Bowire
All Your Protocols. One UI. One Setup.
The multi-protocol API workbench. Discover, invoke, record, replay, mock, scan.
Across 20+ protocols in the plugin family: a dozen bundled, the rest one bowire plugin install away, plus any custom one you ship.
Embedded or Standalone. UI, CLI or AI agent.
No cloud, no account, free and open source.
Built for API testing with even more swag than Swagger.
Ship Bowire: skip to the dock ↓
See it in action
Discovery, request, response, switch protocol — a full round-trip against the BowireDemo sample with gRPC, SignalR, REST, and WebSocket.
A single tool, every protocol — gRPC, REST, GraphQL, SignalR, MCP, SSE, WebSocket, MQTT, Socket.IO, OData, Surgewave, Kafka, DIS, UDP. No browser plugin, no separate desktop app, no protocol-specific UI quirks.
A single Bowire for every situation
Bowire understands your setup and shows the most useful tools and guidance depending on your task — from first-run welcome through single request and daily streaming workflows to recording and replays.
First-run welcome
Standalone tool without --url: two onboarding paths — connect to a live server, or upload a .proto / OpenAPI / GraphQL SDL.
Connected & ready
Service summary, recent-history quick-recall, keyboard shortcut tips, guided tour entry point.
Visual flow editor
Chain API calls into branching pipelines — visual node editor with loops, conditions, and variable forwarding. No Postman Teams subscription required.
Wireshark-style streaming
Append-only message list + detail pane for server-streaming, client-streaming, and duplex. Filter by substring, jump to any frame, pin the latest.
Click any JSON value to chain
Hover a leaf or key in the response, click it, paste {{prev.path.to.value}} into the next request's body or URL.
Environment diff
Compare two environments side-by-side — spot drift before it hits production. Colour-coded equal / changed / only-in-A / only-in-B rows.
Command palette & vim keys
Press / anywhere to search methods, switch environments, filter protocols. Vim-style j/k navigation for power users.
Record & replay
Click record, run a sequence of calls, click stop. Replay against another environment, convert to test assertions, export as HAR or .bwr.
Performance histogram
Repeat any call N times, watch the latency histogram + timeline render in real time. P50 / P90 / P99 percentiles, success rate, throughput.
Discover → invoke → response
Plug in a URL, get a live service tree, execute a method, read the response — the whole round-trip in a single pane.
Every protocol is a plugin
Inspect, update, or uninstall REST, gRPC, WebSocket, MQTT and the rest from Settings → Plugins → Protocols.
Walk the deck: tour every feature →
Straight into the water
From zero to running in three steps. Pick the boat — install + run snippets tailor themselves.
Which boat are you launching today?
Different rig: see every download →
Why Bowire?
What makes Bowire different from Postman, Insomnia, Scalar, and other API tools.
Protocols in One Workbench
- gRPC
- REST
- SOAP
- GraphQL
- SignalR
- WebSocket
- SSE
- MQTT
-
AMQP
- NATS
- Socket.IO
-
OData
- MCP
- JSON-RPC
-
Surgewave
- Kafka
- Pulsar
- DIS
- UDP
-
AsyncAPI
- Akka.NET
- TacticalAPI
- Custom
Built for every protocol you need plus your own via Bowire's plugin API — a dozen bundled in the standalone install, the rest one bowire plugin install away.
No schema files to maintain — each protocol auto-discovers through its native mechanism (e.g. reflection, OpenAPI, introspection).
Bonus for Embedded Mode: Bowire wires the server-side prerequisites in for you.
Embedded in your process
AddBowire() + MapBowire() in your Program.cs — the workbench ships inside your service, not next to it.
Same process, same DI container, same authentication pipeline. No companion container, no shared database, no cross-process IPC. Standalone CLI still ships for everything else.
Embedded in your process
AddBowire() + MapBowire() in Program.cs, and the workbench is part of your service. Not a sidecar, not a companion container, not a cloud service that proxies your traffic.
Bowire reads from the same IServiceProvider your app builds. Discovery, invocation, and recording run in-process — so the methods you see are exactly what your service exposes, through the same DI scopes, [Authorize] gates, and feature flags the request would have hit anyway. Nothing parallel, nothing bypassed.
For the cases where in-process isn’t the right shape — air-gapped scans, contracts-only browsing, MCP-driven CI agents — the standalone bowire CLI covers the same surface from outside.
100% Local — No Cloud
No accounts. No telemetry. No data leaves your machine. Everything persists in localStorage and ~/.bowire/.
Enterprise security teams love this — no third-party data processing agreements needed.
100% Local — no cloud
No accounts. No telemetry. No data leaves your machine. Bowire persists every credential, recording, and environment to your disk.
Workspace state lives in browser localStorage (per-origin, dev/staging/prod each get their own). Recordings, plugins, and shared environments persist under ~/.bowire/ as a plain JSON tree — greppable, diffable, check it into a private repo if you want shared envs without a sync service.
Outbound connections happen only when you click Execute. No background pings, no telemetry, no remote feature flags. Enterprise security teams sign off in minutes — no third party in the chain, nothing to put in a DPA.
AI-agent ready with MCP support
Claude, Cursor, Copilot. bowire mcp serve exposes Bowire’s discover / invoke / record / mock primitives as MCP tools — every protocol Bowire knows becomes a tool the agent can call directly.
No other multi-protocol API workbench ships an MCP adapter.
Built for AI agents
bowire mcp serve turns every protocol Bowire knows into a tool an AI agent can call. Claude, Cursor, Copilot, custom MCP clients — same wire, same auth, same recordings.
Core primitives (bowire.discover, bowire.invoke, bowire.record.start, bowire.mock.start, …) ship as first-class MCP tools. Agents chain discover → invoke → assert → switch env → replay the same way a human does — just in parallel.
Stdio transport for local Claude-Desktop-style clients, HTTP for Cursor / Copilot / remote agents. Auth piggy-backs on whichever provider the workbench already runs under — no second credentials store.
Security scanner with Nuclei templates
bowire scan runs templates against any HTTP-class target and emits SARIF 2.1.0. Built-in passive checks (TLS, version-disclosure headers) plus the 8000+ projectdiscovery/nuclei-templates via --nuclei.
Drops straight into GitHub Code Scanning, GitLab Security Dashboard, or Azure DevOps.
Multi-protocol security scanner
bowire scan --target https://your-api runs vulnerability templates against the API surface Bowire already discovered, and emits SARIF 2.1.0 that your CI can ingest unchanged.
Two template sources at once: Bowire’s own JSON templates (curated baseline in Bowire.VulnDb) plus the 8000+ Nuclei community templates via --nuclei <dir>. Both feed Bowire’s native AttackPredicate engine — same matchers, same payload variables, no separate runtime.
Findings emit as SARIF 2.1.0 — straight into GitHub Code Scanning, GitLab Security Dashboard, Azure DevOps. Built-in passive checks (TLS-version enumeration, version-disclosing headers, verbose-error detection) fire on day one without writing a template.
Build your own protocol
Every protocol is a NuGet package implementing IBowireProtocol — one interface, every shape Bowire knows: discover, invoke, stream, channel, settings. Ship yours alongside the first-party ones.
Per-package AssemblyLoadContext isolation lets each plugin pin its own transitive dependencies. No version-conflict matrix to track.
Build your own protocol
Every protocol is a NuGet package implementing one contract: IBowireProtocol. Discovery, invocation, streaming, duplex channels, per-plugin settings all flow through the same interface, so building a new protocol is one package, not a fork.
Each plugin loads into its own AssemblyLoadContext, so transitive dependencies don’t collide. The gRPC plugin pinning one Protobuf version and a third-party plugin pinning another coexist without a version-conflict matrix to manage.
