Bump mockserver-client from 6.1.0 to 7.0.0

[dependabot]

Bumps mockserver-client from 6.1.0 to 7.0.0.

Release notes

Sourced from mockserver-client's releases.

MockServer 7.0.0

[7.0.0] - 2026-06-06

This cycle centres on first-class LLM / AI-agent mocking and a major platform modernisation, alongside broader resilience-testing and dashboard improvements. Highlights (see the per-item entries below for detail):

• HTTP/3 streaming responses — SSE, chunked proxy forwarding, and LLM streaming are now fully supported over HTTP/3 (QUIC). Each body chunk is sent as an HTTP/3 DATA frame with backpressure via StreamingBody.requestMore(); the QUIC stream is cleanly shut down on completion or error. Bundled native QUIC removes the need for a separately downloaded BoringSSL library.
• TPROXY (IP_TRANSPARENT) transparent proxy — a new default-off transparentProxyTproxy configuration property enables IP_TRANSPARENT socket binding so that with iptables TPROXY rules the kernel preserves the original destination as the listening socket's local address, which MockServer reads via channel.localAddress() — avoiding the conntrack SO_ORIGINAL_DST lookup used with REDIRECT rules. Requires Linux, epoll transport, and CAP_NET_ADMIN. Verified end-to-end with a real Docker NET_ADMIN integration test.
• Testcontainers 1.21.4 — upgrades from 1.20.6, fixing DockerClientFactory.isDockerAvailable() returning false on Docker Desktop 4.67 / Engine API 1.54 (docker-java 3.4.2 probe fix).
• Clustered MockServer state (opt-in) — a new mockserver-state-infinispan module provides an embedded Infinispan StateBackend that can replicate expectations and scenario state across a JGroups cluster. Single-node behaviour is completely unchanged (the in-memory StateBackend remains the default). New configuration properties: stateBackend, clusterEnabled, clusterName, clusterTransportConfig, blobStoreType.
• LLM / AI-agent mocking suite — provider-correct mock completions and streaming for seven providers (Anthropic, OpenAI, OpenAI Responses, Azure OpenAI, Gemini, Bedrock, Ollama), with embeddings for OpenAI and Azure OpenAI; multi-turn scripted conversations with per-session isolation and deterministic prompt normalisation; and a runtime-LLM client SPI (off unless configured, fails closed) that powers the opt-in features. A broad MCP toolset drives it from an agent: mock_llm_completion, create_llm_conversation, verify_tool_call, explain_agent_run (with a correlated call graph), verify_structured_output, verify_cost_budget, detect_llm_drift, mock_adversarial_llm_response, and run_mcp_contract_test.
• Agent resilience & correctness testing — structured-output (JSON-Schema) validation on both the response path (outputSchema, fail-soft) and the verification path (verify_structured_output); a deterministic CI cost-budget gate (verify_cost_budget) over a built-in pricing table; declarative LLM fault/chaos profiles (probabilistic provider errors, mid-stream truncation, malformed SSE) plus a stateful request-quota rate limit; VCR record/replay with strict mode and body/header redaction; a prompt-injection / adversarial-response harness; and OpenTelemetry GenAI span + metrics export. The dashboard surfaces all of it (conversation wizard, sessions & call-graph, metrics view, export).
• HTTP chaos/fault injection — a general HttpChaosProfile (probabilistic error status + latency) attachable to any mocked or forwarded response, making MockServer usable as a chaos proxy for unreliable upstreams.
• Platform modernisation (breaking) — minimum runtime raised to Java 17; full Jakarta EE 10 / Servlet 6 migration (Spring 7 / Boot 4, Tomcat 11, Jetty 12, Jersey 4, Netty 4.2); json-schema-validator 3.x; a bundled DataFaker template helper; and ZGC tuning guidance.

Security

• Released Docker images are now cosign-signed by digest (Docker Hub and ECR Public), using the same signing key infrastructure as the Helm OCI chart. Consumers can verify image provenance with cosign verify. Signing is non-fatal in the pipeline if the key is unavailable, so it never blocks a release.
• Website security hardening — the documentation site (mock-server.com) now sends Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy response headers via CloudFront, and the domain publishes CAA records pinning certificate issuance to Amazon.
• Build/release infrastructure hardening (internal) — least-privilege scoping of CI secrets per Buildkite agent queue, removal of release-only permissions (ECR push) from the PR-build queue, secrets passed to release containers via 0600 files instead of docker -e environment variables, robust git-push-token cleanup, scoped cross-account AssumeRole (ExternalId) and tfstate IAM, full VPC flow logging, GuardDuty→SNS alerting, CloudTrail data-events on secrets/state, and SSE-KMS on the state and AWS Config buckets. See docs/infrastructure/aws-infrastructure.md, docs/infrastructure/ci-cd.md, and docs/operations/website.md.

