March 28, 2026

Multi-Target Testing, Real-World Spec Support, and Conformance Maturity

Versions 0.3.91 through 0.3.103 represent two weeks of intensive field testing with a community user running MockForge against production proxy infrastructure with 66+ targets and real-world OpenAPI specs from GitHub, Amazon S3, Xero, and custom enterprise APIs. The result is a significantly more robust tool for large-scale API testing.

Multi-Target Load Testing

MockForge now handles parallel load testing across dozens of targets reliably. Each k6 instance gets a unique API server port to prevent conflicts. The summary parser correctly handles k6 threshold exits and newer k6 versions that deprecated --summary-export. Per-target results are exported as both JSON and CSV for easy analysis.

mockforge bench --spec api.json --targets-file targets.json \
  --vus 2 --max-concurrency 20 -d 1800s --insecure

The JSON targets file supports per-target headers, auth tokens, and even per-target OpenAPI specs—critical when testing heterogeneous proxy deployments where each target needs different Referer or Origin headers.

Multi-Target Conformance

--conformance combined with --targets-file now runs conformance tests against each target sequentially, producing per-target reports and a combined summary. This enables validating API contract compliance across an entire fleet from a single command.

Real-World OpenAPI Spec Compatibility

Loading the GitHub API spec (1,078 routes) previously caused a panic due to conflicting parameter names at the same path position. MockForge now canonicalizes parameter names across the route tree, handling specs from GitHub, Xero, Amazon, and other large APIs without crashes. Swagger 2.0 specs with formData parameters are now properly converted to OpenAPI 3 request bodies.

HAR-to-YAML Generator

A new command converts browser HAR captures directly into custom conformance YAML:

mockforge har-to-conformance --har recording.har --output checks.yaml

This auto-detects the base URL, filters static assets, and extracts response headers and JSON body field types. The output plugs directly into --conformance-custom for regression testing against real API behavior.

Field-Level Schema Validation

Conformance failures now pinpoint exactly which field violated the schema—not just that validation failed. Each violation includes the JSON path, violation type, and expected vs actual values. This transforms schema errors from opaque failures into actionable diagnostics.

Quality-of-Life Improvements

Host header and Client IP displayed in both the TUI dashboard and web admin UI
Total elapsed time and all_targets.csv in multi-target output
Cookie-based auth no longer conflicts with auto-generated Basic Auth headers
Contract diff warnings downgraded from WARN to DEBUG
OData function call paths supported over TLS

What We Learned

This cycle was driven entirely by field feedback—a single user systematically testing against real infrastructure exposed assumptions that unit tests missed. k6’s deprecated --summary-export, matchit’s parameter name constraints, and Swagger 2.0’s formData semantics were all invisible until someone ran MockForge against production APIs at scale. The takeaway: real-world specs and real proxy topologies are the ultimate test suite.

Docs GitHub