Distribution is plain NuGet. bowire plugin install <package-id> for connected installs, bowire plugin download + install --file for air-gapped. The contract powering the first-party set is the same one every community plugin uses; the sidecar bridge opens it to Python, Go, Rust, and Node implementations — ship them as a zip, an http(s):// URL, or straight from an OCI registry (install --file oci://…).
Record and Replay
Capture a real session once, then serve the exact same responses as a live mock endpoint — same protocols, same payloads, same timing.
Unblock frontend work before the backend ships, run contract tests offline, or share a realistic sandbox with stakeholders without exposing production.
Record and replay
Capture a real session once. Serve the exact same responses back as a live mock endpoint — same protocols, same payloads, same timing.
Click Record, run a sequence, click Stop: you get a JSON file with every request, response, status, header, and inter-call timing — gRPC streams next to SignalR hub invocations next to MQTT publishes next to REST hits, all on one timeline.
Mocks aren’t simulators — they’re playback. Every byte is what the real server actually sent, so a test client sees exactly what production does. Unblocks frontend work before the backend ships, offline contract tests, realistic sandboxes for stakeholders without exposing prod.
Free and open source — and staying that way
Every feature on this page is in the free tier, because there is no other tier. Clone it, fork it, embed it in commercial products, audit the code, hack on it — no asterisks, no seat count, no "commercial use requires…".
Hull-to-hull: see the comparison table ↓
Built for modern APIs
Everything you need to discover, test, record, and debug your services across every protocol.
Discover & build
Auto-discovery with hot reload
Zero manual configuration. Drop in a protocol plugin and Bowire uses its native mechanism to enumerate services — then re-scans every few seconds so new endpoints show up without a refresh or restart.
Auto-discovery with hot reload
Plug in a protocol, get a service tree — no hand-maintained proto / OpenAPI / hub-registration code.
Each protocol plugin implements a single DiscoverAsync method: gRPC hits Server Reflection, REST reads the OpenAPI spec, SignalR enumerates mapped hubs via EndpointDataSource, GraphQL introspects __schema, MQTT subscribes to $SYS/#, and so on. Bowire merges the results into a single sidebar across every installed plugin.
The discovery pass repeats every few seconds against every configured URL. A new method registered on a running server shows up in the sidebar within the next tick — no page refresh, no re-upload, no "disconnect and retry" dance.
All call types
Unary, server streaming, client streaming, duplex channels, REST verbs, GraphQL queries / mutations / subscriptions, SignalR hub methods, raw WebSocket frames — every pattern in one UI.
Every call pattern in one UI
Unary, server-stream, client-stream, duplex — plus REST verbs, GraphQL subscriptions, SignalR hubs, raw WebSocket frames, MQTT publishes. One UI, same muscle memory across all of them.
Streaming calls render into a Wireshark-style append-only list with per-frame detail. Duplex / client-stream open a persistent channel with a "send next message" composer on one side and incoming frames on the other. REST maps verbs onto the same invoke pane; GraphQL has a selection-set picker plus subscription follow-up via graphql-transport-ws.
Form & JSON
Switch between auto-generated form fields (typed, validated, nested) and raw JSON editing per request. Schema-driven validation catches errors before they hit the wire.
Typed form or raw JSON — pick per call
Schema-driven form inputs for the common case, a full JSON editor when you need to tweak something unusual. Toggle with f.
The form view auto-generates controls from the discovered message shape: typed number inputs for int32, date pickers for google.protobuf.Timestamp, dropdowns for enums, nested cards for messages, repeated-field tables. Client-side validation flags missing required fields and type mismatches before a single byte hits the wire.
The JSON view is a full editor with syntax highlighting, bracket matching, and inline validation errors. State is preserved per method, so switching away and back never loses work.
Test & measure
Test assertions
Newman-style assertions that auto-run after every successful response. Eleven operators (eq, ne, gt, contains, matches, type, …). Pass / fail badges right in the response pane.
Inline test assertions
Write Newman-style checks once, Bowire runs them after every successful response and shows a green / red badge inline.
Eleven comparison operators (eq, ne, gt, gte, lt, lte, contains, startsWith, endsWith, matches, type) target any value via response.path.to.value JSONPath. Assertions are stored per method, replay with every invocation, and can be exported into a recording so a flow becomes its own regression test.
For streaming responses, assertions run on the accumulated frames — "expect at least 3 frames of type TICK within 2 s" is one rule. No plugins, no pipeline, just a test that lives next to the request.
Performance graphs
Repeat any call N times, watch the latency histogram + timeline render in real time. P50 / P90 / P99 / P99.9 percentiles, success rate, throughput. No external load tester needed.
Performance testing, built in
Repeat any call N times, watch the latency histogram and timeline render in real time.
P50 / P90 / P99 / P99.9 percentiles, success rate, and throughput all in the same pane as the request. No separate load tool to install, no CI pipeline to wire up — just a quick “is this endpoint holding up?” check when you suspect a regression. Scales enough for smoke tests; for full-blown soak tests, export the call as k6 / vegeta and run it from a proper load runner.
Recorder
Postman Collection-Runner parity. Click record, run a sequence of calls, click stop. Replay with current environment variables, convert into test assertions, or export as HAR for sharing.
Record & replay
Click record, run a sequence of calls, click stop. Now you have a reproducible test case, a debug artifact, and a future mock server in one file.
Recordings capture request, response, status, timing, and metadata for every call across every protocol — gRPC streams, SignalR hub invocations, WebSocket frames, MQTT publishes, REST hits, all in one timeline. Replay against another environment to check drift, convert into test assertions for CI, export as HAR for teammates, or serve the recording back as a live mock server (see the next card).
Mock server
bowire mock turns any captured recording into a live endpoint — REST, gRPC (unary + streaming + bidi), WebSocket, SSE, SignalR, Socket.IO, MQTT, GraphQL subscriptions. Hot-reload, chaos injection, capture-on-miss.
Replay recordings as a mock server
bowire mock --recording session.bwr --port 5099 turns any captured recording into a live endpoint at the same shape as the original.
Every protocol your recording captured replays through the same listener — REST verbs hit the same paths, gRPC unary + server-streaming + bidi answer with the captured frames, WebSocket / SSE / SignalR / Socket.IO push the same sequence, MQTT publishes hit the same topics, GraphQL subscriptions stream the same events. The mock keeps protocol semantics intact (status codes, frame timing, headers) instead of collapsing everything to a JSON stub.
Layers on top: hot-reload (on by default; --no-watch to disable) — rewriting the recording file refreshes the mock without a restart; chaos injection — configurable latency / 5xx rate / dropped-frame ratio for resilience tests; schema-only mode — --schema openapi.yaml (or --grpc-schema / --graphql-schema) serves plausible responses from an OpenAPI / gRPC descriptor / GraphQL schema with no recording at all; stateful cursors — a recording with multiple captures of the same call replays them in order; capture-on-miss — an unrecorded request transparently forwards to the original target, captures the response, and serves it back next time.
Security scan
bowire scan against any HTTP-class target with Bowire's own templates plus the 8000+ Nuclei templates via --nuclei. Findings emit as SARIF 2.1.0 — straight into GitHub Code Scanning, GitLab, or Azure DevOps.
Multi-protocol security scanner
bowire scan --target https://api.example.com --out findings.sarif runs vulnerability templates against the API surface Bowire already discovered, and emits SARIF 2.1.0 that your CI ingests unchanged.
Two template sources at once: Bowire's own JSON templates (the curated baseline shipped in Bowire.VulnDb) plus the 8000+ Nuclei community templates via --nuclei <dir>. The Nuclei reader translates status / word / regex matchers + matchers-condition + payload matrices + the standard variable set (, , , …) into Bowire's native AttackPredicate DSL — same engine, both template sets.
Built-in passive checks fire on every run regardless of templates: TLS-version enumeration, version-disclosing headers, verbose-error detection. SARIF output drops straight into GitHub Code Scanning, GitLab Security Dashboard, Azure DevOps, or any tool with a SARIF importer.
