Shurikly 1.0.0 — Product Documentation

The open-source API client that reads your code.

Launching 25 October 2026. Installers for macOS, Windows and Linux and the public GitHub repository go live on launch day. Until then, download links on the website show Coming soon.

Overview

Shurikly is a free, open-source desktop application for designing, sending, testing, mocking and documenting HTTP APIs. It is local-first: there is no account, no cloud sync and no telemetry. Collections, environments, history and settings are plain JSON files on your own disk.

What sets Shurikly apart is that it starts from your code. The Code Scanner reads a project folder and builds a ready-to-send collection from your backend routes and frontend calls. The AI Engineer analyzes that collection, generates tests and explains failures. The Mock Server turns the same collection into a local fake API, and a built-in MCP server lets AI agents such as Claude and Cursor work with your live workspace.

The request editor: method and URL, request tabs, and a 200 OK response in the JSON tree view.

The problem

• Most API clients require an account and store your requests — often including tokens and internal URLs — on a vendor's cloud.
• Collections drift from the code. Developers retype routes by hand, and the collection is out of date the day after it is written.
• AI features are usually locked to one vendor, cost extra, and send your data by default.
• Mocking an API for frontend work often means a separate tool or a hosted service.

The Shurikly answer

Who it is for

• Backend developers who want a collection that matches their routes without retyping them.
• Frontend developers who need a mock API while the backend is still in progress.
• QA and test engineers who want generated test suites with evidence for every failure.
• Teams with strict data rules that cannot put API credentials in a third-party cloud.
• AI-assisted developers who want Claude, Cursor or another agent to call and edit their APIs.

Feature summary

Screen tour

Every screenshot in this document was taken from the Shurikly 1.0.0 desktop app on macOS in the default dark theme, using a sample Store API collection (backed by the public DummyJSON API) and a public GraphQL endpoint.

Getting started

Install on macOS

1. From 25 October 2026, download the disk image for your Mac from the website or GitHub Releases:
   • Apple silicon (M1 and later): Shurikly-1.0.0-arm64.dmg
   • Intel: Shurikly-1.0.0.dmg
2. Open the .dmg and drag Shurikly into Applications.
3. The 1.0.0 build is not yet notarized by Apple. On first launch, right-click Shurikly in Applications and choose Open, then confirm. Later launches open normally.

Not sure which Mac you have? Apple menu → About This Mac. "Chip: Apple M…" means Apple silicon; "Processor: Intel…" means Intel.

Install on Windows

1. From 25 October 2026, download Shurikly Setup 1.0.0.exe from the website.
2. Run the installer. You can choose the installation folder; Start menu and desktop shortcuts are created.
3. If Microsoft Defender SmartScreen shows a warning for the unsigned installer, choose More info → Run anyway.

Install on Linux

The AppImage is available from 25 October 2026.

chmod +x Shurikly-1.0.0.AppImage
./Shurikly-1.0.0.AppImage

First launch

On first launch Shurikly shows a three-step setup flow. Every choice can be changed later in Settings.

1. Welcome — what the app does: HTTP, GraphQL and WebSocket, collections and folders, environments, every common auth type, scripts / tests / runner, and built-in AI.
2. Local-first — no account and no telemetry, your data stays on this machine, requests go directly to the servers you call, and AI is used only when you ask.
3. Terms and get started — accept the terms, then send a sample request, import an existing collection, or connect an AI provider.

Step 1 — the welcome screen.

Step 2 — what local-first means for your data.

The main window

The Requests workspace: collection tree on the left, open request tabs across the top, the request editor in the middle and the response below.

Your first request

1. In Requests, click New request in the sidebar (or + in the tab bar).
2. Choose a method and enter a URL — for example https://dummyjson.com/products?limit=5. Query parameters typed in the URL appear in the Params table, and edits in the table update the URL.
3. Press Send or Ctrl+Enter. The response panel shows the status (for example 200 OK), time, size and the body as a JSON tree.
4. Click Save to put the request into a collection. It then appears in the sidebar, and every send is recorded in History.

Requests

Protocols

• HTTP / REST — any method (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS and custom).
• GraphQL — endpoint, query, variables, headers and auth, with schema tooling (see below).
• WebSocket — connect, send messages and watch the message stream.

