Spec is your contract. Traffic is reality. When they drift, traffic wins.
Prism is Stoplight’s open-source mock server for OpenAPI, and it’s actively maintained. Point it at a spec and it serves stubbed responses that match the schema. Run it in proxy mode and it routes calls to your real API and validates both requests and responses against the spec, flagging where live traffic violates it. For design-first work where the spec is genuinely the contract, it’s a clean choice.
The catch is that all of that runs against a spec you write and keep current. Prism validates against the spec; it doesn’t author it for you, and it doesn’t record live traffic to replay it back later. So the friction shows up where the spec and reality diverge. Polymorphic schemas withoneOfandanyOfdon’t round-trip cleanly. Body examples are Lorem ipsum unless someone hand-authorsx-fakerextensions. Stateful flows aren’t the model.
Gostly starts from the other end. Point the proxy at your real upstream for an hour. It records the traffic. Then it replays the same bytes back, on demand, against your tests. Spec is the contract; traffic is what actually happened.
| Feature | Prism | Gostly |
|---|---|---|
| Source of truth | OpenAPI spec you author | Real recorded traffic |
| Drift detection | Proxy mode validates live traffic against the spec | Automatic — re-record and compare |
| Spec to author / maintain | Required — Prism validates against it | None — replays recorded bytes |
| Polymorphism (oneOf / anyOf / discriminator) | Open issues against the matcher | Returns the recorded shape |
| Body realism | Lorem ipsum unless you author x-faker | Real recorded bodies, PII-stripped |
| Captures real traffic for replay | No — validates live calls, doesn't record for replay | Records HTTPS, fingerprint-matched outbound |
| Stateful flows (POST then GET) | Stateless by design | Stateful via resource store |
| OSS / self-host | OSS (Apache 2.0) | OSS proxy (FSL) |
| Language / runtime | Node.js | Rust proxy · self-hosted stack (Docker Compose) |
| Pricing | Free | Free · $10/mo Pro · $79/seat Team |
Prism is OSS and free; Gostly’s OSS proxy is free too. Paid tiers cover gap-fill, drift detection, and multi-seat.
When Prism is the right choice
When Gostly is the right choice
oneOf,anyOf, discriminator) where the recorded shape is the only authoritative answer.You don’t have to rip out Prism. Run Gostly in LEARN mode against your live upstream for an hour. The proxy captures the traffic.
Compare the captured traffic to what Prism is returning today. Most teams ship the diff as a spec PR, switch to Gostly for tests, and keep Prism for design-time contract validation.
The two tools answer different questions. Prism: “does live traffic match the spec I’ve written?” — in proxy mode it routes calls to your real API and flags the violations. Gostly: “replay exactly what the upstream returned last Tuesday, with no spec to author.” You can keep both if you want both answers.
Free to start. Self-hosted. Same proxy serves OpenAPI design teams and traffic-driven test teams without picking sides.
No shame in staying on Prism. It’s a good tool for the case it was built for.