Fuzz
Schema-aware field-level fuzzer. bowire fuzz knows not to throw SQL-injection at a latitude (lat) field; image.bytes gets magic-byte mutation, not XSS strings. Categories: sqli / xss / pathtrav / cmdinj with baseline-diff oracle.
Schema-aware field-level fuzzer
bowire fuzz --target https://api.example.com --template recordings/order.bwf --field '$.customer.email' --payloads xss runs targeted mutations against one field at a time using the schema Bowire already knows.
Schema-awareness is the differentiator: the fuzzer respects field types from the discovered schema (OpenAPI / proto / GraphQL / AsyncAPI), so SQL-injection payloads don't get fired at integer latitude fields and XSS strings don't get fired at image.bytes. Image-byte fields get magic-byte / truncation / over-length mutation instead, integer fields get boundary / overflow / negative mutation, dates get format / range mutation.
Four payload categories shipped (sqli, xss, pathtrav, cmdinj) with curated wordlists, plus a baseline-diff oracle: if the mutated response looks materially different from the baseline (status change, error-shape divergence, latency spike beyond N standard deviations) the finding gets flagged. Reuses the same SARIF emitter as bowire scan, so fuzz findings drop into the same CI surface.
Design-time lint
Rules that read the API surface itself — PII in responses, unbounded collections, missing versioning — before anyone calls it.
Design-time lint
bowire lint runs design rules over a discovered surface. It reads a snapshot file or a live URL, so it works on a schema in a pull request as readily as on a running service.
The shipped rules flag a response carrying a field that looks like personal data (email, phone, SSN, date of birth, address, passport or tax id), a response carrying something that looks secret, a collection endpoint with no pagination, an API with no versioning scheme, and a timestamp shipped as a bare string. Each finding names the rule and the method it fired on.
Configuration lives in .bowire/rules.json, discovered by walking up from the working directory the way a linter should — so a repository sets its own severities once and every checkout, and the CI runner, read the same file. The Lint rail shows the same findings in the workbench.
Contract matrix
Pact-style consumer contracts, rolled up into a consumer × provider grid you can read at a glance.
Contract testing, and the matrix over it
bowire contract publish builds a consumer contract from a recording, verify replays it against a live provider, and matrix rolls the stored results into a consumer × provider grid.
verify exits 0 when every interaction held, 1 on a mismatch and 2 when a request errored — three states because a pipeline needs to tell “the provider changed” apart from “the provider was unreachable”. With --broker-url, publish pushes to a Pact Broker instead of writing a file.
The Contracts rail renders the same matrix in the workbench, with per-interaction drill-in: a red cell opens the interaction that failed rather than making you find it.
One rollup
Lint, contract, benchmark, scan and test reports read into one row per service — the same shape in the UI, the CLI and MCP.
One rollup across every report
bowire report rollup reads the lint, contract, benchmark, scan and test reports under the paths you give it and prints one row per service.
The rollup has one canonical JSON shape, and every surface emits it: GET /api/report/rollup for the workbench, bowire report rollup --json for a pipeline, and the bowire.report.rollup MCP tool for an agent. One shape means a dashboard, a CI gate and an assistant are reading the same numbers rather than three approximations of them.
Connect & scale
Auth helpers
Bearer, Basic, API Key (header or query), JWT (HS / RS / ES), OAuth 2.0 client_credentials + authorization_code with PKCE, custom token endpoint with auto-refresh, AWS Signature v4 — per environment.
Every auth scheme, built in
Every auth scheme worth supporting, built in. Set it once per environment, Bowire signs every request.
Bearer tokens, HTTP Basic, API Key (header or query), JWT issuance (HS256 / RS256 / ES256) with custom claims, OAuth 2.0 client_credentials, OAuth 2.0 authorization_code with PKCE for local CLI flow, a custom token endpoint with auto-refresh, and AWS Signature v4 for S3 / Lambda / API Gateway. Each scheme stores its values in the environment, substituted at request time — tokens never touch the page source.
Expired tokens refresh transparently. Metadata headers on gRPC, authorization headers on REST / GraphQL / SignalR / WebSocket / MQTT (Username-Password CONNECT) all share the same credential store.
Environments & variables
Postman-style {{var}} substitution in URLs, headers, and bodies. Switch between Dev / Staging / Prod, or connect to several servers in parallel — per-URL status indicators, per-service origin tagging.
Environments, variables, and drift diff
Postman-style {{var}} substitution in URLs, headers, and bodies — plus a side-by-side diff so you see what changes between Dev and Prod before you call the wrong one.
Switch between Dev / Staging / Prod, or connect to several servers in parallel — per-URL status indicators, per-service origin tagging. Pick any two environments for a colour-coded diff: equal rows fold away, changed rows highlight, only-in-A / only-in-B clearly marked. Catches missing secrets, mistyped keys, and accidental overrides that would otherwise burn an afternoon of debugging.
CLI & standalone tool
bowire list, describe, call for scripting against any server. Or run as a global tool with the browser UI — every protocol plugin built in. No host code changes required.
CLI + standalone browser, same binary
Run as a .NET global tool and get three flavours of the same workbench — CLI subcommands for scripts, an HTTP-served UI for interactive use, and embedded middleware for teams that want the UI inside their own app.
bowire list <url> enumerates services, bowire describe <service.method> prints the full schema, bowire call <service.method> -d '{...}' invokes it — same output shape as the UI uses, so the CLI is scriptable against CI. Add --format json for machine-readable piping, or --recording to capture an output for later replay.
The standalone UI is just bowire --url https://api.example.com — the UI runs locally, hits the API with your auth, zero host-side changes. Plugin management (bowire plugin install / list / uninstall) shares the same state with the embedded mode.
Secrets from the OS keyring
Read credentials from the platform's own credential store instead of a file next to your workspace.
Secrets from the OS keyring
A secret can be resolved from the running operating system’s native credential store, so it never lands in a workspace file, an environment variable, or a shell history.
The shipped backend has no NuGet dependency at all: on Windows it calls CredReadW against advapi32.dll, and on macOS and Linux it reads the platform’s own store. IKeyringBackend is the seam, so an install with a different secret manager implements one type rather than forking the resolver.
Resolution is reported honestly — a key the keyring does not hold reads as absent rather than as an empty string, which is the difference between a request that fails loudly and one that silently sends nothing.
Power tools
Vim-style keyboard navigation
j/k to hop methods, f to flip form/JSON, r to repeat, t to cycle themes, Ctrl+Enter to execute. Power users never touch the mouse.
Keyboard-first everything
Every action has a shortcut. Power users never touch the mouse; newcomers get a cheat sheet at ?.
Vim-style j / k to hop between methods in the sidebar, f to flip form ↔ JSON, r to repeat the last request, t to cycle light / dark / auto themes, Ctrl+Enter (or ⌘+Enter) to execute, Esc to close any modal, / to open the command palette, ? to see the full list without leaving the page.
Shortcuts are configurable per-user in Settings → Shortcuts, with conflict detection so the same chord never binds two actions silently.
Command palette
Press / anywhere to search methods, jump environments, apply protocol filters, or pin a name filter. Recently-used methods surface when the query is empty.
Command palette & keyboard flow
Press / anywhere to search methods, switch environments, filter protocols — never leave the keyboard.
Vim-style j / k to hop between methods, f to flip form / JSON, r to repeat the last request, t to cycle themes, Ctrl+Enter to execute. Recently-used methods surface when the palette query is empty. Power users who live in the shell will feel at home.
Click-to-chain responses
Hover any value in a response — click it and paste {{prev.path.to.value}} straight into the next request's body or URL. Works in JSON, tree, and streaming views.
Click any JSON value to chain
The response from one call is the input for the next. Bowire skips the copy-paste round-trip.
