diff --git a/package.json b/package.json
index 96273cf..80297f7 100644
--- a/package.json
+++ b/package.json
@@ -10,6 +10,9 @@
     "type": "git",
     "url": "https://github.com/klokantech/tileserver-gl.git"
   },
+  "scripts": {
+    "test": "mocha test/**.js"
+  },
   "dependencies": {
     "async": "1.5.2",
     "advanced-pool": "0.3.1",
@@ -23,5 +26,10 @@
     "request": "2.69.0",
     "sharp": "0.13.1",
     "sphericalmercator": "1.0.4"
+  },
+  "devDependencies": {
+    "should": "^8.2.2",
+    "mocha": "^2.4.5",
+    "supertest": "^1.2.0"
   }
 }
diff --git a/src/serve_raster.js b/src/serve_raster.js
index 8238143..2a90aca 100644
--- a/src/serve_raster.js
+++ b/src/serve_raster.js
@@ -246,6 +246,10 @@ module.exports = function(maps, options, prefix) {
         y = req.params.y | 0,
         scale = getScale(req.params.scale),
         format = req.params.format;
+    if (z < 0 || x < 0 || y < 0 ||
+        z > 20 || x >= Math.pow(2, z) || y >= Math.pow(2, z)) {
+      return res.status(404).send('Out of bounds');
+    }
     var tileSize = 256;
     var tileCenter = mercator.ll([
       ((x + 0.5) / (1 << z)) * (256 << z),
diff --git a/test/metadata.js b/test/metadata.js
new file mode 100644
index 0000000..71c1bd8
--- /dev/null
+++ b/test/metadata.js
@@ -0,0 +1,19 @@
+describe('Metadata', function() {
+  describe('/index.json', function() {
+    it('is json', function(done) {
+      supertest(app)
+        .get('/index.json')
+        .expect(200)
+        .expect('Content-Type', /application\/json/, done);
+    });
+
+    it('is non-empty array', function(done) {
+      supertest(app)
+        .get('/index.json')
+        .expect(function(res) {
+          res.body.should.be.Array();
+          res.body.length.should.be.greaterThan(0);
+        }).end(done);
+    });
+  });
+});
diff --git a/test/setup.js b/test/setup.js
new file mode 100644
index 0000000..d2182a3
--- /dev/null
+++ b/test/setup.js
@@ -0,0 +1,20 @@
+process.env.NODE_ENV = 'test';
+
+global.should = require('should');
+global.supertest = require('supertest');
+
+before(function(done) {
+  console.log('global setup');
+  process.chdir('test_data');
+  var running = require('../src/server')({
+    config: 'config.json',
+    port: 8888
+  }, done);
+  global.app = running.app;
+  global.server = running.server;
+});
+
+after(function() {
+  console.log('global teardown');
+  global.server.close(function() { console.log('Done'); });
+});
diff --git a/test/tiles_raster.js b/test/tiles_raster.js
new file mode 100644
index 0000000..904d66f
--- /dev/null
+++ b/test/tiles_raster.js
@@ -0,0 +1,28 @@
+var testTile = function(prefix, z, x, y, format, status, type) {
+  var path = '/' + prefix + '/' + z + '/' + x + '/' + y + '.' + format;
+  it(path + ' returns ' + status, function(done) {
+    var test = supertest(app).get(path);
+    if (status) test.expect(status);
+    if (type) test.expect('Content-Type', type);
+    test.end(done);
+  });
+};
+
+describe('Raster tiles', function() {
+  describe('existing tiles', function() {
+    testTile('test', 0, 0, 0, 'png', 200, /image\/png/);
+    testTile('test', 0, 0, 0, 'jpg',  200, /image\/jpeg/);
+    testTile('test', 0, 0, 0, 'jpeg',  200, /image\/jpeg/);
+    testTile('test', 0, 0, 0, 'webp',  200, /image\/webp/);
+
+    testTile('test', 1, 1, 1, 'png', 200);
+  });
+
+  describe('error tiles', function() {
+    testTile('non_existent', 0, 0, 0, 'png', 404);
+    testTile('test', -1, 0, 0, 'png', 404);
+    testTile('test', 0, 1, 0, 'png', 404);
+    testTile('test', 0, 0, 1, 'png', 404);
+    testTile('test', 0, 0, 1, 'gif', 404);
+  });
+});