aimockBLOCK
Mock everything your AI app talks to — LLM APIs, MCP, A2A, AG-UI, vector DBs, search. One package, one port, zero dependencies.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Mock infrastructure for AI application testing — point your SDK at one local port and every provider, protocol, and service answers deterministically.
Quick start · The suite · **Record & replay** · **Docs**
[](https://www.npmjs.com/package/@copilotkit/aimock) [](https://github.com/CopilotKit/aimock/actions/workflows/test-unit.yml) [](https://github.com/CopilotKit/aimock/actions/workflows/test-drift.yml) [](./LICENSE)
https://github.com/user-attachments/assets/76815122-574a-48e1-b275-edae0a014667
One package, one port, zero dependencies. LLM APIs, image generation and editing, text-to-speech, transcription, audio translation and generation, video generation, embeddings, MCP tools, A2A agents, AG-UI event streams, vector databases, search, rerank, and moderation — no keys, no network, no surprise bills.
Quick Start
npm install @copilotkit/aimock
// The class is still named `LLMock` for back-compat after the v1.7.0 package
// rename from `@copilotkit/llmock` to `@copilotkit/aimock`.
import { LLMock } from "@copilotkit/aimock";
const mock = new LLMock({ port: 0 });
mock.onMessage("hello", { content: "Hi there!" });
await mock.start();
// Set env BEFORE importing/constructing the OpenAI (or other provider) client.
// Many SDKs cache the base URL at construction time — if the client is built
// before these are set, it will talk to the real API (surprise bills) instead
// of aimock.
process.env.OPE8e7afd4aa812OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add aimock --env AIMOCK_DUMMY_KEY_MARKER=${AIMOCK_DUMMY_KEY_MARKER} --env AIMOCK_MCP_UPSTREAM_AUTH=${AIMOCK_MCP_UPSTREAM_AUTH} --env AIMOCK_RECORD_SECRET_VALUES=${AIMOCK_RECORD_SECRET_VALUES} --env AIMOCK_VERTEX_ACCESS_TOKEN=${AIMOCK_VERTEX_ACCESS_TOKEN} -- npx -y @copilotkit/[email protected]{
"mcpServers": {
"aimock": {
"command": "npx",
"args": [
"-y",
"@copilotkit/[email protected]"
],
"env": {
"AIMOCK_DUMMY_KEY_MARKER": "${AIMOCK_DUMMY_KEY_MARKER}",
"AIMOCK_MCP_UPSTREAM_AUTH": "${AIMOCK_MCP_UPSTREAM_AUTH}",
"AIMOCK_RECORD_SECRET_VALUES": "${AIMOCK_RECORD_SECRET_VALUES}",
"AIMOCK_VERTEX_ACCESS_TOKEN": "${AIMOCK_VERTEX_ACCESS_TOKEN}"
}
}
}
}Exposed tools (64)
57 read · 5 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
a | read | d |
after | read | Known entry ID to page after; mutually exclusive with before |
ag1 | read | test |
apply_patch | write | Apply a patch in the *** Begin Patch / *** End Patch format. |
archive | read | Archive a list of city names |
before | read | Known entry ID to page before; mutually exclusive with after |
calc | read | Calculator |
conc-agent | read | concurrent |
config-agent | read | from config |
config-tool | read | from config |
described | read | Look up a city |
echo | read | e |
empty | read | |
f | read | f |
filter | read | Filter by file ingestion status before pagination |
get_weather | read | Get weather for a city |
greeting | read | A greeting prompt |
helper | read | helper agent |
include | write | Set to |
journal-agent | read | test |
late-agent | write | added after start |
limit | read | Maximum entries per page |
lookup | read | config tool |
mcp__github | read | GitHub MCP |
mcp__gitlab | read | GitLab MCP |
method | read | Exact method filter (case-insensitive) |
native_tool | read | Cohere native |
no-result-prompt | read | A prompt without a result handler |
offset | read | Entries to skip (integer >= 0) |
openai_tool | read | OpenAI style |
order | write | Sort order by creation time |
path | read | Substring filter on the request path |
plain | read | scoped |
purpose | read | Filter by purpose |
raw_query | read | free text |
real_tool | read | a tool |