Hover any value or key in a rendered JSON response, click it, and Bowire places the chaining expression on your clipboard — ready to paste into the next request’s body, URL path, or headers. Works on every supported protocol, not just REST: gRPC response fields, GraphQL query results, SignalR hub return values, MQTT payloads, SSE events all use the same {{prev.path.to.value}} grammar.
A map you can read
Trajectories per entity, contacts told apart by their own identity, and a time cursor that rewinds the stream you already collected.
The map widget: trajectories, grouping, playback
A situation picture stops being a scatter of dots. Sequential frames for one entity join into a trajectory LineString, so a track reads as a path rather than as a cloud.
Per-entity grouping keys on a configurable track-id field, so thirteen contacts in one stream stay thirteen tracks instead of merging into one. The field is yours to name — a payload that identifies entities by entityId, callsign or a nested marking is grouped the same way.
A time cursor with playback scrubs a stream you already collected: pin the map to a moment, run it forward, and watch the picture develop. The legend follows the cursor, so what you read beside the map is what is on it.
Walk the deck: tour every feature →
Multi-protocol by design
One UI for every protocol your service stack speaks.
Each protocol is a plugin — install only what you need.
gRPC
Server Reflection, proto schema browser, all four streaming types (unary / server / client / duplex) over native HTTP/2 or gRPC-Web. Auto-generated request templates from protobuf definitions, plus HTTP transcoding for methods with google.api.http annotations.
$ dotnet add package Kuestenlogik.Bowire.Protocol.Grpc
$ bowire --url <url>
built in
gRPC
All four streaming flavours land in the same Wireshark-style frame pane — no separate tool for client-stream or duplex.
Bowire pulls the service tree from Server Reflection, generates typed request forms straight off the proto, and renders streaming responses frame-by-frame with per-message detail. The same plugin speaks native HTTP/2 gRPC and gRPC-Web — opt into web mode with a grpcweb@ URL hint or the X-Bowire-Grpc-Transport: web metadata header to reach browser-fronted services and HTTP/1.1-only ingresses (Envoy, grpcwebproxy, ASP.NET UseGrpcWeb). HTTP transcoding kicks in automatically for methods carrying google.api.http, so REST-style hits work side by side with the gRPC call.
- Unary
- Server-streaming
- Client-streaming
- Bidi
- gRPC-Web
- Connect Phase 2 (shipped v1.7.0)
REST
OpenAPI / Swagger document discovery with full path / query / header / body parameter forms. AWS Sig v4 signing built in. Drop in any swagger.json as a fallback when introspection isn't available.
$ dotnet add package Kuestenlogik.Bowire.Protocol.Rest
$ bowire --url <url>
built in
REST
REST that doesn't make you babysit a Postman collection — OpenAPI in, typed forms out, AWS Sig v4 already wired up.
Bowire pulls the schema from /swagger/v1/swagger.json (or any URL you point it at) and turns each operation into a typed form with separate path / query / header / body sections. Multipart uploads work out of the box, and streaming JSON / NDJSON responses render frame-by-frame in the same pane gRPC server-streaming uses.
- Request / response
- multipart upload
- streaming JSON / NDJSON
GraphQL
Schema introspection via __schema, visual selection-set picker for picking which fields you want returned, support for queries, mutations, and graphql-transport-ws subscriptions.
$ dotnet add package Kuestenlogik.Bowire.Protocol.GraphQL
$ bowire --url <url>
built in
GraphQL
A visual selection-set picker beats hand-rolling query strings — tick the fields you want, Bowire writes the query.
Bowire introspects __schema, lets you tick the fields you want returned, and renders nested object types as collapsible sub-trees. Subscriptions stream into the same Wireshark-style frame pane gRPC server-streaming uses, over either graphql-transport-ws or SSE.
- Query
- Mutation
- Subscription (over WS or SSE)
SignalR
Hub auto-discovery via endpoint metadata, method invocation with parameter type reflection, real-time bidirectional channels with the same UI as gRPC duplex streaming.
$ dotnet add package Kuestenlogik.Bowire.Protocol.SignalR
$ bowire --url <url>
built in
SignalR
Hubs show up in the sidebar without a hand-rolled JS test client — Bowire enumerates them straight from EndpointDataSource.
Auto-discovery walks the ASP.NET endpoint metadata to find every mapped hub, then reflects the method signatures so each gets a typed parameter form. Server-streaming and duplex hub channels render in the same Wireshark-style frame pane gRPC bidi uses.
- Invoke
- Server-streaming
- Duplex hub channels
MCP
AI agent integration for Claude Desktop, Cursor, and Copilot. Discovered methods are exposed as MCP tools with JSON Schema input. Bidirectional MCP server browser for inspecting tools published by other agents.
$ dotnet add package Kuestenlogik.Bowire.Protocol.Mcp
$ bowire --url <url>
built in
MCP
Bowire is an MCP client and server — inspect what Claude Desktop / Cursor / Copilot expose, or surface your own services as tools to them.
Each discovered Bowire method becomes an MCP tool with JSON Schema input, so any MCP-aware agent can call your services. The browser side connects over streamable HTTP today (bowire --url mcp@http://host/mcp), enumerates remote tools, and lets you invoke them with the same typed-form UI used for everything else. The legacy SSE + POST split is deliberately unsupported; stdio is reserved for Bowire acting as a server via bowire mcp serve.
- Tool invocation (unary) over streamable HTTP
- Remote tool discovery
- stdio via
bowire mcp serve
SSE
Server-Sent Events — register endpoints via attribute or fluent API, watch live event streams render in the response pane. The same plugin powers GraphQL subscriptions and MCP server-push.
$ dotnet add package Kuestenlogik.Bowire.Protocol.Sse
$ bowire --url <url>
built in
SSE
One plugin, three jobs — raw SSE, GraphQL subscriptions, and MCP server-push all reuse the same streaming pipeline.
Register an endpoint via attribute or the fluent API, point Bowire at it, and live events render frame-by-frame in the same Wireshark-style pane gRPC server-streaming uses. Last-Event-ID resume and named event channels are honoured automatically.
- Server-streaming (one-way push)
WebSocket
Raw WebSocket frame editor with text + binary support, sub-protocol selection, per-frame type toggle. Open a channel, send a frame, watch responses arrive — same UI as the duplex gRPC and SignalR channels.
$ dotnet add package Kuestenlogik.Bowire.Protocol.WebSocket
$ bowire --url <url>
built in
WebSocket
Raw frame editor with the same duplex UI gRPC and SignalR get — no need for a separate browser tab full of wscat.
Send text or binary frames per side, flip frame type per message, negotiate a sub-protocol on connect. Incoming frames stream into the same Wireshark-style pane, with hex / UTF-8 toggle for binary payloads.
- Duplex text + binary frames
- sub-protocol negotiation
MQTT
Broker connect over TCP or WebSocket, topic subscribe with wildcards, retained-message inspection, QoS 0/1/2 publishes. Bidirectional channel reuses the same Wireshark-style stream pane as gRPC and SignalR.
$ dotnet add package Kuestenlogik.Bowire.Protocol.Mqtt
$ bowire --url <url>
built in
MQTT
Both 3.1.1 and 5.0 brokers in one client, with retained-message inspection and QoS 0/1/2 publishes from the same UI as every other call.
Connect over TCP or WebSocket, subscribe with wildcards (+, #), and watch live messages stream in the Wireshark-style frame pane. MQTT 5 request/response pairs (using correlation data + response topic) are correlated automatically and shown as a unified call.
Pairs with AsyncAPI. An asyncapi.yaml declaring bindings.mqtt or bindings.mqtt5 dispatches through this plugin — channel address → topic, qos / retain / will fields ride along on the metadata bag. Same workbench UI whether you point Bowire at a broker or at an AsyncAPI contract.