Added

• Added a daily performance-regression pipeline (notify-only) that guards response latency, throughput, and CPU/memory against drift across releases. It runs on a dedicated, pinned, on-demand, scale-to-zero Buildkite perf queue and fires once per day only when master moved since the last run. Each run measures four behaviours (mock match, forward/proxy, Velocity template, large-body) over HTTP and HTTPS/HTTP-2 (k6/regression.js), a sustained resource-growth run that surfaces "increases over time" regressions such as the issue #2329 O(n) log-eviction CPU climb (k6/growth.js, CPU/heap/latency slope ratios), and the JMH MatchingBenchmark allocation backstop. Results are persisted to S3 and each run is compared against a rolling median+MAD baseline of recent runs, posting a Buildkite annotation table when a metric regresses. See docs/operations/performance-tuning.md.

LLM & AI-agent mocking

• Added a dedicated retrieve_logs MCP tool so an AI assistant debugging a failing test can pull MockServer's recorded log messages (request matching, mismatches, actions and errors) directly. It is a thin, discoverable wrapper over the existing LOGS retrieval path (shared with raw_retrieve), with an optional correlationId filter (trace one request's full lifecycle) and a limit (most-recent N, default 100, max 500). This fills the gap left by its sibling tools retrieve_recorded_requests / retrieve_request_responses, which already existed. See the AI/MCP tools page.
• Added a runtime-LLM client SPI (org.mockserver.llm.client) that lets MockServer call a real LLM you already run, as the foundation for opt-in features such as drift detection and exploratory semantic matching. Mirrors the existing codec registry: an LlmClient per provider (Ollama, OpenAI, OpenAI Responses, Azure OpenAI, Anthropic, Gemini, Bedrock) registered in LlmClientRegistry, an immutable LlmBackend config (with the API key redacted in logs), and a three-layer LlmBackendResolver (provider env vars → mockserver.llmProvider/llmApiKey/llmModel/llmBaseUrl → named-backends JSON via mockserver.llmBackendsConfig). All runtime-LLM use goes through LlmCompletionService, which is off unless a backend is configured, fails closed on any timeout/error/non-2xx (never flipping a deterministic result), and caches per normalised prompt for reproducibility. Ollama is the reference backend (no key, local); Bedrock builds the Anthropic-on-Bedrock request and relies on the headers escape hatch pending automatic SigV4 signing. See the configuration properties page and docs/code/llm-mocking.md.
• LLM conversation mocks can now opt into deterministic prompt normalisation before the latestMessageContains / latestMessageMatches predicates are evaluated, so a match is not blocked by cosmetic differences in dynamically-assembled agent prompts. A new normalization block on conversationPredicates (also exposed per-turn in the create_llm_conversation MCP tool and the dashboard conversation wizard) supports collapsing whitespace, lowercasing, sorting JSON object keys, dropping built-in volatile values (ISO-8601 timestamps, UUIDs, req_/msg_/call_ ids), and dropping named JSON fields. Normalisation is pure and idempotent — it never makes a test flaky — and has no effect unless a text predicate is set. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added two MCP tools for agent-run analysis and tool-call assertions, both backed by a new deterministic org.mockserver.llm.analysis.AgentRunAnalyzer that reconstructs an agent run by decoding the LLM requests MockServer recorded. verify_tool_call asserts that an agent called a named tool a given number of times (atLeast/atMost, with an optional regex over the tool-call arguments); explain_agent_run summarises the run's structure (message and assistant-turn counts, the ordered tool-call sequence, tool results, and the latest message role). Read-only and offline — no LLM call. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added a correlated agent-run call graph. AgentRunAnalyzer.buildCallGraph reconstructs a recorded run as a graph — a node per message and per assistant tool call, with NEXT (sequence), INVOKES (turn→tool call), and RESULT (tool call→its result, correlated by tool-call id) edges — exposed in the explain_agent_run MCP result as a callGraph field. The dashboard Sessions view renders it per session (a "Call graph" button loads it via explain_agent_run): each step shows the message role and the tool calls it made, with a result indicator, plus a copyable Mermaid flowchart source. Deterministic and read-only. See docs/code/llm-mocking.md.
• Added opt-in, exploratory semantic prompt matching for LLM conversations: a semanticMatch turn predicate (the intent the latest message should express) judged by a runtime LLM via the client SPI. It is off by default and never on the assertion path — the predicate is ignored unless mockserver.llmSemanticMatchingEnabled is set and a runtime backend resolves, so deterministic matching is never affected by default. Non-deterministic by nature (a live LLM judge), so it is documented for exploration only, never for CI assertions; fails closed (a non-affirmative/empty/errored judge does not match). Exposed in the Java TurnBuilder.whenSemanticMatch, the create_llm_conversation MCP tool, and the dashboard wizard (clearly flagged exploratory). See docs/code/llm-mocking.md.

