The Keploy alternative — serve-the-mock infrastructure, not CI fixtures

Keploy is one of the better stories in this category, and it deserves the credit. Its core is genuinely Apache-2.0 and free — not an open-core teaser — and it does something the snapshot tools do not: it captures real traffic with eBPF and auto-generates CI test cases and mocks, including for databases and message queues, not just HTTP. If what you want is a test suite that materializes from production traffic and runs in your pipeline, Keploy is built for exactly that, and Gostly does not auto-generate test suites at all.

Gostly is built around a different job. It is not a CI test-generator; it is a place you put a Rust proxy in front of your upstream, run LEARN to record an hour of real traffic, then flip to MOCK and serve that traffic back byte-for-byte — as long-running infrastructure your whole team and CI fleet point at, not a fixture file that exists for the duration of one run. The deployment is a containerized stack you bring up with Docker Compose in your own perimeter. There is no Kubernetes to operate.

The biggest architectural difference is how each one gets the traffic. Keploy reads it off the kernel with eBPF, which means running the capture container with elevated privileges, the host’s process namespace, and the host docker socket, on a Linux kernel of 5.15 or newer — on macOS or Windows you do it inside a VM or Docker, and there is no userspace fallback. Gostly sits in the request path as an ordinary userspace proxy. No kernel modules, no elevated privileges, no host PID — it runs the same way on a developer’s Mac, a Windows box, and a Linux CI runner.

Data locality is the other place the two diverge, and it is worth being precise. Keploy’s OSS telemetry is on by default and reports your OS, CI provider, git-repo slug, and the hostnames of the upstreams you recorded to its telemetry endpoint — disableable with a config flag, but on until you flip it. Its AI test-generation sends your source code to a hosted third-party model unless you self-host one. Gostly inverts both: your recorded traffic and PII never leave your host, inference is self-hosted in the container, and credential headers are redacted before anything touches disk. The licensed build makes only opt-out license-validation and counters-only calls — no payloads.

And because Gostly runs as your own single-tenant deployment, the controls a security review asks for are built in: SSO via SAML or OIDC, role-based access control, and an append-only audit log on Team — self-hosted in the container, not gated behind a cloud account. Each deployment is single-tenant, so your data is isolated by running in your own perimeter, never shared with another customer’s. The trade-offs are real, too: Keploy markets SCIM and SOC 2 / HIPAA readiness that Gostly does not yet, and Keploy auto-mocks databases and queues where Gostly is HTTP/HTTPS only.