Request builder

• Params — Path variables fill :id or {id} tokens in the URL; Query params are key / value rows kept in sync with the URL. Untick a row to disable it without deleting it.
• Headers — key / value pairs with enable / disable toggles and descriptions. Headers inherited from a folder or collection are merged in at send time.
• Body — None, JSON (editor with formatting and linting), Text, Form Data (text and file fields) and URL Encoded. Fill with AI drafts a body from the endpoint.
• Notes — Markdown notes attached to the request.
• Scripts and Tests — see Scripts, tests and the collection runner.
• Settings — per-request options such as the timeout (30 s by default).

Path variables: {{baseUrl}}/products/:id with id = 1, sent with the Production environment.

A POST with a JSON body. The response shows 201 Created and the new record.

All HTTP traffic is executed in the Electron main process, not in the web renderer, so requests are not subject to browser CORS rules and behave like a real client.

Authentication

Requests default to Inherit auth from parent. The Auth tab shows which folder or collection the credentials come from and the resolved type, so you can set a token once on the collection and every request uses it.

The request inherits Bearer Token auth from the Store API collection. Set it via the collection menu → Authorization.

GraphQL

Switch a request to GQL in the request bar, or create one from a collection menu → New GraphQL request.

1. Enter the endpoint URL and click Fetch schema to run introspection. The status changes to Schema available.
2. Write the query in the Query tab. The editor offers schema-aware autocomplete and validation, and Format query tidies it.
3. Put variables as JSON in the Variables tab.
4. If the document has several operations, pick one from Operation.
5. Send. The response shows the HTTP status and a GraphQL status (GraphQL OK or errors), with separate Data and Errors views.

A GraphQL query with variables against a public endpoint. The schema is loaded and the response is shown in the Data view.

Response inspection

The response bar shows the status, time, size and, when the request has tests, a pass count such as 4/4 tests.

• Body → Tree — a collapsible JSON tree. Hover a node to copy the value, copy the path or filter to that node. Type in Filter keys & values to narrow a large body.
• Body → JSON — the raw, formatted body, with find-in-body.
• JSONPath — query the body, for example $.products[*].title or $..items[?(@.price < 10)].
• Copy — copy the body as JSON or text; the download icon saves the body to a file.
• Headers and Cookies — every response header and cookie, with a count on the tab.
• Tests — per-assertion results for the request's tests.
• Previews for images, SVG, PDF, audio and video; a hex view for other binary bodies.
• Large-response guards keep the UI responsive on very large bodies.
• Explain asks your AI provider to describe the response (AI must be configured).

Compare

Click Compare in the response bar to diff the latest response (B) against a run you pick (A):

• the previous run of the same request,
• a pinned baseline, or
• another open tab.

Comparing two runs of the same request: status, time (−42 ms), size and content type at the top, then request, header and body differences.

Collections, folders and history

• Collections group related requests; folders nest inside collections. The sidebar shows the request count next to each one, and a shield icon when the collection sets auth.
• Inheritance — auth, headers and pre-request scripts set on a collection or folder apply to every child request. Child keys win when names collide.
• Drag and drop requests and folders to reorder or move them.
• Tabs keep several requests open at once; unsaved changes are marked with a dot.
• History records every request you send with its method, URL, status and time. Filter by method, click an entry to reopen it, or clear the list.

Right-click a collection (or use its … menu) for collection actions:

Collection menu: Run collection, New Request, New GraphQL request, New Folder, Authorization, Rename, Export…, Create Mock Server and Delete.

History lists every send with its status code. The method filter and clear button are at the top.

Environments and variables

1. Open the environment menu in the request bar (it shows No Environment or the active one) and choose Manage Environments…, or use the Envs tab in the sidebar.
2. Click + to add an environment such as Production or Local mock.
3. Add variables as rows — for example baseUrl = https://dummyjson.com. Untick a row to disable it.
4. Mark one environment Active. Its variables are substituted wherever you write {{variableName}} — URL, params, headers, body and auth.

Two environments, Production (active) and Local mock. {{baseUrl}} and {{accessToken}} are used by every request in the Store API collection.

Tip: pair a Local mock environment (baseUrl = http://127.0.0.1:4010) with a mock server to switch the whole collection between the real API and the mock with one click.

Scripts, tests and the collection runner

Pre-request scripts

The Scripts tab runs JavaScript before the request is sent. Scripts can read and set environment variables — for example, to compute a signature or a timestamp. Collection and folder scripts run first, then the request's own script.