LLM resilience, validation & cost testing

• Added a verify_structured_output MCP tool: validate that the structured (JSON) output of recorded LLM responses conforms to a JSON Schema. It decodes each recorded response for a given provider (via the runtime-LLM client SPI), extracts the assistant's output text, and checks it against the schema — so you can assert that an agent (or a mocked model) produced schema-valid structured output. Read-only and deterministic; responses with no text output are reported separately as skipped, and the result gives per-response conformance with validation errors. See the AI/MCP tools page and docs/code/llm-mocking.md.
• A mock LLM completion can now declare an outputSchema (a JSON Schema) that its response text is expected to conform to. As the response is encoded, MockServer validates the configured text against the schema and, on a mismatch, fail-soft: the response body is returned exactly as configured but an x-mockserver-structured-output-invalid diagnostic header is added and a warning logged — so a malformed structured-output fixture is surfaced immediately while a deliberately non-conforming fixture still returns unchanged. A blank schema, absent text, or a malformed schema are all treated as "nothing to check" and never affect the response. Exposed on the Java Completion.withOutputSchema(...), the outputSchema field in expectation JSON, and the mock_llm_completion MCP tool (string or inline object). Complements the read-side verify_structured_output tool. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added a verify_cost_budget MCP tool: a deterministic, read-only cost gate for agent runs. It decodes each recorded LLM response for a provider (via the runtime-LLM client SPI), sums the input/output tokens from each response's usage, prices them with a new built-in pricing table (org.mockserver.llm.cost.LlmPricing, mirroring the dashboard's llmPricing.ts — same prefixes/rates), and asserts the total estimated USD cost is at or below maxCostUsd. The model can be pinned via a model param or read per-response from the recorded request body; responses with no usage are skipped and responses whose model has no known price are reported as unpriceable and excluded from the total. The result gives token/cost totals, withinBudget, and a per-response breakdown. Pricing is public list pricing captured 2025-Q4 (an estimate, not an invoice). See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added declarative LLM fault/chaos profiles for resilience testing, attachable to any mock LLM response (mock_llm_completion, each create_llm_conversation turn, the Java LlmConversationBuilder, and raw expectation JSON via a chaos block). Supports probabilistic provider errors (e.g. 429/529 with a Retry-After header), mid-stream truncation of an SSE stream (keep a leading fraction of events), and appending a malformed (broken-JSON) SSE chunk. Errors are deterministic at probability 0.0/1.0 and reproducible at fractional probabilities via a seed; truncation and malformed-SSE are always deterministic. A new LLM_CHAOS_INJECTED_COUNT metric tracks injections. The dashboard conversation wizard exposes the profile per turn. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added a stateful request quota to the LLM chaos profile — a deterministic fixed-window rate limit, the stateful counterpart to the existing probabilistic 429. Set quotaName, quotaLimit, and quotaWindowMillis (optional quotaErrorStatus, default 429) on a chaos block and requests beyond the limit within the window are rejected with that status and the retryAfter header. Expectations sharing a quotaName share one counter (model an upstream account limit across several mocks); the count resets when the window elapses and on server reset. Backed by a new process-wide, thread-safe org.mockserver.llm.LlmQuotaRegistry (injectable clock for deterministic tests). Exposed in expectation JSON, the mock_llm_completion/create_llm_conversation chaos MCP parameter, and the Java LlmChaosProfile. A misconfigured/partial quota fails open (never rate-limits). See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added a prompt-injection / adversarial-response harness for testing agent resilience. A new mock_adversarial_llm_response MCP tool returns a curated adversarial payload as the mock LLM response — prompt-injection ("ignore previous instructions…"), jailbreak persona-swaps, data-exfiltration requests, malformed/truncated JSON, an empty response, and an over-long repetition — so you can verify your agent resists hostile or malformed model/tool output. Backed by AdversarialResponseLibrary (deterministic; the payloads are benign test fixtures, not working exploits). A defensive testing aid. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added drift detection for LLM fixtures (detect_llm_drift MCP tool): replays a recorded cassette's exchanges against the live provider (via the runtime-LLM client SPI) and reports structural drift — new/removed fields and type changes in the responses — not semantic differences, so benign wording changes never flag. Built on a reusable, pure StructuralShapeDiff and a DriftDetector that fails closed per exchange (a network error or non-2xx live response is reported as could-not-check, never as drift, never thrown). Off unless a runtime backend is configured. Intended for an opt-in/scheduled CI lane (real API keys + tokens), never the per-commit build. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Completed the VCR (record/replay) toolkit for LLM fixtures with three additions. (1) Strict mode — load_expectations_from_file accepts strict (or set mockserver.llmVcrStrict), which registers a low-priority catch-all per cassette path so a request matching no recorded fixture returns HTTP 599 instead of silently falling through. (2) Body-field redaction — record_llm_fixtures accepts redactBodyFields (or set mockserver.fixtureBodyRedactFields) to redact named JSON fields from recorded request/response bodies, complementing the existing header redaction. (3) Replay field normalisation — load_expectations_from_file accepts normalizeRequestBodyFields to drop volatile JSON fields from each recorded request body and match the remainder loosely (ignoring extra fields), so per-run values (request ids, timestamps) do not block replay. These are operational settings exposed via config and MCP. See the AI/MCP tools and configuration properties pages.

