A self-hostable API workbench with an independent offline desktop client.
English · 简体中文
MoleAPI uses Rust/Axum/SeaORM, React/Radix UI/CodeMirror, and Tauri. SQLite is the default; PostgreSQL and MySQL are also supported. The server embeds its frontend, fonts, and editors, so running the binary does not require Node.js. The desktop client uses local SQLite through in-process IPC and can optionally synchronize with your self-hosted server.
Development is ongoing; complete Apifox/Postman feature coverage has not been achieved. Implementation status, protocol coverage, and code-generation coverage distinguish verified behavior from remaining work. Dedicated clients cover HTTP, SSE, WebSocket, GraphQL, gRPC, Socket.IO, MQTT, SOAP, MCP, A2A, TCP/TLS, Data SQL, and Webhook receivers. Workspaces, collections, scoped/environment variables, scripts, history, assertions, basic Mock, and collection execution are available. Multi-language request examples and full SDK/server generation are separate capabilities; the latter remains in progress.
Collection tests support temporary or saved CSV/JSON datasets, typed iteration data, multiple iterations and cancellation. Reusable datasets use workspace save/versioning/sync; private sources are hidden in default backups. See runner behavior and saved dataset coverage.
Collection scripts can branch, loop, stop an iteration or skip a request with pm.execution controls. See flow behavior and limits.
Response checks include header/regex/JSONPath/XPath/JSON Schema assertions through mature Rust engines. See assertion behavior and limits.
These screenshots show the actual self-hosted interface with synthetic test data. The desktop shares this frontend; the screenshots do not establish native tray or installer verification.
OpenAPI project generation uses a native Progenitor Rust client engine and a pinned embedded OpenAPI Generator for multi-language client/server artifacts. Java targets require an explicitly configured Java17+ executable (MOLEAPI_CODEGEN_JAVA); native Rust does not. Original definitions are preserved, default output excludes credentials, and ZIP manifests record generated files/checksums. See actual target validation and remaining scope.
Regeneration imports previous generated ZIPs or snapshots and current edited directories/ZIPs. It preserves authored files, compares deletions and lets you resolve conflicts before exporting a new merged ZIP. Original files are never overwritten.
OpenAPI Generator targets also accept custom Mustache templates and static assets from directories, ZIPs or preserved generation snapshots. Preview/edit templates, configure API/model/docs/tests/supporting outputs and restore upstream defaults; exports retain sources, binary assets, mappings and checksums. See template evidence and remaining limits.
Single HTTP endpoints offer the Apifox/Postman request-code catalog:23 language/tool families and55 library adapters, with preview, copy and source download. Families include C, C#, Clojure, Dart, F#, Go, HTTP, Java, JavaScript, Julia, Kotlin, Node.js, Objective-C, OCaml, PHP, PowerShell, Python, R, Ruby, Rust, Shell, Swift and Postman CLI. Choose libraries such as HttpClient/RestSharp, Fetch/Axios, Requests/HTTPX and OkHttp/Unirest independently. See the complete language/library catalog and body support, dependencies and runtime evidence. Raw file bodies show only adapters that can read file bytes.
Native CLI commands share offline and remote execution, environments/datasets, request filters, private reports and the full request-code catalog. See usage and CI examples and current evidence and limits. CLI packaging and Newman compatibility remain in progress.
Data model generation covers Apifox's19 language families using embedded Quicktype for18 languages and OpenAPI Generator for MySQL/PostgreSQL table definitions. Choose all or one component and its serialization/style options, then preview/copy/download or regenerate. See actual model runtime evidence and remaining limits.
HTTP/SOAP, SSE/WebSocket/GraphQL, gRPC, TCP/TLS, MQTT, Socket.IO, A2A and MCP HTTP requests support explicit HTTP/SOCKS proxies, bypass rules, custom CA roots, PEM/encrypted PFX client certificates, DNS overrides and HTTP/2. Network credentials are scrubbed from history/default exports; exact source backup requires including sensitive values. See network support and current combinations.
Simplified Chinese and English UI can be selected on the sign-in screen or in workbench settings; the preference is remembered. Request names, variables, original specifications, scripts, real service responses, and generated code remain unchanged user data. Native tray menus follow the application language; native system dialogs depend on the operating system. Additional languages use embedded localization catalogs.