record_numbers | read | Record the full comma-separated integer sequence. |
record_payload | read | Record a long payload |
record_text | read | Record text |
registered-only | read | registered |
requestId | read | Request-id filter |
reset-agent | destructive | test |
reset-tool | destructive | will be cleared |
search | read | Search things |
search_tool | read | Search |
service | read | Exact service filter |
skill-agent | read | An agent with skills |
status | read | Exact response status filter |
stream-agent | read | An agent with streaming tasks |
suite-agent | read | Agent in suite |
summarize | read | Summarize text |
t | read | d |
t1 | read | one |
task-agent | read | An agent with tasks |
test-agent | read | A test agent |
test-tool | read | A test tool |
testId | read | Test-id scope filter |
translate | read | Translates text |
w | read | from A |
weather | read | Weather lookup |
weather_tools | read | Weather lookups |
web | read | search |
with_meta | read | Fake with metadata |
write_report | write | Write a detailed weather report. |
Trust audit
BLOCKgrade F · trust 51/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- none-observed
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
stdout = exec(
.claude/commands/write-fixtures.md
["sk-ant-api03-abcdefghijklmnop", "Anthropic API key"],
["AKIAABCDEFGHIJKLMNOP", "AWS access key"],
apiKey: "aimock-fixture-no-key",
const secret = "synthetic-owner-private-7f3d";
token: source === "selected" ? secret : "ordinary-test-credential",
const token = "synthetic-live-credential-7f3d";
token: "synthetic-live-credential-7f3d",
["ghp_abcdefghijklmnopqrstuvwxyz0123456789", "GitHub token"],
["github_pat_11ABCDEFG0123456789_abcdefghij", "GitHub token"],
it('-----BEGIN PRIVATE KEY-----fixture-private-canary-----END PRIVATE KEY-----', () => expect(true).toBe(true));["xoxb-123456789012-abcdefghij", "Slack token"],
reset-agent, reset-tool
.prettierignore
const path = join(fx, "..", `cfg-${createHash("sha1").update(fx).digest("hex")}.json`);const accept = createHash("sha1")return createHash("sha1")} from "../../scripts/update-adoption-wall.js";
const DOCS_PATH = fileURLToPath(new URL("../../docs/index.html", import.meta.url));const AW_REPO_ROOT = new URL("../../", import.meta.url);const CLI_PATH = resolve(__dirname, "../../dist/aimock-cli.js");
const readme = readFileSync(resolve(__dirname, "../../README.md"), "utf8");
# code can never exfiltrate the provider keys. The trade-off (a fork PR has
os.environ.copy() ... requests.post
Gates applied: no_behavioural_pass.
8e7afd4aa812full audit observations/trust-audit/mcp-server/copilotkit__aimock.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 8e7afd4aa812 | BLOCK | F | 51 | first audit |
Questions
What is the @copilotkit/aimock MCP server?
Mock everything your AI app talks to — LLM APIs, MCP, A2A, AG-UI, vector DBs, search. One package, one port, zero dependencies.
What tools does @copilotkit/aimock expose?
64 in total: 57 read-only, 5 that write, and 2 that can delete or overwrite (reset-agent, reset-tool). Every one is listed on this page with its risk.
Is @copilotkit/aimock safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (51/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @copilotkit/aimock need?
It reads AIMOCK_DUMMY_KEY_MARKER, AIMOCK_MCP_UPSTREAM_AUTH, AIMOCK_RECORD_SECRET_VALUES, AIMOCK_VERTEX_ACCESS_TOKEN, ANTHROPIC_API_KEY, ARK_API_KEY, COHERE_API_KEY, ELEVENLABS_API_KEY, FAL_KEY, FIXTURE_SECRET, GITHUB_TOKEN and GOOGLE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @copilotkit/aimock run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @copilotkit/aimock at 1.45.1.
How current is this page?
The grade is for one exact copy of the source (8e7afd4aa812), read on 2026-10-12. The repository is watched and re-audited when it changes.