HTTP chaos & protocol contract testing

• Added a time-to-live (auto-revert) to service-scoped chaos — an optional ttlMillis on a PUT /mockserver/serviceChaos registration makes the chaos automatically revert after that many milliseconds (a "dead-man's switch" so a fault self-heals even if the matching clear is never sent — e.g. an external chaos orchestrator crashes mid-experiment). It is also the one-shot time-box form: a single call breaks a host for a bounded window. Expiry is measured with the controllable clock (real-time by default, deterministic under PUT /mockserver/clock) and is applied lazily on the next lookup. Exposed via the endpoint, the Java/Node/Python/Ruby clients (setServiceChaos(host, chaos, ttlMillis) / ttl_millis), and the manage_service_chaos MCP tool. See the Chaos Testing page.
• Added service-scoped chaos — register one HttpChaosProfile for an upstream host and have it applied to all matched forwards to that host, instead of attaching a chaos block to every forwarding expectation (the "break service X" control for running MockServer as a chaos proxy). Manage it through a new control-plane endpoint PUT/GET /mockserver/serviceChaos ({"host":...,"chaos":{...}} to register, {"host":...,"remove":true} to remove, {"clear":true} to clear all), protected by control-plane authentication. Resolution happens only on the matched-forward path keyed by the request Host header (case-insensitive, port-ignored); an expectation's own chaos always takes precedence, the anonymous proxy fall-through is unaffected, and registrations clear on server reset. Backed by a new process-wide org.mockserver.mock.action.http.ServiceChaosRegistry. Convenience wrappers are exposed in all four clients (setServiceChaos/removeServiceChaos/clearServiceChaos/serviceChaosStatus in Java/Node, the snake-case equivalents in Python/Ruby) and via the manage_service_chaos MCP tool. See the Chaos Testing page.
• Added gradual degradation to the HTTP chaos block — a degradationRampMillis that linearly ramps errorProbability and dropConnectionProbability from 0 up to their configured values over the window from the expectation's first match, modelling a dependency that deteriorates over time (for alerting / SLO-burn tests). The ramp is measured with MockServer's controllable clock, so it is deterministic under clock freeze/advance with no real-time waiting; only the probabilistic rates ramp (latency, body corruption, slow response and quota are unaffected). Exposed in expectation JSON, the Java/Node/Python/Ruby clients, and the create_expectation chaos MCP parameter. See the Chaos Testing page.
• Added a stateful request quota to the HTTP chaos block — a deterministic fixed-window rate limit, the HTTP counterpart of the existing probabilistic 429 and of the LLM quota. Set quotaName, quotaLimit and quotaWindowMillis (optional quotaErrorStatus, default 429) and requests beyond the limit within the window are rejected with that status and the retryAfter header. Expectations sharing a quotaName share one counter (model an upstream account limit across several mocks); the count resets when the window elapses and on server reset. The quota gate takes priority over the probabilistic error and the body/slow faults (after connection-drop). Backed by a new process-wide, thread-safe org.mockserver.mock.action.http.HttpQuotaRegistry (separate from the LLM quota registry). Exposed in expectation JSON, the Java/Node/Python/Ruby clients, and the create_expectation chaos MCP parameter; metered as fault_type=quota. See the Chaos Testing page.
• Added a slow (dribbled) response fault to HttpChaosProfile — slowResponseChunkSize + slowResponseChunkDelay trickle the response body to the client in small chunks with a delay between each (via chunked transfer-encoding), for testing read timeouts and slow-network handling (distinct from latency, which delays the whole response by a fixed amount). Both fields are required; deterministic; applies to the real mocked or forwarded response within the active count and outage windows; skipped for streaming bodies; metered as fault_type=slow. Exposed in expectation JSON, the Java/Node/Python/Ruby clients, and the create_expectation chaos MCP parameter. See the Chaos Testing page.
• Added response-body corruption faults to HttpChaosProfile — truncateBodyAtFraction keeps only a leading fraction of the body bytes (e.g. 0.5 returns the first half, 0.0 empties it) and malformedBody appends a broken-JSON fragment so the payload fails to parse, for testing client-side body-parsing and partial-response resilience. Both are deterministic (no probability draw), apply to the real mocked or forwarded response within the active count and outage windows, preserve the Content-Type and drop any stale Content-Length (the encoder then sets the correct length) so the response stays well-framed, and are skipped for streaming bodies. Connection-drop and error injection still take priority (an injected error body is never corrupted). Exposed in expectation JSON, the Java/Node/Python/Ruby clients, and the create_expectation chaos MCP parameter; metered as fault_type=truncate / fault_type=malformed. See the Chaos Testing page.
• Added time-based outage windows (outageAfterMillis / outageDurationMillis) to HttpChaosProfile — chaos becomes active a configurable time after the expectation's first match and (optionally) self-heals after a bounded duration, modelling a dependency that degrades for a transient window then recovers. The window is measured with MockServer's controllable clock, so it is deterministic under clock freeze/advance (PUT /mockserver/clock) with no real-time waiting; it composes with the count window and the probability fields.

... (truncated)

Changelog

Sourced from mockserver-client's changelog.

