Generation got cheap. Knowing what’s safe to ship didn’t.
Trusted by 76 of the Fortune 500.
Write 60% less test code. Any CI. Any LLM you host. Open core, 9.0k ★ on GitHub.
Our reference API, graded on every commit
Proven, not claimed
Only evidence counts. Green that never ran does not.
Reproducible, inside your walls
Same inputs, same verdict. In your CI, inside your network.
1 error-severity finding stands unwaived. 1 more gate is open. 34 rules ran.
2 gates open
unwaived-errors1 error-severity finding stands unwaivedcapped-dimensionsecurity-scheme-declared caps security at 20%. Uncapped it would read 62%.Computed, not guessed
Graded against your rules. An answer you can take to an auditor.
The blocker is named
One missing security scheme caps the grade. Fix it, and the grade moves.
Verdict
Computed, not guessed
Proven-ness
34% has evidence
Blocker
Named, with the fix
Reproducible
Your CI, your walls
Velocity & Cost
“We ship every week now, but I can’t tell which requirements we’ve actually proven.”
Trust & Governance
“The dashboards are green, but defects still escape, and now AI writes the tests too.”
Control & Sovereignty
“I sign the release. I can’t stake my name on evidence I can’t reproduce, or that lives on a vendor’s servers.”
API · UI · AI automation
“Locator hell, flaky suites, and screenshot agents that burn tokens.”
Coverage & traceability
“Green that never ran, and AI writing its own tests.”
@req tags → RTM from real runsSelf-hosted & BYO-LLM
“Can’t send code to a cloud LLM; unpredictable token bills.”
The Problem
Different tools for API tests, UI tests, mocks, and performance
Verbose code that takes longer to write than the feature itself
Tests that break every time you refactor, slowing your team down
The Karate Way
Unified framework for API, UI, mocks, and performance tests
Readable, concise syntax that anyone on the team can understand
Built-in parallel execution, reporting, and CI/CD integration
The problem, in your language
A passing dashboard reports activity. Your board, your auditors, and your regulators ask for assurance. Those are not the same question.
What the dashboard counts
Activity. It tells you something ran.
What an auditor asks
Assurance. It tells you you’re safe to ship.
When the same AI writes the code and its tests, passing becomes the goal instead of finding the flaw. “100% hit” can still be not ready to ship.
The bottom line for a product owner
Every release gets a verdict against your business rules, blockers named, evidence attached. No model in the path.
Proof, not a promise
Our reference API, graded by our own tooling, in public, on every commit. No login, no demo request.
The graded spec
1 error-severity finding stands unwaived. 1 more gate is open. 34 rules ran. A dimension with no evidence reads not measured, never zero.Every dimension had evidence this run. One without would read not measured, never zero.
Live from the published report
A document linter would call this spec fine. The heaviest dimension is the one no spec edit can move.
Open the governance reportThe paired run
Mock and provider agreed across 12 scenarios. Then it tells you what it did not check.
It names them: cancelPolicy and getClaim.
Live from the published report · run of 7 Oct 2026
Open the contract reportDeterministic. No model produced any of it, so anyone can re-derive it. How it is computed.
Open core · the engine
Under all three pillars is the open-source engine teams already trust: API, UI, mocks, and performance in one syntax.
REST, GraphQL and SOAP with JSON/XML assertions, schema validation and data-driven scenarios. Karate Agent authors tests from natural language, MCP or your IDE.
Write REST, GraphQL & SOAP in one syntaxMocks in the same syntax as your tests. Stateful, thread-safe, 100% local. Run one suite against mock and provider; see where they disagree.
Browsers and desktop apps in readable commands. Karate Agent recovers when locators drift, so tests survive UI refactors.
Automate UI without CSS selectorsRe-use your API tests as performance tests: thousands of concurrent requests, Gatling built in.