- Pub / Sub
- Request / Response
- MQTT 3.1.1 + 5.0
- AsyncAPI
bindings.mqtt/mqtt5target
NATS
Built on the official NATS.Net 2.x client. Three discovery sources fan out from one shared connection: subject sampling on the > wildcard, JetStream stream enumeration, and the Services API via $SRV.PING broadcast. Pub / sub / request reuse the same Wireshark-style stream pane.
$ dotnet add package Kuestenlogik.Bowire.Protocol.Nats
$ bowire plugin install Kuestenlogik.Bowire.Protocol.Nats
NATS
One connection, three discovery sources: subject sampling, JetStream streams, Services API. Every subject becomes publish / subscribe / request without per-subject configuration.
The plugin sits on the official NATS.Net 2.x client. Subjects observed during the > scan window get grouped by first-token prefix; each surfaces three methods. JetStream streams (when -js is on) become services with info, consume via ordered consumer, and JS-acked publish per filtered subject. $SRV.PING broadcast + $SRV.INFO.<name> follow-up parses the Services-API endpoint list. Queue-group hint on subscribe via metadata queue_group for NATS-side load balancing.
Try it. samples/Nats in the main repo brings up a nats:2-alpine -js broker via docker-compose; point Bowire at nats://localhost:4222 to see all three discovery surfaces light up at once.
- Subject pub / sub / request
- JetStream streams
- Services API
- Queue groups
SOAP
WSDL 1.1 discovery (operations → methods, port types → services), SOAP 1.1 + 1.2 envelopes, automatic Fault detection. No WCF or SoapCore dependency — the wire is hand-rolled XML over HTTP, so the plugin works on every .NET LTS.
$ dotnet add package Kuestenlogik.Bowire.Protocol.Soap
$ bowire --url <url>
built in
SOAP
Paste a WSDL URL, get a typed service tree. Fault bodies surface with their own Status="Fault" so they're distinct from transport-level errors.
The parser walks every <portType> and matches it to its <binding> + <service>/<port> so each operation knows its SOAPAction header. SOAP 1.1 is the default; soap_version=1.2 metadata flips both the envelope namespace and the Content-Type per WS-I BP 1.1. Endpoint URL override via endpoint_url metadata covers the "WSDL on host A, service on host B" deployments.
Try it. samples/Soap/CalculatorService in the main repo is a hand-rolled Calculator service (no WCF dependency) with Add / Subtract / Multiply / Divide and a Fault on divide-by-zero so the fault-handling path lights up.
- WSDL discovery
- SOAP 1.1 + 1.2
- Fault detection
JSON-RPC
Generic JSON-RPC 2.0 client over HTTP. Discovery via OpenRPC's rpc.discover reflection method; servers that don't advertise OpenRPC still work with a freeform fallback so you can invoke any method by name.
$ dotnet add package Kuestenlogik.Bowire.Protocol.JsonRpc
$ bowire --url <url>
built in
JSON-RPC
Spec-conformant JSON-RPC 2.0 with OpenRPC discovery, positional or named params, and structured error codes on the response status.
The plugin calls rpc.discover and pulls every method definition out of the OpenRPC document into Bowire's form UI. Servers that return Method-Not-Found (-32601) still get a placeholder service so users can invoke any method by name. Application errors surface with Status="jsonrpc:<code>" so the UI can tell a JSON-RPC error apart from a transport / parse failure without a second round-trip.
Try it. samples/JsonRpc/Math in the main repo is a full rpc.discover-aware add / subtract / divide service.
- OpenRPC discovery
- Positional + named params
- Spec error codes on Status
Apache Pulsar
Built on the Apache-maintained DotPulsar 3.5.x client. Topic discovery via Pulsar's HTTP admin API; produce (Unary) and subscribe (ServerStreaming) over the binary protocol with an exclusive subscription that auto-acks so the cursor advances.
$ dotnet add package Kuestenlogik.Bowire.Protocol.Pulsar
$ bowire plugin install Kuestenlogik.Bowire.Protocol.Pulsar
Apache Pulsar
Topic enumeration via the Pulsar HTTP admin, produce / subscribe over the binary protocol. URL plumbing accepts any of five common shapes and derives broker + admin automatically.
The plugin enumerates topics in public/default plus any extra namespaces wired via the namespaces setting. Each topic surfaces as a service with produce (Unary) and subscribe (ServerStreaming). Short topic names get expanded into Pulsar's fully-qualified form (my-topic → persistent://public/default/my-topic). Subscription type is Exclusive so workbench tails don't fight production consumers, and from_latest metadata flips the initial position to Earliest for backlog replay.
Try it. samples/Pulsar in the main repo brings up apachepulsar/pulsar:3.3.0 standalone via docker-compose plus a .NET producer that publishes one message per second to a demo topic.
- HTTP-admin topic discovery
- Produce + Subscribe
- Multi-namespace scan
AMQP
RabbitMQ, ActiveMQ, Solace, Azure Service Bus — one plugin covers both AMQP 0.9.1 and AMQP 1.0. URL scheme picks the wire: amqp:// for 0.9.1, amqp1:// for 1.0. Discovery uses the RabbitMQ Management HTTP API; consume streams render in the same Wireshark-style pane.
$ dotnet add package Kuestenlogik.Bowire.Protocol.Amqp
$ bowire plugin install Kuestenlogik.Bowire.Protocol.Amqp
AMQP
Two AMQP wires (0.9.1 and 1.0) in one plugin, picked by URL scheme. v0.2.0 ships discovery + unary invocation + finite-stream consume against live brokers.
Built on RabbitMQ.Client for AMQP 0.9.1 (amqp:// / amqps://) and AMQPNetLite for AMQP 1.0 (amqp1:// / amqps1://). On 0.9.1, discovery reads the broker topology via the RabbitMQ Management HTTP API; basic.publish drives invocations, AsyncEventingBasicConsumer drives consume. On 1.0, the plugin exposes a synthetic Broker service, with Session.Send for invocations and ReceiverLink for consume. Same workbench UI on either wire.
Pairs with AsyncAPI. An asyncapi.yaml declaring bindings.amqp (0.9.1) or bindings.amqp1 (1.0) dispatches through this plugin — channel address → exchange / address, routingKey / deliveryMode / expiration ride on the metadata bag.
Try it. Bowire.Samples.Amqp spins up a RabbitMQ broker via docker compose and a publisher loop emitting crane telemetry to the harbor topic exchange — runnable in two commands.
- Pub / Sub
- Topic / Direct exchanges
- AMQP 0.9.1 + 1.0
- AsyncAPI
bindings.amqp/amqp1target
Socket.IO
Namespace + room aware client, event emit / ack with JSON payloads, auto-reconnect with exponential backoff, binary event support. Works against any v2/v3/v4 Socket.IO server.
$ dotnet add package Kuestenlogik.Bowire.Protocol.SocketIO
$ bowire --url <url>
built in
Socket.IO
Namespace + room aware, with the ack callback wired into the same response pane — no JS console acrobatics.
Bowire picks the namespace, joins / leaves rooms on the fly, and emits typed events with JSON payloads. Acks come back as a normal response with timing; broadcast events stream into the duplex pane like any other channel. Works against v2 / v3 / v4 servers, with auto-reconnect on transport drop.
- Duplex with ack
- namespaces
- rooms
OData
CSDL metadata discovery, entity-set browser with typed filters ($filter, $orderby, $expand), batch requests, navigation-property follow-through. Works with ASP.NET's Microsoft.AspNetCore.OData.
$ dotnet add package Kuestenlogik.Bowire.Protocol.OData
$ bowire --url <url>
built in
OData
Build $filter / $expand / $select as picker UI — no more hand-encoding query strings to chase a bug.