Tests

The Tests tab holds pm.test-style assertions that run in a sandbox after every response. The sandbox provides pm.test(name, fn), pm.response.status, pm.response.headers, pm.response.responseTime, pm.response.json() and pm.response.text(). A test passes unless its function throws.

pm.test("status is 200", function () {
  if (pm.response.status !== 200) throw new Error("Expected 200, got " + pm.response.status)
})
pm.test("returns a list of products", function () {
  const body = pm.response.json()
  if (!Array.isArray(body.products)) throw new Error("products is not an array")
})
pm.test("responds in under 1.5s", function () {
  if (pm.response.responseTime > 1500) throw new Error("slow: " + pm.response.responseTime + "ms")
})

Four assertions on List products, all passing. Results appear under the editor and as 4/4 tests in the response bar.

AI Generate writes assertions from the latest response, and Run Tests re-runs them without re-sending the request.

Collection runner

Choose Run collection (or Run folder) from the sidebar menu. Set a delay between requests and whether to stop on failure, then click Run. The runner sends every request in order with inherited auth, headers and scripts, runs each request's tests, and reports totals plus a per-request line with method, status and time.

The Store API collection: 12 requests, 11 passed and 1 failed (/auth/me without a token), completed in 7.3 s.

Import and export

Code Scanner

Code Scanner turns a project folder into a Shurikly collection. Code is read locally and never uploaded.

Scanning an Express backend: 60 endpoints in 32 files in 0.3 s, with the framework and auth scheme detected.

How it works

1. Open Code Scanner and click Choose folder. For safety, only folders picked in the system dialog can be scanned.
2. Shurikly detects the frameworks in use and extracts endpoints from the backend and HTTP calls from the frontend.
3. Frontend calls are linked to backend routes, so you can see which endpoints are used and which calls have no matching route.
4. Review the results, then click Import N requests to create the collection. Rescan re-reads the same folder.

Reading the results

Supported sources in 1.0.0

Re-scan without losing work

When you scan again, Shurikly merges the new results into the existing collection using structural fingerprints. Requests you edited keep your changes; new endpoints are added and removed ones are flagged.

Hand-offs

• Export as OpenAPI — produce a spec from the scanned collection.
• Create a Mock Server from the scan.
• Send to AI Engineer for analysis and test generation.

AI enrichment (optional)

With an AI provider configured, Code Scanner can enrich endpoints with descriptions and better example bodies. Each run asks for explicit consent, code snippets are scrubbed of secrets before sending, and answers are checked against the code that was actually sent.

AI features

Providers

Open Settings → AI to choose a routing mode:

Settings → AI: routing mode, cloud provider, default model with pricing, temperature, max tokens, and fallback and cache switches.

Automatic fallback retries on the other provider if the active one fails, and Prompt cache reuses answers to identical prompts. Usage is tracked locally and a budget guard can stop requests once a spending limit is reached. API keys are encrypted with the operating system's secure storage (Electron safeStorage).

What AI can do

• Generate a request from a plain-English description.
• Explain a response — what it contains and what went wrong.
• Write tests for a request.
• Fix a failing request with a suggested change.
• Document a collection as readable API docs.

AI Engineer

AI Engineer is an analysis and testing workflow built on the same HTTP engine, environments and collections as the rest of the app.

Walkthrough

1. Open AI Engineer, pick a collection in the top-right menu (or Import OpenAPI), and click Analyze API. The Test suite panel summarizes the API — endpoints, auth-related endpoints and protected ones.
2. Click Generate tests. Without an AI provider you get baseline tests (reachability and missing-auth probes); with one, AI adds functional, edge-case and auth tests.
3. Click Run safe tests. Results stream into Latest run with a passed / failed / skipped count.

After Analyze API: 12 endpoints found, with 2 of them auth-related.

A run of 12 baseline tests: 9 passed, 1 failed (/products/999999 returned 404) and 2 write tests skipped until approved.

The four cards at the top show Endpoints in the latest analysis, Tests executed across all runs, Pass rate and Findings (grouped by severity).

Works without an AI provider

• Structural API analysis of a collection or an OpenAPI document.
• Baseline test generation — reachability checks and missing-auth probes.
• Test execution through the same path as the Collection Runner.
• Evidence-backed results: every failure keeps the request, the response and the assertion that failed.

With an AI provider

Only when Send API data to AI provider is turned on (it is off by default), and only after secrets are redacted:

• A narrative API summary after analysis.
• Additional functional, edge-case and auth tests.
• Failure analysis that explains why a test failed.