[7.0.0] - 2026-06-06

This cycle centres on first-class LLM / AI-agent mocking and a major platform modernisation, alongside broader resilience-testing and dashboard improvements. Highlights (see the per-item entries below for detail):

• HTTP/3 streaming responses — SSE, chunked proxy forwarding, and LLM streaming are now fully supported over HTTP/3 (QUIC). Each body chunk is sent as an HTTP/3 DATA frame with backpressure via StreamingBody.requestMore(); the QUIC stream is cleanly shut down on completion or error. Bundled native QUIC removes the need for a separately downloaded BoringSSL library.
• TPROXY (IP_TRANSPARENT) transparent proxy — a new default-off transparentProxyTproxy configuration property enables IP_TRANSPARENT socket binding so that with iptables TPROXY rules the kernel preserves the original destination as the listening socket's local address, which MockServer reads via channel.localAddress() — avoiding the conntrack SO_ORIGINAL_DST lookup used with REDIRECT rules. Requires Linux, epoll transport, and CAP_NET_ADMIN. Verified end-to-end with a real Docker NET_ADMIN integration test.
• Testcontainers 1.21.4 — upgrades from 1.20.6, fixing DockerClientFactory.isDockerAvailable() returning false on Docker Desktop 4.67 / Engine API 1.54 (docker-java 3.4.2 probe fix).
• Clustered MockServer state (opt-in) — a new mockserver-state-infinispan module provides an embedded Infinispan StateBackend that can replicate expectations and scenario state across a JGroups cluster. Single-node behaviour is completely unchanged (the in-memory StateBackend remains the default). New configuration properties: stateBackend, clusterEnabled, clusterName, clusterTransportConfig, blobStoreType.
• LLM / AI-agent mocking suite — provider-correct mock completions and streaming for seven providers (Anthropic, OpenAI, OpenAI Responses, Azure OpenAI, Gemini, Bedrock, Ollama), with embeddings for OpenAI and Azure OpenAI; multi-turn scripted conversations with per-session isolation and deterministic prompt normalisation; and a runtime-LLM client SPI (off unless configured, fails closed) that powers the opt-in features. A broad MCP toolset drives it from an agent: mock_llm_completion, create_llm_conversation, verify_tool_call, explain_agent_run (with a correlated call graph), verify_structured_output, verify_cost_budget, detect_llm_drift, mock_adversarial_llm_response, and run_mcp_contract_test.
• Agent resilience & correctness testing — structured-output (JSON-Schema) validation on both the response path (outputSchema, fail-soft) and the verification path (verify_structured_output); a deterministic CI cost-budget gate (verify_cost_budget) over a built-in pricing table; declarative LLM fault/chaos profiles (probabilistic provider errors, mid-stream truncation, malformed SSE) plus a stateful request-quota rate limit; VCR record/replay with strict mode and body/header redaction; a prompt-injection / adversarial-response harness; and OpenTelemetry GenAI span + metrics export. The dashboard surfaces all of it (conversation wizard, sessions & call-graph, metrics view, export).
• HTTP chaos/fault injection — a general HttpChaosProfile (probabilistic error status + latency) attachable to any mocked or forwarded response, making MockServer usable as a chaos proxy for unreliable upstreams.
• Platform modernisation (breaking) — minimum runtime raised to Java 17; full Jakarta EE 10 / Servlet 6 migration (Spring 7 / Boot 4, Tomcat 11, Jetty 12, Jersey 4, Netty 4.2); json-schema-validator 3.x; a bundled DataFaker template helper; and ZGC tuning guidance.

Security

• Released Docker images are now cosign-signed by digest (Docker Hub and ECR Public), using the same signing key infrastructure as the Helm OCI chart. Consumers can verify image provenance with cosign verify. Signing is non-fatal in the pipeline if the key is unavailable, so it never blocks a release.
• Website security hardening — the documentation site (mock-server.com) now sends Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy response headers via CloudFront, and the domain publishes CAA records pinning certificate issuance to Amazon.
• Build/release infrastructure hardening (internal) — least-privilege scoping of CI secrets per Buildkite agent queue, removal of release-only permissions (ECR push) from the PR-build queue, secrets passed to release containers via 0600 files instead of docker -e environment variables, robust git-push-token cleanup, scoped cross-account AssumeRole (ExternalId) and tfstate IAM, full VPC flow logging, GuardDuty→SNS alerting, CloudTrail data-events on secrets/state, and SSE-KMS on the state and AWS Config buckets. See docs/infrastructure/aws-infrastructure.md, docs/infrastructure/ci-cd.md, and docs/operations/website.md.

Added

• Added a daily performance-regression pipeline (notify-only) that guards response latency, throughput, and CPU/memory against drift across releases. It runs on a dedicated, pinned, on-demand, scale-to-zero Buildkite perf queue and fires once per day only when master moved since the last run. Each run measures four behaviours (mock match, forward/proxy, Velocity template, large-body) over HTTP and HTTPS/HTTP-2 (k6/regression.js), a sustained resource-growth run that surfaces "increases over time" regressions such as the issue #2329 O(n) log-eviction CPU climb (k6/growth.js, CPU/heap/latency slope ratios), and the JMH MatchingBenchmark allocation backstop. Results are persisted to S3 and each run is compared against a rolling median+MAD baseline of recent runs, posting a Buildkite annotation table when a metric regresses. See docs/operations/performance-tuning.md.

