.yaml ./fixtures/

# Docker
docker run -d -p 4010:4010 -v "$(pwd)/fixtures:/fixtures" ghcr.io/copilotkit/aimock -f /fixtures -h 0.0.0.0
Note on `llmock` vs `aimock` CLIs. The llmock bin is retained as a compat alias for users of the pre-1.7.0 @copilotkit/llmock package. It runs a narrower flag-driven CLI without --config or the convert subcommand. New projects should use aimock (or npx @copilotkit/aimock) for full feature support.

Remote fixture URLs

--fixtures accepts https:// and http:// URLs pointing at JSON fixture files in addition to filesystem paths, and the flag is repeatable so you can layer remote and local sources in argv order. Fetched fixtures are cached on disk at ~/.cache/aimock/fixtures/<sha256-of-url>/ (honors $XDG_CACHE_HOME); when paired with --validate-on-load, a fetch failure with a valid cached copy logs a warning and continues — without a cache, the process exits non-zero. HTTP fetches have a 10s timeout and a 50 MB body cap; redirects are rejected fail-loud, so configure your upstream to serve the final URL directly (GitHub raw content URLs already do).

Private and link-local addresses (loopback, RFC1918, CGNAT, cloud metadata, ULA, multicast) are rejected by default to prevent SSRF. For local development or tests that need to hit 127.0.0.1, opt out with AIMOCK_ALLOW_PRIVATE_URLS=1. Tarball and zip URL support is intentionally deferred.

Replay matching & AIMOCK_STRICT_TURN_INDEX

On replay, turnIndex is a non-fatal disambiguator, not a hard reject gate: a content-matching fixture is served even when its scripted turnIndex differs from the request's assistant-message count. This kills false "no fixture matched" misses for multi-bubble agent runs (multi-step agents emit several assistant bubbles per logical turn). When a served fixture diverges from its scripted turnIndex, the match diagnostic carries turnIndexRelaxed: true and aimock logs a one-shot warning (at the warn log level — silent by default). To restore the legacy strict behavior where a defined turnIndex must equal the assistant count exactly, set AIMOCK_STRICT_TURN_INDEX=1. The record path is always strict regardless of this flag.

API-key validation

By default aimock accepts all requests. Opt into inbound test-client validation with a programmatic option, top-level aimock.json field, or environment-only key list:

ts
await createServer(fixtures, { auth: { apiKeys: ["test-key"] } });
json
{ "auth": { "apiKeys": ["test-key"] } }
bash
AIMOCK_API_KEYS=test-key,rotated-key npx @copilotkit/aimock --config aimock.json

Use Authorization: Bearer <key>, Authorization: Key <key>, x-api-key, x-goog-api-key, api-key, or xi-api-key. Every supplied credential must resolve to one configured key; mismatches return 401 with an OpenAI-compatible authentication error. HTTP routes, control APIs, mounts, and WebSocket upgrades are protected. Genuine CORS preflights plus GET /health, GET /ready, and GET /metrics remain public. This is inbound test access control, distinct from record.providerKeys; when enabled, proxying strips test credentials and requires a configured static provider credential before egress.

aimock-owned upstream keys — AIMOCK_PROVIDER_*_KEY

In record or --proxy-only mode, aimock forwards the caller's auth header to the real provider unchanged. If your tests can only send a dummy placeholder key (e.g. an SDK that refuses to start without a non-empty API key), aimock can inject its own configured upstream key on a fixture-miss passthrough so the proxied call actually authenticates. Each provider has an independent env var, and the key is applied with the provider-correct wire scheme:

| Env var | Provider | Injected header |

| -------------------------------- | -------------------------------- | ----------------------------- |

| AIMOCK_PROVIDER_OPENAI_KEY | OpenAI | Authorization: Bearer <key> |

| AIMOCK_PROVIDER_OPENROUTER_KEY | OpenRouter | Authorization: Bearer <key> |

| AIMOCK_PROVIDER_COHERE_KEY | Cohere | Authorization: Bearer <key> |

| AIMOCK_PROVIDER_GROK_KEY | Grok (xAI) | Authorization: Bearer <key> |

| AIMOCK_PROVIDER_BYTEPLUS_KEY | BytePlus Ark (ModelArk) | Authorization: Bearer <key> |

| AIMOCK_PROVIDER_OLLAMA_KEY | Ollama (Cloud / bearer-gated) | Authorization: Bearer <key> |

| AIMOCK_PROVIDER_ANTHROPIC_KEY | Anthropic | x-api-key: <key> |

| AIMOCK_PROVIDER_GEMINI_KEY | Gemini (and Gemini Interactions) | x-goog-api-key: <key> |

| AIMOCK_PROVIDER_VEO_KEY | Veo | x-goog-api-key: <key> |

| AIMOCK_PROVIDER_AZURE_KEY | Azure OpenAI | api-key: <key> |

| AIMOCK_PROVIDER_ELEVENLABS_KEY | ElevenLabs | xi-api-key: <key> |

| AIMOCK_PROVIDER_FAL_KEY | fal.ai | Authorization: Key <key> |

The Gemini interactions provider mode reuses AIMOCK_PROVIDER_GEMINI_KEY (same upstream API as Gemini). An empty-string value is treated as unset.

This is opt-in and backward-compatible: with no key configured the feature is inert and the caller's header passes through as-is. Injection fires only when the caller sent no credential or a dummy credential prefixed with sk-aimock- (overridable via AIMOCK_DUMMY_KEY_MARKER); a real caller key never starting with that marker is always forwarded verbatim, so the caller overrides aimock. Signed and exchanged credentials — AWS Bedrock (SigV4) and Vertex AI (OAuth) — are never rewritten and always forwarded unchanged. (Azure's static api-key is injected; a real Microsoft Entra ID Authorization: Bearer token from the caller is never dummy-prefixed, so it too passes through verbatim.)

Framework Guides

Test your AI agents with aimock — no API keys, no network calls: LangChain · CrewAI · PydanticAI · LlamaIndex · Mastra · Google ADK · Microsoft Agent Framework

Switching from other tools?

Step-by-step migration guides: MSW · VidaiMock · mock-llm · piyook/llm-mock · Python mocks · openai-responses · Mokksy

Documentation

[https://aimock.copilotkit.dev](https://aimock.copilotkit.dev) · Example fixtures

Real-World Usage

AG-UI uses aimock for its end-to-end test suite, verifying AI agent behavior across LLM providers with fixture-driven responses.

License

MIT

Embed Security Badge

Add this badge to your README or documentation

Aimock MCP Server MCPSafe Security
[![Aimock MCP Server MCPSafe Security](https://api.mcpsafe.org
/api/badge/copilotkit-aimock.svg)](https://mcpsafe.org/registry/copilotkit-aimock)
Need more customization options?Badge Documentation

Server Information

Source
GITHUB
Version
1.38.0
Language
typescript
License
MIT
Transport
STDIO
Added
Aug 2, 2026
Updated
Oct 1, 2026