Execution safety

• Run safe tests executes only low-risk GET, HEAD and OPTIONS tests.
• POST, PUT, PATCH and DELETE tests are skipped while Require approval for write methods is on (the default). Choose Run all (approved) to run them.
• The AI provider chip shows what is in use — Offline · baseline analysis only when no provider is configured.

Mock Server

Run local HTTP mock APIs from your collections.

Create Mock Server on the Store API collection: one route per request, with {{baseUrl}} stripped and :id parameters kept.

Defaults

Workflow

1. Open Mock Servers, or choose Create Mock Server on a collection in Requests.
2. Add or edit routes (method + path).
3. Configure responses — status, headers, body and delay. A route can hold several responses; add, duplicate, disable or delete them.
4. Start the server and call http://127.0.0.1:<port>/... from a browser, curl or Shurikly. Test sends a request to the selected route, Copy cURL copies a ready command, and URL copies the server address.

Editing GET /products/:id: response name, status, delay, headers and body on the right, and the live Request log below — including a 404 for an unknown path.

The Request log lists every call with time, method, path, the response that was served, status and duration.

Save real responses as examples

In Requests, send a request, open the response menu and choose Save as mock example. Status, headers and body are added to the matching route (or a new route is created). Transport headers such as Content-Length, Set-Cookie and Date are dropped, {{baseUrl}} prefixes are ignored and {{id}} / {id} segments become :id parameters.

Choosing a response

A client can choose a response for a single call with the X-Mock-Response header or the __response query parameter, matching the response id, name (case-insensitive) or status code:

curl -H "X-Mock-Response: Not found" http://127.0.0.1:4010/users/1
curl "http://127.0.0.1:4010/users/1?__response=404"

An unknown value returns 400 with the list of available response names. Served responses carry an X-Mock-Response header with the URL-encoded response name.

Route matching

• Paths support :parameters, e.g. GET /users/:id.
• Static segments win over parameters — /users/me matches before /users/:id.
• Query strings are ignored for matching but available in templates.

Templates

Missing values render as an empty string. CORS can be enabled per server, and every call is recorded in the request log.

MCP server

Shurikly includes a local Model Context Protocol server so AI agents can work with your live workspace — the same collections, environments and results you see in the app.

Enabling it

1. Open Settings → AI and enable the MCP server.
2. The server listens on http://127.0.0.1:47823/mcp (port configurable) and requires a bearer token, which you can regenerate at any time.
3. By default, secrets are replaced with placeholders before an agent sees them. You can choose to expose them.

Connecting an agent

• Claude Desktop — click Install in Settings. Shurikly adds an api-studio entry to claude_desktop_config.json without touching your other servers. If Shurikly is not running, the stdio bridge can start it.
• Claude Code and other HTTP MCP clients:

claude mcp add --transport http --header "Authorization: Bearer <token>" api-studio http://127.0.0.1:47823/mcp

Tools (28)

Diagnostics and bug reports

• Diagnostics page with searchable application logs.
• Global logging of renderer errors and unhandled promise rejections.
• Local bug reports with severity, category, reproduction steps and optional diagnostics.
• Credential redaction on diagnostic attachments.
• Reports stay on your device. Nothing is submitted to an external service automatically; you choose whether to attach a report to a GitHub issue.

Settings

Settings are grouped into four tabs:

Settings are stored as JSON and can be backed up by copying the data folder.

Settings → Appearance: color mode (Light, Dark, System), style (Shurikly, Minimal, Professional, Midnight), accent color and density.

The same workspace in Light mode.

Privacy and security

Reporting a vulnerability

Please report security issues privately through GitHub Security Advisories on the repository rather than in a public issue.

Data storage

Shurikly stores its data in the data subfolder of the shurikly folder inside the operating system's application data directory:

To back up or move Shurikly to another computer, copy the shurikly folder while the app is closed. Encrypted API keys are tied to the original machine and must be entered again.

Architecture

Tech stack

Process model

• Main process — HTTP engine, auth and OAuth 2.0, script and test runners, AI providers and router, Code Scanner, AI Engineer, Mock Server runtime, MCP server, logging and JSON storage.
• Preload — a contextBridge API exposing a typed IPC surface.
• Renderer — the React UI. It never makes network calls directly; everything goes through typed IPC defined in shared/ipc/api.ts.