Building requires Rust1.94+ and Node22+. Running a built server requires only its binary.
npm --prefix web ci
npm --prefix web run build
cargo build --locked --release -p moleapi-server
./target/release/moleapi-server --bind 127.0.0.1:8787Open http://127.0.0.1:8787 and create the first account using the setup token printed on first launch. Further registration requires --allow-registration. Enable --allow-private-network explicitly to debug private-network endpoints.
SQLite defaults to ./data/moleapi.db. Configure another database with --database-url or MOLEAPI_DATABASE_URL:
MOLEAPI_DATABASE_URL='postgresql://user:password@localhost:5432/moleapi' ./target/release/moleapi-server
MOLEAPI_DATABASE_URL='mysql://user:password@localhost:3306/moleapi' ./target/release/moleapi-serverSee the database specification for configuration and backup details. Changing the URL does not migrate existing data.
npm --prefix web run desktop:dev
npm --prefix web run desktop:build
docker compose pull
docker compose up --no-build -dDesktop builds require the platform's Tauri development dependencies. Configured installers are NSIS/MSI on Windows, DMG on macOS, and deb/rpm/AppImage on Linux. Native tray menus offer Show, Hide, Quit, and window restoration; actual support remains subject to the recorded platform checks. Signing and notarization require keys; unsigned artifacts are not advertised as signed releases.
Docker images are built, verified, and published only by GitHub Actions on native amd64/arm64 runners. Pull images locally instead of building them. The development image ghcr.io/ca-x/moleapi:feat-application may lag the latest source; Registry/Actions artifacts establish its actual version and platforms. Select a published version with MOLEAPI_IMAGE. Data uses the /data volume; external PostgreSQL/MySQL can be configured.
cargo test --locked
cargo clippy --locked --all-targets -- -D warnings
npm --prefix web test
npm --prefix web run typecheckGitHub Actions checks source and real database cases, and builds platform server binaries, desktop installers, and Docker images. Current failed or unverified platform checks are listed in the status document. One green run does not establish full feature or installer completion.
- Full capability matrix, module map, protocols and Rust libraries
- Apifox public catalog, Postman public catalog
- Configuration options, UI research, research notes
The transparent mole logo was supplied by the project owner. Competitor names and original materials belong to their respective owners and are retained as research references; the application does not use competitor brand assets.
Response extraction rules support JSON Pointer, JSONPath, XPath, regex, headers and full bodies, targeting the selected development environment, collection, project or temporary variables. They run before post scripts and supply subsequent collection requests; shared workspace values are not automatically overwritten. See extraction coverage and limits.
Saved test scenarios reference original interfaces with custom step order, groups, enable flags and repeated requests. Run them with the selected environment and existing dataset/iteration options; create/edit/reorder/save them on the testing page. See scenario behavior and remaining scope.
Scenario steps support JavaScript boolean conditions, true/false step destinations, end-iteration branches, fixed repeats and backwards loops. Conditions use the existing sandbox, discard their changes and skip requests entirely when false. See control ordering, limits and evidence.
Named parallel scenario blocks run conditional/repeated requests with configurable concurrency. Branches keep isolated variables and merge after completion; differing writes stop the block, and histories use combined peer privacy taints. See parallel semantics, evidence and remaining scope.
Collection/scenario runs automatically save redacted reports with source revisions, ordered outcomes, assertions and timings. Browse/filter/delete reports, locate current failed interfaces and export JSON, CSV, JUnit XML or standalone English/Chinese HTML. Each workspace retains its latest100 reports; live bodies/headers/logs/variables stay outside these artifacts. See report evidence and remaining scope.
Report steps can open their corresponding redacted historical response with the existing response viewer. This reads saved history without sending the request again; clearing history removes payload access while retaining the report. See response links and limitations.
Scheduled collection/scenario tasks support cron, IANA timezones, selected environments/datasets, enable/disable, queue-now, cancellation and execution history linked to saved reports. Definitions and job state persist across restart. Hosted tasks continue after logout; local desktop tasks require the app to stay running. See schedule semantics, evidence and remaining scope.
Scheduled tasks can notify selected Webhook, Slack, Teams Workflow, WeCom, DingTalk, Feishu, Jenkins, PagerDuty or SMTP targets. Configure outcome/change filters and inspect bounded retries/provider receipts without exposing saved credentials. See actual local transport evidence and remaining integration scope.
Ordinary collection/scenario runs can inherit saved notification targets or override them per run. API callers can label CI runs explicitly; notification publication shares the saved-report transaction and scheduled runs avoid duplicate events. See run notification bindings.