AI coding agents are getting good at writing integrations. The problem is they're just as happy running them.
I kept hitting the same failure mode: an agent "testing" a Stripe integration against a real key, or a Twilio integration that actually sends an SMS to a real number. No malice, just an agent doing exactly what the code says, against whatever environment variables happen to be sitting in the shell.
So I built GhostAPI — a local sandbox that mocks Stripe, Twilio, GitHub, and OpenAI on 127.0.0.1, so agents (and you) can develop and test against something that behaves like the real API without any of the real consequences.
How it works
npx @yiaany/ghostapi start --open
This spins up local HTTP servers shaped like each provider's API — same status codes, same error formats, same webhook payloads. Your existing SDK calls don't need to change, you just point the base URL at localhost.
There's a dashboard that shows every request as it happens, so you can actually see what your agent is doing instead of guessing from logs. Secrets get masked before they ever hit a log line.
The MCP part
This is the piece I care about most. Instead of clicking through a dashboard to simulate a declined card or a rate limit, an agent can call an MCP tool directly to force that state, then run its own error-handling code and verify it recovers correctly: npx @yiaany/ghostapi setup --write
This wires up MCP + agent instructions for Cursor, Claude, and similar tools. From there the agent can inspect state, force specific responses, and toggle chaos conditions (declines, rate limits, latency) — all without a human in the loop, and all without touching anything real.
What it's not
Not a full replacement for each vendor's own test/sandbox mode — those exist for a reason and are more thorough for provider-specific edge cases. The goal here is narrower: one consistent local environment across providers, built specifically for the loop of "agent writes integration code, agent tests integration code."
Currently covers Stripe, Twilio, GitHub, and OpenAI. Adding more is mostly a matter of demand — happy to hear what people are running into with other providers.
GitHub: https://github.com/yiaany/ghostapi
Site: https://ghostapi-virid.vercel.app/
Would genuinely appreciate feedback, especially on provider coverage and whether the MCP tool set covers what people actually need when testing agent-written code.
Top comments (1)
A bit more detail for anyone curious about the internals:
GhostAPI runs actual local HTTP servers per provider rather than intercepting requests at the network level, so there's no need for proxy config or messing with your DNS/hosts file — you just point the base URL at localhost and your existing SDK code works unchanged.
The chaos toggles (declines, rate limits, latency) were the part I found most useful personally — it's easy to write a happy-path integration and forget that Stripe will rate limit you or a card will get declined eventually. Forcing those states on demand made it obvious pretty fast where my error handling was just... missing.
Still early days on provider coverage (Stripe/Twilio/GitHub/OpenAI so far) — if there's a provider you'd want mocked, let me know and I'll prioritize based on what people are actually running into