LLM & AI-agent mocking

• Added a dedicated retrieve_logs MCP tool so an AI assistant debugging a failing test can pull MockServer's recorded log messages (request matching, mismatches, actions and errors) directly. It is a thin, discoverable wrapper over the existing LOGS retrieval path (shared with raw_retrieve), with an optional correlationId filter (trace one request's full lifecycle) and a limit (most-recent N, default 100, max 500). This fills the gap left by its sibling tools retrieve_recorded_requests / retrieve_request_responses, which already existed. See the AI/MCP tools page.
• Added a runtime-LLM client SPI (org.mockserver.llm.client) that lets MockServer call a real LLM you already run, as the foundation for opt-in features such as drift detection and exploratory semantic matching. Mirrors the existing codec registry: an LlmClient per provider (Ollama, OpenAI, OpenAI Responses, Azure OpenAI, Anthropic, Gemini, Bedrock) registered in LlmClientRegistry, an immutable LlmBackend config (with the API key redacted in logs), and a three-layer LlmBackendResolver (provider env vars → mockserver.llmProvider/llmApiKey/llmModel/llmBaseUrl → named-backends JSON via mockserver.llmBackendsConfig). All runtime-LLM use goes through LlmCompletionService, which is off unless a backend is configured, fails closed on any timeout/error/non-2xx (never flipping a deterministic result), and caches per normalised prompt for reproducibility. Ollama is the reference backend (no key, local); Bedrock builds the Anthropic-on-Bedrock request and relies on the headers escape hatch pending automatic SigV4 signing. See the configuration properties page and docs/code/llm-mocking.md.
• LLM conversation mocks can now opt into deterministic prompt normalisation before the latestMessageContains / latestMessageMatches predicates are evaluated, so a match is not blocked by cosmetic differences in dynamically-assembled agent prompts. A new normalization block on conversationPredicates (also exposed per-turn in the create_llm_conversation MCP tool and the dashboard conversation wizard) supports collapsing whitespace, lowercasing, sorting JSON object keys, dropping built-in volatile values (ISO-8601 timestamps, UUIDs, req_/msg_/call_ ids), and dropping named JSON fields. Normalisation is pure and idempotent — it never makes a test flaky — and has no effect unless a text predicate is set. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added two MCP tools for agent-run analysis and tool-call assertions, both backed by a new deterministic org.mockserver.llm.analysis.AgentRunAnalyzer that reconstructs an agent run by decoding the LLM requests MockServer recorded. verify_tool_call asserts that an agent called a named tool a given number of times (atLeast/atMost, with an optional regex over the tool-call arguments); explain_agent_run summarises the run's structure (message and assistant-turn counts, the ordered tool-call sequence, tool results, and the latest message role). Read-only and offline — no LLM call. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added a correlated agent-run call graph. AgentRunAnalyzer.buildCallGraph reconstructs a recorded run as a graph — a node per message and per assistant tool call, with NEXT (sequence), INVOKES (turn→tool call), and RESULT (tool call→its result, correlated by tool-call id) edges — exposed in the explain_agent_run MCP result as a callGraph field. The dashboard Sessions view renders it per session (a "Call graph" button loads it via explain_agent_run): each step shows the message role and the tool calls it made, with a result indicator, plus a copyable Mermaid flowchart source. Deterministic and read-only. See docs/code/llm-mocking.md.
• Added opt-in, exploratory semantic prompt matching for LLM conversations: a semanticMatch turn predicate (the intent the latest message should express) judged by a runtime LLM via the client SPI. It is off by default and never on the assertion path — the predicate is ignored unless mockserver.llmSemanticMatchingEnabled is set and a runtime backend resolves, so deterministic matching is never affected by default. Non-deterministic by nature (a live LLM judge), so it is documented for exploration only, never for CI assertions; fails closed (a non-affirmative/empty/errored judge does not match). Exposed in the Java TurnBuilder.whenSemanticMatch, the create_llm_conversation MCP tool, and the dashboard wizard (clearly flagged exploratory). See docs/code/llm-mocking.md.

