Wrote up why I built GhostAPI — my agent almost sent a real SMS while "testing" a Twilio integration, so now everything runs against localhost instead

eugene — Mon, 20 Jul 2026 12:15:57 +0000

eugene

Jul 20

I built a local sandbox so my AI agent stops testing on real Stripe/Twilio/GitHub keys

#ai #opensource #webdev #testing

2 min read

I built a local sandbox so my AI agent stops testing on real Stripe/Twilio/GitHub keys

eugene — Mon, 20 Jul 2026 12:14:12 +0000

AI coding agents are getting good at writing integrations. The problem is they're just as happy running them.

I kept hitting the same failure mode: an agent "testing" a Stripe integration against a real key, or a Twilio integration that actually sends an SMS to a real number. No malice, just an agent doing exactly what the code says, against whatever environment variables happen to be sitting in the shell.

So I built GhostAPI — a local sandbox that mocks Stripe, Twilio, GitHub, and OpenAI on 127.0.0.1, so agents (and you) can develop and test against something that behaves like the real API without any of the real consequences.

How it works

npx @yiaany/ghostapi start --open
This spins up local HTTP servers shaped like each provider's API — same status codes, same error formats, same webhook payloads. Your existing SDK calls don't need to change, you just point the base URL at localhost.

There's a dashboard that shows every request as it happens, so you can actually see what your agent is doing instead of guessing from logs. Secrets get masked before they ever hit a log line.

The MCP part

This is the piece I care about most. Instead of clicking through a dashboard to simulate a declined card or a rate limit, an agent can call an MCP tool directly to force that state, then run its own error-handling code and verify it recovers correctly: npx @yiaany/ghostapi setup --write
This wires up MCP + agent instructions for Cursor, Claude, and similar tools. From there the agent can inspect state, force specific responses, and toggle chaos conditions (declines, rate limits, latency) — all without a human in the loop, and all without touching anything real.

What it's not

Not a full replacement for each vendor's own test/sandbox mode — those exist for a reason and are more thorough for provider-specific edge cases. The goal here is narrower: one consistent local environment across providers, built specifically for the loop of "agent writes integration code, agent tests integration code."

Currently covers Stripe, Twilio, GitHub, and OpenAI. Adding more is mostly a matter of demand — happy to hear what people are running into with other providers.

GitHub: https://github.com/yiaany/ghostapi
Site: https://ghostapi-virid.vercel.app/

Would genuinely appreciate feedback, especially on provider coverage and whether the MCP tool set covers what people actually need when testing agent-written code.

DEV Community: eugene

Wrote up why I built GhostAPI — my agent almost sent a real SMS while "testing" a Twilio integration, so now everything runs against localhost instead

I built a local sandbox so my AI agent stops testing on real Stripe/Twilio/GitHub keys

I built a local sandbox so my AI agent stops testing on real Stripe/Twilio/GitHub keys

How it works

The MCP part

What it's not