Self-Hosted API Testing
Self-Hosted, On-Premise API Testing Tool with Your Own LLM
Shift-Left API is a self-hosted, on-premise API testing tool. A Windows installer runs the backend as a service on your server against your own MongoDB, and AI features can call Ollama, LM Studio or vLLM (Trial and Enterprise). It integrates with GitHub Actions, Jenkins, Azure DevOps and a REST API. Free developer licence, 15-day trial, annual plans.
Deployment options
The same product runs in three shapes. Self-hosting is not edition-gated: it is available on every plan, Free included.
| Option | Where it runs | Where data lives | Best for |
|---|---|---|---|
| Cloud SaaS | Hosted by Total Shift Left at your own subdomain | A separate database per customer; no region choice today | Teams with no data-location constraint |
| Self-hosted server | Windows installer on a server you control: backend as a Windows service, plus the desktop client | Your own MongoDB 4.4+ (local or your Atlas cluster) | Regulated teams, private networks, shared team server |
| Desktop + local runner | Shift-Left Studio desktop app on Windows or macOS, with the local runner | Tests run from your machine against APIs only your network can reach | Testing internal APIs without exposing them |
Not available today: a Docker or Kubernetes image for the main platform, high availability or clustering (roadmap), and a data-residency selector on the cloud SaaS.
Pick an AI policy your security team will sign
One active model per installation. Switch between these modes in AI Settings; none of them is required to generate a test suite.
Every plan
No AI at all
The coverage engine plans 79 scenario classes across 12 dimensions with no AI key. Failure triage still works.
Every plan
Your own cloud key
Bring a key from 19 provider families (OpenAI, Anthropic Claude, Google Gemini, Azure OpenAI, Mistral and more). Keys are encrypted at rest.
Trial and Enterprise
Self-hosted LLM
Point AI features at Ollama, LM Studio, vLLM or any OpenAI-compatible server you run. No call to a cloud AI provider.
Why teams choose self-hosted API testing
When your API specifications are in scope for security and compliance review, where the testing (and the AI behind it) runs is the whole decision. Comparing vendors? Use our on-prem API testing platform buyer checklist.
Your API specs stay inside your perimeter
Cloud AI testing tools generate tests by sending your OpenAPI or WSDL spec to a third-party model. Self-hosted Shift-Left API keeps specs, test data and run history on your server, and AI generation can run against an LLM you host.
Air-gapped: what works and what to arrange
With a self-hosted install and a self-hosted LLM, test generation and execution make no call to a cloud AI provider, and usage telemetry is opt-in and off by default. Licence validation and updates still contact Total Shift Left unless arranged otherwise, so ask us about offline licensing before you plan an air-gapped install.
The protocols your stack actually runs
REST, SOAP with WSDL import, and GraphQL on every plan, with JSON-RPC 2.0/MCP and WebSocket-RPC on Trial and Enterprise. Import OpenAPI 3.0/3.1, Swagger 2.0, WSDL, GraphQL, Postman collections and cURL.
CI/CD on your infrastructure
A first-party GitHub Action, Jenkins plugin and Azure DevOps task, plus a public REST API for GitLab CI, CircleCI, Bitbucket Pipelines and any other pipeline. Run the CI job on a self-hosted runner inside the same network as your Shift-Left server.
How it works on your infrastructure
Deploy inside your boundary
Run the Windows installer on a server you control: the backend as a Windows service plus the desktop client, on your own MongoDB. Silent install, corporate proxy and TLS inspection are supported.
Choose your AI policy
No AI, your own cloud key, or a self-hosted model (Ollama, vLLM, LM Studio or any OpenAI-compatible endpoint) on Trial and Enterprise.
Import specs and generate
Import OpenAPI, Swagger, WSDL or GraphQL. Tests for every endpoint are planned from the schema, with AI adding edge cases if you enable it.
Run in CI/CD with evidence
Trigger packs from your pipeline. CI runs write JUnit XML and a JSON summary, and the audit log records who changed what, from where.
Go deeper
Buyer checklist: on-prem API testing platforms →
What to ask any vendor about deployment, AI, licensing and audit evidence before you shortlist.
Deployment & topology →
Reference architecture, install paths and infrastructure requirements.
Self-hosted LLM integration →
Configure Ollama, LM Studio or vLLM in AI Settings, with a connection test before you save.
API security testing (paid add-on) →
OWASP-mapped checks generated beside your functional tests and run inside your own boundary. Included in the trial.
API load testing (paid add-on) →
Load, stress, spike and soak tests from the functional tests you already have, with load agents on your own machines. Included in the trial.
Platform security →
RBAC, AES-256-GCM secret storage, audit logs and data-protection details.
Compliance & data residency →
How self-hosting supports the controls behind SOC 2, HIPAA, ISO 27001 and GDPR reviews. Evidence, not certification.
Regulated industries →
Banking, insurance, healthcare and public-sector specifics.
FAQs
What is a self-hosted API testing tool?
One where the test platform, its data and, optionally, the AI model run on infrastructure you control instead of a vendor cloud. With Shift-Left API that means a Windows installer on your server, your own MongoDB, and an optional self-hosted LLM on Trial and Enterprise.Can it run fully air-gapped?
Test generation and execution can run with no outbound AI calls when you use a self-hosted LLM (Trial and Enterprise), and telemetry is off by default. Licence validation and updates contact Total Shift Left unless arranged otherwise, so ask us about offline licensing for air-gapped installs.Is there a Docker or Kubernetes image?
Not for the main platform today. Self-hosted installs use the Windows installer, which runs the backend as a Windows service against your MongoDB. High availability and clustering are on the roadmap.Do I have to use my own LLM?
No. You can run with no AI at all (generation and triage still work), bring your own cloud key, or use a self-hosted model on Trial and Enterprise. For regulated workloads the self-hosted model is the usual choice.Which plans include self-hosting?
Self-hosted deployment is available on every plan, including the free developer licence. The self-hosted LLM is Trial and Enterprise only. Professional and Enterprise are annual licences on a custom quote; performance and security testing are paid add-ons.Which protocols are supported?
REST, SOAP (with WSDL import) and GraphQL on all plans, with OpenAPI 3.0/3.1, Swagger 2.0 and Postman collection import. JSON-RPC 2.0 (including MCP server tool discovery and OpenRPC import) and WebSocket-RPC are available in Trial and Enterprise, and Server-Sent Events streaming responses are supported.
Talk to the engineer who'll plan your deployment
30-minute working call on self-hosted topology, your AI policy and licensing for restricted networks. An engineer replies to every request within one business day.