Data sheet

Traffic Parrot is an API and service simulation (service virtualization) platform, a product of Traffic Parrot Ltd. It stands in for the APIs, services and systems your application depends on, so your teams can test without waiting for a shared environment, a third party or a mainframe to be available.

One installation simulates HTTP(S) (REST, SOAP and GraphQL), gRPC, WebSocket, JMS, native IBM® MQ with the CICS bridge, file transfers over the local file system, FTP and SFTP, and Thrift, from one web console, one management API and one MCP endpoint for AI agents.

One Traffic Parrot instance is one Java process. It serves the administration console, the management APIs and the MCP endpoint, and runs the virtual services the system under test connects to, each on its own port or queue: HTTP(S), gRPC, WebSocket, JMS, native IBM® MQ, file transfers and Thrift. A small launcher process starts the server and, with the shipped start script, exits once the server is up. Mappings, and the files they reference, are kept on the local file system as JSON, one directory per scenario.

For a message queue the virtual service consumes from the request queue and replies on the response queue, on Traffic Parrot's internal broker or on your own broker or queue manager.

Each entry links to the documentation page that describes it.

What each protocol's virtual service records, replays and imports, and how an unmatched request is diagnosed.

• Role-based access: a read-only role and an edit role, checked on every request that would change Traffic Parrot, through the console, the APIs it serves and the MCP endpoint.
• Single sign-on with Okta for the web console.
• Credentials can stay out of recordings: with recording redaction switched on, Authorization, Cookie and any header you name are masked in what recording saves and in the log, and the rewrite rules you define keep secrets out of recorded bodies.
• Passwords and secret-looking settings are redacted in the log Traffic Parrot writes at startup.
• The MCP endpoint accepts requests from the local machine only unless you configure a bearer token, checks the browser Origin, and, with the console login on, refuses a tool that changes something to a user without the edit role.
• HTTPS with your own certificates, limited to the TLS protocol versions and cipher suites you choose.
• Webhooks are signed both ways: outbound callbacks carry an HMAC signature, and an inbound webhook's signature is verified before a mapping matches it.
• AI-written mocks are bounded by a helper policy, and the MCP tools preview a change before it is applied.
• On your own infrastructure: Traffic Parrot installs on your machines, virtual machines or clusters, and its licence is read from a file or an environment variable, or from a licence server you host.

Traffic Parrot requires Java 17 or later. Three of the four downloads bundle a Java runtime, so the JVM is already in the ZIP package you download; the fourth runs on a Java runtime you install, on any of the supported operating systems.

Although Traffic Parrot is built on the JVM it works over the wire, so the systems it simulates and the applications it serves can be written in any language, and no Java knowledge is needed unless you want to write Traffic Parrot plugins and extensions. For example, you can use Traffic Parrot to mock Go or .NET C# microservice APIs.

Hardware requirements

Traffic Parrot ships with a small default Java heap (-Xmx128m in the install's jvm.args file), which you raise for larger recordings, larger datasets, or multiple virtual services per instance (see JVM arguments). The figures below are sized for that default configuration; high request rates and performance testing need more (see Performance testing for sizing guidance).

Software requirements