Repository layout

electron/
  main/
    api-studio/    HTTP client, auth, OAuth 2.0, scripts/tests, AI helpers
    ai/            AI providers, routing, metrics, budget guard
    ai-engineer/   analysis, test generation, execution
    code-scanner/  folder scanning and AI enrichment
    infra/         logger, API keys, onboarding, bug reports, JSON store
    ipc/           IPC handlers
    mock-server/   local HTTP mock server runtime
    mcp/           local MCP server and stdio bridge
    windows/       main window
  preload/         contextBridge API
src/
  modules/         api-studio · code-scanner · ai-engineer · mock-server
  features/        settings, onboarding, diagnostics
  shared/          UI components, stores, utilities
shared/            cross-process types, IPC contract, pure libraries
tests/             vitest suites

System requirements

Build from source

Requirements: Node.js 20+ and Git. The source code is published on GitHub on launch day, 25 October 2026.

git clone https://github.com/shurikly/shurikly.git
cd shurikly
npm install
npm run dev

Installers are written to release/.

Release artifacts for 1.0.0

Contributing

Shurikly is built in the open and contributions of every size are welcome.

1. Discuss — open an issue for bugs and larger features before starting work.
2. Fork and branch — create a topic branch from main.
3. Develop — follow the existing code style; run npm run lint and npm run format.
4. Verify — npm run verify must pass. Add or update tests in tests/.
5. Pull request — describe what changed and why, with screenshots for UI changes.

Good first areas: new Code Scanner extractors (Spring, Go, Laravel, Rails, Koa, Hono, tRPC), documentation, translations of UI text, and additional code-snippet languages.

Roadmap

Planned after 1.0.0 (subject to community feedback):

• Code Scanner — Spring, Go, Laravel, Rails, Koa, Hono, hapi and tRPC; GraphQL server schemas; multi-folder scans; request preview before import; open-in-editor; persisted scans.
• AI Engineer phase 2 — security scan module, API diff, conversational agent, documentation export.
• Distribution — signed and notarized macOS builds, signed Windows installer, automatic updates, Windows arm64.
• Collaboration — git-friendly per-request files for sharing collections through a repository.
• More — additional code-snippet languages, gRPC support.

Known limitations in 1.0.0

• macOS builds are not notarized and the Windows installer is not code-signed; the operating system shows a warning on first launch.
• No automatic updates yet — download new versions from the website or GitHub Releases.
• Code Scanner frontend wrappers support one URL parameter per wrapper function.
• Code Scanner does not yet follow Fastify @fastify/autoload directory prefixes (only autoPrefix exports), NestJS RouterModule paths, or Django regex routes with character classes outside named groups.
• Data from earlier pre-release app names is not migrated to the shurikly data folder.
• AI Engineer test runs do not yet substitute environment variables or path parameters, so requests written as {{baseUrl}}/products/:id fail. Use absolute URLs in the collection you analyze until this is fixed.
• Create Mock Server from a collection fails when another mock server already uses port 4010. Change or delete that server's port first.

Troubleshooting

Changelog

1.0.0 — 2026-10-25

First public, open-source release.

Added

• API client with REST, GraphQL and WebSocket, eleven auth types, and body editors.
• GraphQL introspection, autocomplete, validation and operation selection.
• Response inspection: JSON tree, filter, JSONPath, previews, hex view, find, save.
• Response compare against previous run, pinned baseline or another tab.
• Collections, folders with inheritance, tabs, history, and environments.
• Pre-request scripts, tests and the collection runner with reports.
• Import Postman, OpenAPI and cURL; export Postman, OpenAPI, cURL, Markdown and HTML docs; code snippets.
• Code Scanner for Node.js and Python backends, OpenAPI files and frontend HTTP calls, with re-scan merge, AI enrichment and OpenAPI export.
• AI assistance with OpenAI, Anthropic, Gemini, OpenAI-compatible endpoints and Ollama.
• AI Engineer: analysis, baseline and AI tests, safe execution and failure analysis.
• Mock Server with multiple responses per route, templates, CORS and request logs.
• Local MCP server with 28 tools and one-click Claude Desktop setup.
• Diagnostics center and local bug reports with credential redaction.
• Installers for macOS (Apple silicon and Intel), Windows and Linux.

Changed

• Product renamed to Shurikly, with a new icon and the shurikly data folder.
• Settings and AI usage stored as JSON files instead of a database.
• Single main window with a slim title bar.

License

Shurikly is released under the MIT License.

MIT License

Copyright (c) 2026 Shurikly contributors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.