Systems | Development | Analytics | API | Testing

When I ask an AI agent to change code, I also want it to run the application and test what it changed. Asking it to write some tests is a start. But if it invents the expected responses from the same assumptions it used to write the code, those tests can miss the same mistake. Traffic replay gives the agent something concrete to test against: requests and responses captured from a working application.

In Under the Hood with Go TLS and eBPF, I left socket tracking as an exercise for later. The example used bpf_get_current_pid_tgid() and explicitly excluded concurrent TLS operations. Capturing plaintext was enough for that post. With rustls, later arrived: I could read the HTTP payload perfectly and still attach it to the wrong TCP connection. That’s a frustratingly convincing failure. The request looks right. The response looks right. The application works.

OpenTelemetry graduated from the CNCF in May 2026 as, in the foundation’s own words, the de facto observability standard. The JavaScript API package alone did 1.36 billion downloads in twelve months. That kind of win has a side effect nobody plans for. Once a wire format is everywhere, has a receiver for every source, a transform language, and an agent your platform team already operates, people start putting things on it that have nothing to do with knowing whether a service is healthy.

Detecting API performance issues before they impact users is the difference between APIs that scale reliably and those that quietly erode user trust. When users encounter lag, failed requests, or timeouts, the consequences are immediate: lost transactions, customer frustration, and brand damage. Teams that build scalable APIs recognize that performance is not just a technical metric – it’s fundamental to business health and reputation.

Kong AI Gateway already gives platform teams a central place to route, observe, and enforce policy across AI traffic. Security teams working alongside those platform teams often need another set of answers: Which agents are connected? Which attack paths actually succeed against them? What happened across the full session or tool chain? And if an agent is compromised, can its next action be stopped before it reaches an enterprise system? The integration is designed to be complementary.

Bruno is an open source, offline-first API client that stores your API collections as plain text files inside your Git repo. It gives you a fast GUI for building and sending REST, GraphQL, gRPC, and WebSocket requests, plus a scripting layer for writing tests against the responses. This guide covers Bruno API testing from install to CI, so by the end you can build a request, assert on its response, and run the whole suite from the command line.

Service virtualization replaces real external dependencies (APIs, databases, queues, or third-party services) with controlled simulations that respond like the real thing. Tests run against these virtual services whether the real dependency is unavailable, expensive to call, or still being built. Keploy implements this by capturing real dependency interactions from live traffic and replaying them automatically in CI.