Bowire reads CSDL metadata from /$metadata, renders entity sets in the sidebar, and gives each one a query builder for system query options. Bound functions and actions appear as their own callable methods. Works against ASP.NET's Microsoft.AspNetCore.OData stack and any V4-compliant service.
- Request / response
$filter/$expand/$select- functions / actions
AsyncAPI
Discovery source — not a wire. Drop in an asyncapi.yaml or .json document (2.x + 3.0); Bowire walks channels, operations, and per-message overloads, then dispatches each call through the wire plugin its bindings: block declares. Today that means MQTT, Kafka, AMQP, WebSocket, and HTTP — every binding resolves to a shipped first- or third-party plugin. NATS follows.
$ dotnet add package Kuestenlogik.Bowire.AsyncApi
AsyncAPI
Discovery source for event-driven APIs — parse the contract, route invocations through whichever wire the doc’s bindings: declare.
Bowire loads AsyncAPI 2.x and 3.0 documents (YAML or JSON), walks channels + operations + messages + per-message overloads, and registers them as first-class entries in the sidebar. Each operation knows which wire it speaks (from the bindings: block), so the invoke pane composes the right frame and hands it to the matching wire plugin — today http (built into the AsyncAPI plugin itself, no extra wire needed), mqtt + mqtt5 via Kuestenlogik.Bowire.Protocol.Mqtt, kafka via Kuestenlogik.Bowire.Protocol.Kafka, ws via Kuestenlogik.Bowire.Protocol.WebSocket, and amqp / amqp1 via Kuestenlogik.Bowire.Protocol.Amqp; NATS follows as that wire ships.
- AsyncAPI 2.x + 3.0 (YAML / JSON)
- Channels, operations, per-message overloads
- http + mqtt + mqtt5 + kafka + ws + amqp / amqp1 bindings
Surgewave
Küstenlogik's Surgewave broker — native protocol via the Kuestenlogik.Surgewave.Client SDK or Kafka-compatible wire (?protocol=kafka). Topic browse, produce, server-streaming consume, in-process tap via surgewave://embedded.
$ bowire plugin install Kuestenlogik.Bowire.Protocol.Surgewave
Surgewave
First-class support for Küstenlogik's own broker — including the in-process surgewave://embedded tap that needs zero broker installed.
Connect with the native Kuestenlogik.Surgewave.Client SDK, or hit any Surgewave broker through its Kafka-compatible wire by appending ?protocol=kafka. Topic discovery, produce, partitioned consume, and consumer-group state are all visible in the same UI — the embedded mode is the fastest path from "is my pipeline producing?" to a green frame in the response pane.
- Topic produce (Unary)
- partitioned consume (Server-streaming)
- in-process tap
Kafka
Apache Kafka via Confluent.Kafka. Topic discovery via the Admin API, produce / consume with the standard JSON envelope, mTLS + SASL auth, plus optional ?schema-registry=… for live Avro decode of consumed messages.
$ bowire plugin install Kuestenlogik.Bowire.Protocol.Kafka
Kafka
Live Avro decode against Schema Registry — consumed records show up as JSON in the frame pane instead of opaque bytes.
Bowire connects with Confluent.Kafka, discovers topics via the Admin API, and uses the standard envelope so produce / consume work the same as every other protocol. Append ?schema-registry=https://... and Avro records are decoded inline; mTLS and SASL credentials live in the environment alongside every other auth scheme.
Pairs with AsyncAPI. An asyncapi.yaml declaring bindings.kafka dispatches through this plugin — the AsyncAPI KafkaBindingResolver reads channel address → topic, schema-registry hints, key / partition fields from the doc and hands them off here, so the same workbench UI works whether you point Bowire at a live broker or at an AsyncAPI contract.
- Produce (Unary)
- Consume (Server-streaming)
- Schema Registry decode (Avro)
- AsyncAPI
bindings.kafkatarget
DIS
IEEE 1278 Distributed Interactive Simulation. UDP multicast listener for live PDU traffic, structured rendering of EntityState / Fire / Detonation / Collision PDUs, on-wire hex dump for binary inspection. Standalone-mode plugin for simulation environments.
$ bowire plugin install Kuestenlogik.Bowire.Protocol.Dis
DIS
Typed PDU rendering for IEEE 1278 traffic — EntityState / Fire / Detonation / Collision get a real form, not just a hex blob.
Subscribe to a multicast group, watch live PDUs land in the streaming pane with structured fields per type. Anything Bowire doesn't have a typed renderer for falls back to a canonical hex dump so binary inspection still works. Built for the same simulation environments as Surgewave and the Estuary stack.
- UDP-multicast PDU listen
- typed PDU rendering
- hex-dump fallback
UDP
Raw UDP datagram listener — feed any UDP source into the Bowire streaming pane. Auto-detects UTF-8 text payloads, falls back to base64 + canonical hex dump for binary. Sibling to the DIS plugin via the same IBowireMockEmitter contract.
$ bowire plugin install Kuestenlogik.Bowire.Protocol.Udp
UDP
A general-purpose UDP listener that feels like every other protocol — same streaming pane, same hex / UTF-8 toggle, same recording support.
Listen on multicast, broadcast, or unicast addresses; Bowire auto-detects UTF-8 payloads and falls back to base64 + canonical hex dump for raw binary. Shares the IBowireMockEmitter contract with the DIS plugin, so the same harness works for both.
- Datagram listen
- multicast / broadcast / unicast
- UTF-8 + hex
Akka.NET
Live tap on any Akka.NET ActorSystem — the BowireTapMailbox wraps the standard mailbox and streams every Tell into the workbench. Embedded mode only; opt in globally via the default-mailbox swap or per-actor with Props.WithMailbox.
$ bowire plugin install Kuestenlogik.Bowire.Protocol.Akka
Akka.NET
A passive mailbox tap means you can watch every Tell in your actor system without changing a line of business code.
The BowireTapMailbox wraps Akka.NET's standard mailbox and streams each message into the workbench in real time — per-actor or globally via the default-mailbox swap. Embedded mode only, since the tap runs in the same process as the ActorSystem; nothing leaves the host unless you choose to expose it.
- Mailbox tap (Server-streaming)
- embedded only
TacticalAPI
Rheinmetall's TacticalAPI — gRPC interface for situational-awareness systems. Bundled schema means the Situation service tree shows up in the sidebar even without Server Reflection. v1.0: discovery + typed unary CRUD + server-streaming pump all wired through, mTLS client-cert via metadata for the field-default deployment shape, recording-replay via TacticalApiMockEmitter.
$ dotnet add package Kuestenlogik.Bowire.Protocol.TacticalApi
$ bowire plugin install Kuestenlogik.Bowire.Protocol.TacticalApi
TacticalAPI v1.0.0
A typed discovery sidebar for Rheinmetall's situational-awareness gRPC interface — even when the target server doesn't expose Server Reflection.
The plugin downloads the upstream .proto set at build time (pinned commit, EPL-2.0 upstream, never redistributed), compiles it with Grpc.Tools, and ships only the generated bindings — so installing the package gives Bowire enough schema to render the Situation service tree out of the box. Connect with bowire --url tacticalapi@host:50051. Pairs naturally with the gRPC plugin's gRPC-Web transport for TacticalAPI's HTTP/1.1 port (:4268) alongside the native HTTP/2 port (:4267).
- Descriptor discovery
- Typed unary invoke
- Server-streaming SubscribeSituationObjectEvents
Coming soon
Surgewave tap-stream subscription, Connect (Buf) phases 1 + 3 (unary + bidi-streaming over HTTP/2). OTLP receive-side has already shipped as a first-party plugin (Kuestenlogik.Bowire.Protocol.Otlp). More on the roadmap →
Your Protocol
Scaffold a new plugin with the bowire-plugin template — implements IBowireProtocol, ships as a NuGet package with <PackageType>BowirePlugin</PackageType>, picked up by assembly scanning at startup.
