Self-Hosted API Testing
AI-native API testing that runs on your own infrastructure
For teams that can't ship API specs to the cloud: generate REST, SOAP, and GraphQL tests with your own self-hosted LLM, keep specs and data inside your perimeter, and integrate with the CI/CD stack you already run.
Why self-hosted API testing
When your API specifications are in-scope for security and compliance review, where the testing — and the AI behind it — runs is the whole decision.
Your API specs never have to leave your perimeter
Cloud-based AI testing tools generate tests by sending your OpenAPI or WSDL spec to a third-party LLM. Self-hosted Shift-Left API runs that same generation against an LLM you host (Ollama, vLLM, LM Studio, or any OpenAI-compatible endpoint), so specs and prompts stay inside your boundary.
Bring your own LLM, or run air-gapped
Point the platform at a local model so no AI call leaves your network, or at an internal inference endpoint. For air-gapped installs, telemetry is off by default; licence validation and updates contact Total Shift Left, so ask us about offline licensing. Cloud providers such as OpenAI, Anthropic, Gemini and Azure OpenAI remain an option for non-sensitive workloads — they are never a requirement.
The protocols your stack actually runs
REST, SOAP with WSDL parsing, and GraphQL are first-class — not a legacy mode — with JSON-RPC 2.0/MCP and WebSocket-RPC on Trial and Enterprise editions. Import OpenAPI 3.0/3.1 and Swagger 2.0, auto-discover endpoints, and generate coverage for every operation.
CI/CD and agents, on your infrastructure
GitHub Actions, Jenkins and Azure DevOps first-party integrations, plus a public REST API for GitLab CI, CircleCI, Bitbucket, and any other pipeline — all driving runs inside your environment. An MCP server connects Claude, Cursor, and other AI agents.
How it works on your infrastructure
Deploy inside your boundary
Run the Windows installer on a server you control: the backend as a Windows service plus the desktop client, on your own MongoDB. See the full topology on the deployment page.
Connect your own LLM
Configure a self-hosted endpoint — Ollama, vLLM, LM Studio, or any OpenAI-compatible model. No cloud key required.
Import specs and generate
Point the platform at OpenAPI, Swagger, or WSDL. AI generates REST, SOAP, and GraphQL tests for every endpoint.
Run in CI/CD with evidence
Execute via the desktop runner or a first-party CI/CD plugin. Export run reports and audit logs for every release.
Go deeper
Deployment & topology →
Reference architecture, install paths, and infrastructure requirements.
Platform security →
RBAC, AES-256 credential storage, audit logs, and data-protection details.
API security testing →
OWASP-mapped checks generated beside your functional tests and run inside your own boundary. Paid add-on, included in the trial.
Compliance & data residency →
How self-hosting maps to SOC 2, FedRAMP, HIPAA, ISO 27001, and GDPR.
Regulated industries →
Banking, insurance, healthcare, and public-sector specifics.
FAQs
What does "self-hosted API testing" mean here?
The entire platform — the test runner, the data, and the LLM that generates tests — runs on infrastructure you control. Your API specifications and test data stay inside your perimeter rather than transiting a vendor SaaS or a third-party AI service.Can it run fully air-gapped?
An on-prem install can run with no outbound AI calls. With a self-hosted LLM (Ollama, vLLM, LM Studio, on Trial and Enterprise) and an on-prem install, test generation and execution make no call to a cloud AI provider, and telemetry is off by default. Licence validation and updates contact Total Shift Left, so ask us about offline licensing for air-gapped installs.Do I have to use my own LLM?
For regulated workloads that is the default and recommended posture. You can optionally configure a cloud provider for non-sensitive projects, but cloud LLMs are never required.Which protocols are supported?
REST, SOAP (with WSDL parsing), and GraphQL on all plans, with OpenAPI 3.0/3.1, Swagger 2.0, and Postman collection import. JSON-RPC 2.0 (including MCP server tool discovery and OpenRPC import) and WebSocket-RPC are available in Trial and Enterprise editions, and Server-Sent Events streaming responses are supported.How is this different from a cloud API testing tool?
Cloud tools centralize your specs and test data in their environment and typically call a hosted LLM for AI features. Self-hosted Shift-Left API keeps all of that inside your boundary while still providing AI-native test generation, multi-protocol coverage, and CI/CD integration.
Talk to the architect who'll run your deployment
30-minute working call. Self-hosted topology, your-LLM configuration, and a security questionnaire response shared on the call, so your security team can review in parallel.