LLM resilience, validation & cost testing

• Added a verify_structured_output MCP tool: validate that the structured (JSON) output of recorded LLM responses conforms to a JSON Schema. It decodes each recorded response for a given provider (via the runtime-LLM client SPI), extracts the assistant's output text, and checks it against the schema — so you can assert that an agent (or a mocked model) produced schema-valid structured output. Read-only and deterministic; responses with no text output are reported separately as skipped, and the result gives per-response conformance with validation errors. See the AI/MCP tools page and docs/code/llm-mocking.md.
• A mock LLM completion can now declare an outputSchema (a JSON Schema) that its response text is expected to conform to. As the response is encoded, MockServer validates the configured text against the schema and, on a mismatch, fail-soft: the response body is returned exactly as configured but an x-mockserver-structured-output-invalid diagnostic header is added and a warning logged — so a malformed structured-output fixture is surfaced immediately while a deliberately non-conforming fixture still returns unchanged. A blank schema, absent text, or a malformed schema are all treated as "nothing to check" and never affect the response. Exposed on the Java Completion.withOutputSchema(...), the outputSchema field in expectation JSON, and the mock_llm_completion MCP tool (string or inline object). Complements the read-side verify_structured_output tool. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added a verify_cost_budget MCP tool: a deterministic, read-only cost gate for agent runs. It decodes each recorded LLM response for a provider (via the runtime-LLM client SPI), sums the input/output tokens from each response's usage, prices them with a new built-in pricing table (org.mockserver.llm.cost.LlmPricing, mirroring the dashboard's llmPricing.ts — same prefixes/rates), and asserts the total estimated USD cost is at or below maxCostUsd. The model can be pinned via a model param or read per-response from the recorded request body; responses with no usage are skipped and responses whose model has no known price are reported as unpriceable and excluded from the total. The result gives token/cost totals, withinBudget, and a per-response breakdown. Pricing is public list pricing captured 2025-Q4 (an estimate, not an invoice). See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added declarative LLM fault/chaos profiles for resilience testing, attachable to any mock LLM response (mock_llm_completion, each create_llm_conversation turn, the Java LlmConversationBuilder, and raw expectation JSON via a chaos block). Supports probabilistic provider errors (e.g. 429/529 with a Retry-After header), mid-stream truncation of an SSE stream (keep a leading fraction of events), and appending a malformed (broken-JSON) SSE chunk. Errors are deterministic at probability 0.0/1.0 and reproducible at fractional probabilities via a seed; truncation and malformed-SSE are always deterministic. A new LLM_CHAOS_INJECTED_COUNT metric tracks injections. The dashboard conversation wizard exposes the profile per turn. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added a stateful request quota to the LLM chaos profile — a deterministic fixed-window rate limit, the stateful counterpart to the existing probabilistic 429. Set quotaName, quotaLimit, and quotaWindowMillis (optional quotaErrorStatus, default 429) on a chaos block and requests beyond the limit within the window are rejected with that status and the retryAfter header. Expectations sharing a quotaName share one counter (model an upstream account limit across several mocks); the count resets when the window elapses and on server reset. Backed by a new process-wide, thread-safe org.mockserver.llm.LlmQuotaRegistry (injectable clock for deterministic tests). Exposed in expectation JSON, the mock_llm_completion/create_llm_conversation chaos MCP parameter, and the Java LlmChaosProfile. A misconfigured/partial quota fails open (never rate-limits). See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added a prompt-injection / adversarial-response harness for testing agent resilience. A new mock_adversarial_llm_response MCP tool returns a curated adversarial payload as the mock LLM response — prompt-injection ("ignore previous instructions…"), jailbreak persona-swaps, data-exfiltration requests, malformed/truncated JSON, an empty response, and an over-long repetition — so you can verify your agent resists hostile or malformed model/tool output. Backed by AdversarialResponseLibrary (deterministic; the payloads are benign test fixtures, not working exploits). A defensive testing aid. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Added drift detection for LLM fixtures (detect_llm_drift MCP tool): replays a recorded cassette's exchanges against the live provider (via the runtime-LLM client SPI) and reports structural drift — new/removed fields and type changes in the responses — not semantic differences, so benign wording changes never flag. Built on a reusable, pure StructuralShapeDiff and a DriftDetector that fails closed per exchange (a network error or non-2xx live response is reported as could-not-check, never as drift, never thrown). Off unless a runtime backend is configured. Intended for an opt-in/scheduled CI lane (real API keys + tokens), never the per-commit build. See the AI/MCP tools page and docs/code/llm-mocking.md.
• Completed the VCR (record/replay) toolkit for LLM fixtures with three additions. (1) Strict mode — load_expectations_from_file accepts strict (or set mockserver.llmVcrStrict), which registers a low-priority catch-all per cassette path so a request matching no recorded fixture returns HTTP 599 instead of silently falling through. (2) Body-field redaction — record_llm_fixtures accepts redactBodyFields (or set mockserver.fixtureBodyRedactFields) to redact named JSON fields from recorded request/response bodies, complementing the existing header redaction. (3) Replay field normalisation — load_expectations_from_file accepts normalizeRequestBodyFields to drop volatile JSON fields from each recorded request body and match the remainder loosely (ignoring extra fields), so per-run values (request ids, timestamps) do not block replay. These are operational settings exposed via config and MCP. See the AI/MCP tools and configuration properties pages.

