Modern Python services are distributed across dozens of external HTTP APIs. Testing them reliably shouldn't require compromising on security or fighting fragile socket monkey-patchers.
For over a decade, Python engineers relied on tools like `vcrpy` to mock HTTP traffic. But those libraries were designed in the Python 2 era. They work by monkey-patching Python's global `socket` module and modifying low-level `urllib3` connection pools.
In modern Python 3.11+ codebases using asynchronous event loops, HTTP/2 multiplexing, and concurrent worker threads, global socket mutation leads to bizarre side effects, test pollution, and hard-to-diagnose concurrency deadlocks.
Even worse: legacy tools frequently persist raw `Authorization` headers and live API keys into fixture files, creating constant security risks when repositories are committed to Git.
Instead of mutating global sockets, VEXFOX cleanly intercepts calls at the HTTPX transport boundary (`BaseTransport` and `AsyncBaseTransport`). Other libraries in your process remain completely unaffected.
Credentials never touch disk unredacted. Bearer tokens, OpenAI keys, Stripe secrets, cookies, and basic auth URLs are replaced with `[REDACTED]` prior to JSON serialization.
Requests match on real HTTP semantics: normalized URLs, order-insensitive query parameters, and parsed JSON structures. Whitespace and key order changes don't break your tests.
Test execution state is isolated per thread and asyncio task using Python's standard `contextvars`, making parallel test runners like `pytest-xdist` reliable.
VEXFOX is released under the permissive MIT License.
The code is hosted publicly on GitHub. We encourage issues, feature requests, pull requests, and discussions on how to make HTTP testing in Python faster, safer, and completely deterministic.