$ dotnet new install Kuestenlogik.Bowire.Templates
$ dotnet new bowire-plugin --name MyProtocol
Want to ship one? Join the crew
Built for your workflow
Bowire isn't a Postman replacement — it's a workbench for the situations where Postman doesn't fit. Pick the workflow that sounds most like yours.
Backend developers
embedded mode · zero account walls
You're building an ASP.NET service and you want a debug UI inside your app for your team and your users — not a separate Electron app behind a sign-up flow. Add app.MapBowire(), ship the binary, every endpoint is browsable at /bowire.
→ gRPC reflection · OpenAPI · GraphQL introspection · SignalR endpoint scan · AsyncAPI discovery
API integration testers
recorder · environments · assertions
You're verifying that an external API behaves the way the docs claim. Click Record, run a sequence of calls, click stop. Replay against Dev / Staging / Prod with environment-variable substitution. Convert the captured responses into regression assertions with one click.
→ Postman Collection-Runner parity · HAR export · Newman-style assertions
AI agent builders
MCP adapter · Claude / Cursor / Copilot
You're wiring an AI agent up to internal services. Bowire's MCP adapter exposes every discovered method as an MCP tool with JSON Schema input — without writing the MCP server boilerplate yourself. Drop the URL into your agent config and your assistant has typed access to your service surface.
→ --enable-mcp-adapter · auto-tool generation · streaming support
Documentation teams
interactive docs · live examples · code export
You're writing API docs and you want every example to be runnable without a curl-paste-and-pray loop. Embed Bowire next to your written guides — readers click a method, edit the JSON, hit Send, see the actual response. Export the call as curl, grpcurl, or a typed C# / TypeScript snippet.
→ Live examples · per-language code export · embedded in your own docs site
Security engineers
scan · SARIF · intercepting proxy · templates
You're auditing an API surface that spans gRPC, GraphQL, MQTT, SignalR — protocols where Burp Suite and ZAP stop being useful. Recordings double as vulnerability templates; bowire scan replays each one against the target, emits SARIF for GitHub Code Scanning / GitLab / Azure DevOps, and the intercepting proxy with HTTPS MITM captures live traffic the way you're used to.
→ bowire scan · SARIF 2.1.0 · CA-trusted proxy · JWT toolkit
DevOps & platform engineers
CI/CD container · scan · mock · fuzz
You're wiring the CI/CD pipeline. Bowire ships as a single binary + Docker image that drops into any runner — bowire scan as a SAST gate, bowire mock spun up as an integration-test fixture for ephemeral environments, bowire fuzz as a security-regression step. Real exit codes, native SARIF output, no translation layer between the runner and your Code-Scanning surface.
→ bowire scan · bowire mock · bowire fuzz · GitHub Actions / GitLab CI / Azure DevOps
For another workflow: join the crew
Pick the right tool
Postman, Scalar, Swashbuckle, Insomnia, Bruno — every API tool has its sweet spot.
Here's where Bowire lands.
Shell tools (curl, HTTPie) aren’t listed — Bowire exports every call as a curl snippet when you need one.
Pick a tool above to see when it fits better than Bowire — and when Bowire is the right call.
Bowire vs. Postman
Pick Postman when a distributed team collaborates on curated API collections in the cloud, your stack is primarily REST / GraphQL / WebSocket, and features like Agent Mode, Public Workspaces, and seat-based sync are worth the account + subscription.
Pick Bowire when you need more protocols (gRPC streaming, SignalR, MCP, MQTT, Socket.IO, OData, …) in one workbench, want local-first (no Kong/Postman account, no cloud), or need the UI embedded in your ASP.NET service for ops teams.
Bowire vs. Scalar
Pick Scalar when your workflow is spec-first: an openapi.yaml / swagger.json is the source of truth, server + clients are generated from it, and you want a polished public docs site with a built-in Try-it console. Scalar reads the spec and renders it beautifully — great fit for contract-first REST APIs where the contract is designed before implementation.
Pick Bowire when the direction is reversed: a running server is the source of truth and Bowire discovers the contract at runtime (gRPC reflection, the OpenAPI document the server emits, SignalR hub enumeration, GraphQL introspection, …). Bowire lands one workbench across every protocol your service actually speaks — not only REST — and embeds directly inside the ASP.NET app instead of being a separate hosted site.
Bowire vs. Swashbuckle / Microsoft.AspNetCore.OpenApi
Pick Swashbuckle (or Microsoft’s new built-in OpenAPI in .NET 9+) when pre-built / offline generation and distribution of OpenAPI specs is enough for your workflow. Note that Swagger UI itself is legacy — Scalar or Bowire make a simple migration path, both consume the same OpenAPI document you already emit.
Pick Bowire when the same service exposes gRPC, SignalR, WebSocket, MCP, or other protocols alongside REST. Bowire reads the OpenAPI document you already generate and layers every other protocol on top — one workbench instead of five different tools.
Bowire vs. Insomnia
Pick Insomnia when you want a solid local-first desktop client for REST / GraphQL / gRPC / WebSocket, and you’re fine with Kong’s account layer for Sync, Teams, and the Dev Portal.
Pick Bowire when you also need SignalR, MCP, MQTT, Socket.IO, OData, or custom protocols, or when you want the workbench embedded in your ASP.NET service instead of running a separate desktop app. No Kong account required for anything.
Bowire vs. Bruno
Pick Bruno when Git-native collections are your priority — REST / GraphQL / basic gRPC with .bru files committed to your repo. No cloud, no account, just text files reviewed like code.
Pick Bowire when you need gRPC streaming, GraphQL subscriptions, SignalR hubs, MQTT topics, Socket.IO, or the workbench embedded in your ASP.NET service.
Bowire vs. gRPC UI / grpcurl
Pick gRPC UI or grpcurl when you only care about gRPC and want a lightweight, single-purpose tool with minimal setup.
Pick Bowire when the same service exposes REST or SignalR alongside gRPC and you don’t want to switch tools mid-session. Bowire also has a Wireshark-style append-only streaming view that beats the chat-style drawer for long duplex sessions.
Dig into the details
The positioning above is the quick read. The table below is the exhaustive top-5-competitors check — useful when you're evaluating Bowire for a specific project.