Re-use API tests as load testsSee the Difference
import io.restassured.RestAssured;
import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;
public class UserTest {
@Test
public void testCreateUser() {
RestAssured.baseURI = "https://api.example.com";
String body = "{" +
"\"name\": \"John\"," +
"\"email\": \"john@test.com\"" +
"}";
given()
.contentType("application/json")
.body(body)
.when()
.post("/users")
.then()
.statusCode(201)
.body("name", equalTo("John"))
.body("id", notNullValue());
}
}
Feature: User API
Scenario: Create a new user
Given url 'https://api.example.com/users'
And request { name: 'John', email: 'john@test.com' }
When method post
Then status 201
And match response.name == 'John'
And match response.id == '#notnull'
New · AI Test Automation
An LLM-powered agent that drives the browser, recovers when UIs drift, and authors tests in plain English. Display-text locators, BYO LLM (Claude, GPT, Gemini, Llama, Ollama), 100% self-hosted, and MCP-native for Claude Code and VS Code Copilot.
~30s
Scripted flow runtime (vs 8–19 min pure-LLM)
72×
Fewer page scans (lower token cost)
0
Tokens on scripted paths (LLM only on recovery)
80%
Faster test authoring
60%
Less code vs alternatives
10x
Faster with parallel execution
Recognized by analysts, reviewers & developers
Featured in the Gartner® Market Guide
API & MCP Testing Tools · March 2026
View on GartnerReviewed on G2
Software Testing · API Testing category
Read reviews on G28,800+ GitHub stars
10 years open source · 2M+ monthly downloads
Star on GitHubEnterprise-grade security and support for test automation at scale.
One isolated instance per team, behind your firewall. No shared identity store, no multi-tenant attack surface.
Fine-grained permissions for teams, projects, and environments.
Complete visibility into who did what, when. Export-ready for compliance.
Self-hosted end-to-end. No SaaS dependency, no telemetry, no outbound calls. Your data never leaves your network.
Named account manager, SLA-backed response times, and onboarding assistance.
Deploy in your own cloud or on-premise. Your data never leaves your infrastructure.
What Teams Are Saying
“Ease of setup, ease of writing tests even for juniors, and the fact that it uses Gherkin allows everyone to understand the tests.”
Lina K.
Head of QA · Capterra verified
“Well documented and well supported. The DSL is so simple to learn. Offers a full range of automation capabilities: client-side assertions, server-side mocks and simulators, even performance testing.”
Anthony S.
Team Lead / Principal Engineer · Capterra verified
“An excellent tool in all sense. Used it for both API and UI automation. Found it amazing with parallel execution, negligible flakiness, and code-less automation.”
Kanishka J.
QA Automation Lead · Capterra verified
Questions
No. Everything runs on your machines and your CI. No hosted tier, no telemetry. Karate runs air-gapped in banks, insurers and healthcare.
APIs (REST, GraphQL, SOAP, gRPC, Kafka, WebSocket), browser and desktop UI, performance and mocking. One file drives functional, load and contract tests.
A passing suite reports activity, not which rule was proved or whether only your mock answered. Karate joins evidence to requirements and computes a verdict, blockers named.
No. Verdicts are deterministic: no model, no network, no guess. Same inputs, same result. AI helps author tests, never decides whether one passed.
Yes. Bring your own model, including self-hosted via Ollama, so nothing leaves your perimeter. Model choice is config, not a different product.
No. Teams adopt incrementally: new tests in Karate, existing suites carry on. The platform layers governance and coverage on top of what you have.
Get Started
Join thousands of developers who contribute to and rely on Karate every day. Star us on GitHub, submit a PR, or just say hello.
8,800+
GitHub Stars
350+
Contributors
2M+
Downloads
Unified API, UI, and AI test automation: open source, self-hosted, enterprise-ready. Get a guided walkthrough from our team.
Audit logs, offline licensing, and dedicated support. 100% local. Your data never leaves your infrastructure.