HTTP chaos & protocol contract testing

• Added a time-to-live (auto-revert) to service-scoped chaos — an optional ttlMillis on a PUT /mockserver/serviceChaos registration makes the chaos automatically revert after that many milliseconds (a "dead-man's switch" so a fault self-heals even if the matching clear is never sent — e.g. an external chaos orchestrator crashes mid-experiment). It is also the one-shot time-box form: a single call breaks a host for a bounded window. Expiry is measured with the controllable clock (real-time by default, deterministic under PUT /mockserver/clock) and is applied lazily on the next lookup. Exposed via the endpoint, the Java/Node/Python/Ruby clients (setServiceChaos(host, chaos, ttlMillis) / ttl_millis), and the manage_service_chaos MCP tool. See the Chaos Testing page.
• Added service-scoped chaos — register one HttpChaosProfile for an upstream host and have it applied to all matched forwards to that host, instead of attaching a chaos block to every forwarding expectation (the "break service X" control for running MockServer as a chaos proxy). Manage it through a new control-plane endpoint PUT/GET /mockserver/serviceChaos ({"host":...,"chaos":{...}} to register, {"host":...,"remove":true} to remove, {"clear":true} to clear all), protected by control-plane authentication. Resolution happens only on the matched-forward path keyed by the request Host header (case-insensitive, port-ignored); an expectation's own chaos always takes precedence, the anonymous proxy fall-through is unaffected, and registrations clear on server reset. Backed by a new process-wide org.mockserver.mock.action.http.ServiceChaosRegistry. Convenience wrappers are exposed in all four clients (setServiceChaos/removeServiceChaos/clearServiceChaos/serviceChaosStatus in Java/Node, the snake-case equivalents in Python/Ruby) and via the manage_service_chaos MCP tool. See the Chaos Testing page.
• Added gradual degradation to the HTTP chaos block — a degradationRampMillis that linearly ramps errorProbability and dropConnectionProbability from 0 up to their configured values over the window from the expectation's first match, modelling a dependency that deteriorates over time (for alerting / SLO-burn tests). The ramp is measured with MockServer's controllable clock, so it is deterministic under clock freeze/advance with no real-time waiting; only the probabilistic rates ramp (latency, body corruption, slow response and quota are unaffected). Exposed in expectation JSON, the Java/Node/Python/Ruby clients, and the create_expectation chaos MCP parameter. See the Chaos Testing page.
• Added a stateful request quota to the HTTP chaos block — a deterministic fixed-window rate limit, the HTTP counterpart of the existing probabilistic 429 and of the LLM quota. Set quotaName, quotaLimit and quotaWindowMillis (optional quotaErrorStatus, default 429) and requests beyond the limit within the window are rejected with that status and the retryAfter header. Expectations sharing a quotaName share one counter (model an upstream account limit across several mocks); the count resets when the window elapses and on server reset. The quota gate takes priority over the probabilistic error and the body/slow faults (after connection-drop). Backed by a new process-wide, thread-safe org.mockserver.mock.action.http.HttpQuotaRegistry (separate from the LLM quota registry). Exposed in expectation JSON, the Java/Node/Python/Ruby clients, and the create_expectation chaos MCP parameter; metered as fault_type=quota. See the Chaos Testing page.
• Added a slow (dribbled) response fault to HttpChaosProfile — slowResponseChunkSize + slowResponseChunkDelay trickle the response body to the client in small chunks with a delay between each (via chunked transfer-encoding), for testing read timeouts and slow-network handling (distinct from latency, which delays the whole response by a fixed amount). Both fields are required; deterministic; applies to the real mocked or forwarded response within the active count and outage windows; skipped for streaming bodies; metered as fault_type=slow. Exposed in expectation JSON, the Java/Node/Python/Ruby clients, and the create_expectation chaos MCP parameter. See the Chaos Testing page.
• Added response-body corruption faults to HttpChaosProfile — truncateBodyAtFraction keeps only a leading fraction of the body bytes (e.g. 0.5 returns the first half, 0.0 empties it) and malformedBody appends a broken-JSON fragment so the payload fails to parse, for testing client-side body-parsing and partial-response resilience. Both are deterministic (no probability draw), apply to the real mocked or forwarded response within the active count and outage windows, preserve the Content-Type and drop any stale Content-Length (the encoder then sets the correct length) so the response stays well-framed, and are skipped for streaming bodies. Connection-drop and error injection still take priority (an injected error body is never corrupted). Exposed in expectation JSON, the Java/Node/Python/Ruby clients, and the create_expectation chaos MCP parameter; metered as fault_type=truncate / fault_type=malformed. See the Chaos Testing page.
• Added time-based outage windows (outageAfterMillis / outageDurationMillis) to HttpChaosProfile — chaos becomes active a configurable time after the expectation's first match and (optionally) self-heals after a bounded duration, modelling a dependency that degrades for a transient window then recovers. The window is measured with MockServer's controllable clock, so it is deterministic under clock freeze/advance (PUT /mockserver/clock) with no real-time waiting; it composes with the count window and the probability fields.
• Added connection-drop chaos fault (dropConnectionProbability) to HttpChaosProfile — probabilistic TCP connection drops (no response sent) on both mocked and forwarded responses, simulating hard network failures. Drop faults take priority over error and latency injection (drop > error > latency). Uses a derived seed for independent but reproducible draws alongside errorProbability.

... (truncated)

Commits

• 08061e2 release: publish mockserver-client-node 7.0.0
• 241ed70 release: update version references to 7.0.0
• 9755e9c release: set version 7.0.0
• ee3d4ec Revert "release: set version 7.0.0"
• 92a204e release: set version 7.0.0
• 2f6538b Revert "release: set version 7.0.0"
• a9d8556 release: set version 7.0.0
• d6fa66b build(deps-dev): bump the npm-minor-and-patch group across 2 directories with...
• f234819 build(deps-dev): bump c8 in /mockserver-client-node (#2333)
• 831df4a test(node-client): replace deprecated Karma/Jasmine browser tests with Playwr...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #38.