- Full support
- Partial / limited (hover for details)
- Not supported
| Bowire | Postman | Scalar | Swashbuckle | Insomnia | Bruno | |
|---|---|---|---|---|---|---|
| 20+ | 7 | 1 | 1 | 5 | 4 | |
| gRPC | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ |
| REST / HTTP | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| SOAP | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| GraphQL | ✓ | ✓ | ✗ | ✗ | ✓ | partial |
| SignalR | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| MCP | ✓ | ✓ | ✗ | ✗ | client only | ✗ |
| JSON-RPC | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| SSE | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ |
| WebSocket | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ |
| MQTT | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| AMQP | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| NATS | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Socket.IO | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| OData | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| AsyncAPI | ✓ | partial | ✗ | ✗ | ✗ | ✗ |
| Surgewave | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Kafka | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Apache Pulsar | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| DIS (IEEE 1278) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| UDP (raw datagrams) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Akka.NET (mailbox tap) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| TacticalAPI (situational awareness) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| OTLP (OpenTelemetry listener) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Custom protocol plugins | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| ✓ | manual | OpenAPI | OpenAPI | manual | manual | |
| gRPC Reflection | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ |
| OpenAPI / Swagger import | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| GraphQL introspection | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ |
| Proto file loading | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ |
| Service catalogue (Consul / Kubernetes) | ✓ | paid cloud | ✗ | ✗ | ✗ | ✗ |
| Schema drift watch | ✓ | paid cloud | ✗ | ✗ | ✗ | ✗ |
| Embedded in ASP.NET app | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ |
| Standalone tool | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ |
| CLI mode | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ |
| ✓ | Enterprise (paid) | ✓ | ✓ | Enterprise (paid) | ✓ | |
| Docker image | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Compose manifest | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Kubernetes / Helm | planned | ✓ | ✓ | ✓ | ✓ | manual |
| Air-gapped install | ✓ | Enterprise (paid) | ✓ | ✓ | Enterprise (paid) | ✓ |
| SSO / SCIM | ✓ | Enterprise (paid) | Enterprise (paid) | ✗ | Enterprise (paid) | ✗ |
| Native .NET | ✓ | ✗ | via Scalar.AspNetCore | ✓ | ✗ | ✗ |
| ✓ | Collections | ✗ | ✗ | partial | ✗ | |
| Record session | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ |
| Replay against env | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ |
| HAR export | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ |
| Convert to test assertions | ✓ | ✓ | ✗ | ✗ | via Inso CLI | ✗ |
| Correlated multi-protocol timeline | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Native export format | .bwr | Collection JSON | ✗ | ✗ | Insomnia JSON | .bru |
| Replay as mock server | ✓ | Free tier | ✗ | ✗ | Free tier (1k req/mo) | ✗ |
| Mock from schema (no recording) | ✓ | examples | REST only | ✗ | ✗ | ✗ |
| Mock engine depth | ✓ | basic | ✗ | ✗ | basic | ✗ |
| Multiple duplex channels | ✓ | one at a time | ✗ | ✗ | one at a time | one at a time |
| ✓ | paid cloud | ✗ | ✗ | ✗ | ✗ | |
| Branching (if / else) | ✓ | paid cloud | ✗ | ✗ | ✗ | ✗ |
| Loops | ✓ | paid cloud | ✗ | ✗ | ✗ | ✗ |
| Delays / wait steps | ✓ | paid cloud | ✗ | ✗ | ✗ | ✗ |
| Variable forwarding | ✓ | paid cloud | ✗ | ✗ | ✗ | ✗ |
| Per-step assertions | ✓ | paid cloud | ✗ | ✗ | ✗ | ✗ |
| Performance / load testing | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| CI test runner (JUnit / SARIF / HTML) | ✓ | ✓ | ✗ | ✗ | Inso CLI | ✓ |
| Contract testing (consumer / provider) | ✓ | schema checks | ✗ | ✗ | ✗ | ✗ |
| Snapshot testing | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Data-driven test runs | ✓ | ✓ | ✗ | ✗ | Inso CLI | CLI |
| Endpoint test coverage | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Security scanning | ✓ OWASP API Top 10 | secrets + governance | ✗ | ✗ | ✗ | ✗ |
| Out-of-band (OAST) detection | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| API monitoring / scheduled probes | ✓ local | cloud | ✗ | ✗ | ✗ | ✗ |
| Traffic interception / reverse proxy | ✓ | capture only | ✗ | ✗ | ✗ | ✗ |
| AI assistant (local-first, BYOK) | ✓ | cloud | ✗ | ✗ | ✗ | ✗ |
| Local-first, no account | ✓ | account required | cloud-hosted | ✓ | ✓ | ✓ |
| Git-native workspace | ✓ | ✓ | ✗ | ✗ | Git Sync (cloud) | ✓ |
| internal ✓ / public via Registry | Public Workspaces | ✓ | Swagger UI | partial | ✗ | |
| Hosted docs page | ✗ | ✓ | ✓ | ✓ | Kong portal | ✗ |
| Custom domain | ✗ | Enterprise (paid) | Pro (paid) | ✓ | ✗ | ✗ |
| Try-It-Out widget | via client | ✓ | ✓ | ✓ | ✗ | ✗ |
| API versioning | via Surgewave Registry | ✓ | Pro (paid) | manual | ✗ | ✗ |
| Catalog / search | ✓ built-in | Public API Network | ✓ | ✗ | ✗ | ✗ |
| ✓ every protocol | REST only | REST docs only | ✗ | client only | ✗ | |
| Tools capability | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Resources capability | ✓ | ✓ | docs-as-resources | ✗ | ✗ | ✗ |
| Prompts capability | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| stdio transport | ✓ | ✓ | ✗ | ✗ | client only | ✗ |
| Streamable HTTP transport | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| ✓ 15 tools | ✓ | ✗ | ✗ | ✗ | ✗ | |
| Recording start / stop | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Environment list | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Replay execute | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Mock spin-up | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Collection / workspace mgmt | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ |
| License | Apache 2.0 | Proprietary | MIT | MIT | Apache 2.0 (core only!) | MIT |
| Price | Free | Freemium | Freemium | Free | Freemium | Free |
Comparison reflects the public feature matrix as of 2026-08. Postman, Scalar, Swashbuckle, Insomnia and Bruno are excellent tools in their own niches — Bowire is designed for the .NET ecosystem and devs who want every protocol in one place, embeddable into their own service, with zero account walls.
Spotted something wrong? Tools move fast — if we’ve misrepresented a feature or missed one that has since shipped, please open an issue and we’ll update the matrix.
Below decks: tour every feature →
On course
A short look at what just landed — and what’s on the way.
The Security pillar v2.3
bowire scan runs the full OWASP API Security Top 10 — 10/10, with protocol-specific probes for GraphQL, gRPC, WebSocket, SSE, MQTT and MCP — plus an opt-in active attack tier and a complete out-of-band (OAST) chain with a self-hosted bowire oast serve catcher. The Monitoring rail runs saved recordings as scheduled health probes with Slack / PagerDuty / OTLP signalers.
The Dev pillar v2.4
Mock-from-schema without a recording, the schema-watch diff that shows what moved in your API while you were away, side-by-side service compare across two versions or deployments, the correlated multi-protocol timeline for recordings — and CLI / UI / MCP parity, so every capability is reachable from all three.
The CI pillar v2.5
Design-time lint reads the discovered surface for design smells — PII in responses, unbounded collections, missing versioning. Latency gates and a contract matrix turn a run into a pass/fail a pipeline can act on, one rollup puts every signal on one page, and the workbench arrives in your editor as a VS Code extension.
Multi-tenancy v2.6
One Bowire, several authenticated passengers. Point it at any OIDC provider and every identity gets its own slot on disk — workspaces, recordings, collections, plugin settings — with SCIM 2.0 provisioning keeping the roster in step and per-user plugins so one person’s install is not everybody’s.
The map you can read v2.7
The map widget stops being a scatter of dots: trajectory LineStrings join an entity’s frames into a path, per-entity grouping tells thirteen contacts apart by their own identity rather than merging them, and a time cursor with playback rewinds a stream you already collected. Alongside it, the gRPC plugin reaches a server with Server Reflection switched off — the state Bowire’s own scanner recommends — and the scanner learns three failures that survive every “is it public?” check.
Now: workbench UX polish v2.8
Underway. The freeform builder already landed — schema-free ad-hoc REST, URL and verb and body, for the endpoint that has no schema to discover. Still ahead: a header library of named, scoped, toggleable header sets; i18n with German and English catalogues; a within-tab and cross-tab split layout; and a visual shelf for dragging fragments between surfaces.
MCP completion + agent hub v2.9
The remaining MCP tools and adapter modes, server-side notifications through the SDK’s handlers, and the agent hub — embedded Bowire instances registering with a central hub so an agent can find them.
Cleanups + breaking-change cuts v3.0
The version where deprecated shapes come out rather than accumulate — among them the ${name} variable syntax that replaced.
Nothing on this list is a commitment — Bowire is built in the open, and priorities shift with what users actually hit in practice. If something here matters to you, file an issue or start a discussion.
Chart the course: roadmap on GitHub →
Join the crew
Bowire is Apache 2.0 and developed publicly on GitHub. Issues, pull requests, and the roadmap live in one place — all visible, all welcome.
All hands on deck: every community channel →
No paid tier, no account wall, no telemetry. Fork it, audit it, embed it.
Set sail. Discover APIs.