postman-mcp-server

Name: postman-mcp-server
Author: postmanlabs

Issues

Postman MCP Server — connect AI agents (Claude Code, Cursor, VS Code Copilot, Gemini CLI) to your Postman collections, OpenAPI specs, and environments via Model Context Protocol (MCP)

308stars

84forks

TypeScript

Installation

# Add to your Claude Code skills
git clone https://github.com/postmanlabs/postman-mcp-server

Getting Started

Guides for using ai agents skills like postman-mcp-server.

Caveman: Cut Claude Token Use by 65%
How agent-side prompt compression works, when to use it, and when not to.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills

Security ReportIssues

Last scanned: 5/30/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "httpntlm: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "jose: jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "lodash: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "newman: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "node-forge: node-forge has ASN.1 Unbounded Recursion",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postman-collection: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "postman-collection-transformer: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "postman-request: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "postman-runtime: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postman-sandbox: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "serialised-error: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "underscore: Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "uvm: Vulnerability found",
      "severity": "high"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-05-30T15:22:17.005Z",
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

Frequently Asked Questions

What is postman-mcp-server?

postman-mcp-server is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by postmanlabs. Postman MCP Server — connect AI agents (Claude Code, Cursor, VS Code Copilot, Gemini CLI) to your Postman collections, OpenAPI specs, and environments via Model Context Protocol (MCP). It has 308 GitHub stars.

Is postman-mcp-server safe to use?

postman-mcp-server failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.

How do I install postman-mcp-server?

Clone the repository with "git clone https://github.com/postmanlabs/postman-mcp-server" and add it to your Claude Code skills directory (see the Installation section above).

What programming language is postman-mcp-server written in?

postman-mcp-server is primarily written in TypeScript. It is open-source under postmanlabs on GitHub, so you can review or fork the full source.

Are there alternatives to postman-mcp-server?

Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh postman-mcp-server against similar tools.

Agentic AI for Beginners

Build your first AI agent from scratch - tool use, ReAct pattern, memory, deployment

41 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

243,238

oneshot-gtm lovcode

Postman MCP Server

The Postman MCP Server implements the Model Context Protocol (MCP) to connect AI agents and coding assistants — including Claude Code, Cursor, VS Code Copilot, GitHub Copilot CLI, and Gemini CLI — directly to your Postman workspaces, collections, specifications, and environments.

Postman also offers the server as an npm package.

For the full installation guide with agent-specific setup, see Postman's MCP Server product page.

Postman MCP Server collection

The Postman MCP Server collection is the quickest way to explore, test, and connect to the Postman MCP Server. Use it to:

Browse the complete list of available tools across all configurations.
Connect to and test the remote server — Full and Minimal.
Connect to and test the local server.

Tool configurations

Minimal — (Default) Only includes essential tools for basic Postman operations. Ideal for users who want to modify a single Postman element, such as collections, workspaces, or environments.
Code — Includes tools to generate high-quality, well-organized client code from public and internal API definitions. Ideal for users who need to consume APIs or get API context to their agents.
Full — Includes all available Postman API tools (100+ tools). Ideal for users who engage in advanced collaboration and Postman's Enterprise features.
Learn — Searches Postman Docs for guides, tutorials, and reference content. Ideal for agents who need to discover Postman features, look up API concepts, or find learning resources.

Authentication

For the best developer experience and fastest setup, use OAuth on the remote server (https://mcp.postman.com). OAuth is fully compliant with the MCP Authorization specification and requires no manual API key configuration.

The EU remote server and the local server support only Postman API key authentication.

Quick start

Remote (any OAuth-compatible MCP host):

Add this URL to your MCP host's configuration:

https://mcp.postman.com/minimal

Change /minimal to /code or /mcp for Code or Full mode. For EU or API key auth, pass Authorization: Bearer <POSTMAN_API_KEY> as a header.

Local:

npx @postman/postman-mcp-server

Add --code or --full for Code or Full mode. Set POSTMAN_API_KEY as an environment variable.

For IDE-specific setup instructions, see the following table. For more information, see the Postman MCP Server docs.

Supported agents and IDEs

Agent / IDE	Remote	Local
Claude Code	Docs	Docs
Claude Desktop	Docs	Docs
Cursor	Docs	Docs
VS Code	Docs	Docs
Codex	Docs	Docs
Antigravity CLI	Docs	Docs
GitHub Copilot CLI	Docs	Docs
Kiro	Docs	Docs
Docker	—	Docs

EU support

The Postman MCP Server supports the EU region for remote and local servers:

For streamable HTTP, the remote server is available at https://mcp.eu.postman.com/mcp (Full), https://mcp.eu.postman.com/code, and https://mcp.eu.postman.com/minimal.
For the STDIO public package, use the --region eu flag, or set the POSTMAN_API_BASE_URL environment variable directly.
OAuth isn't supported for the EU server. The EU remote server only supports API key authentication.

Use cases

API Testing — Continuously test your API using your Postman collection. Use the local server to test local APIs, as the remote server won't have network access to your workstation.
Code synchronization — Keep your code in sync with your Postman Collections and specs.
Collection management — Create and tag collections, update documentation, add comments, or perform actions across multiple collections without leaving your editor.
Workspace and environment management — Create workspaces and environments, plus manage environment variables.
Automatic spec creation — Create specs from your code and use them to generate collections.
Client code generation — Generate production-ready client code that consumes APIs following best practices and project conventions.

Docker

For Docker setup and installation, see DOCKER.md.

Contributing

Bug reports, tool requests, and documentation fixes are all welcome — see CONTRIBUTING.md.

The MCP tool definitions and the server implementation here are synced from Postman's internal source of truth, so changes to files under src/ can't be merged in this repository — but issues are how those changes get made, and we credit contributions that ship. Documentation and repository tooling accept pull requests directly.

Found a security issue? See SECURITY.md — please don't open a public issue.

Questions and support

See Add your MCP requests to your collections to learn how to use Postman to perform MCP requests.
Visit the Postman Community to share what you've built, ask questions, and get help.
You can connect to both the remote and local servers and test them using the Postman MCP Server collection.
Report bugs and request tools in GitHub Issues. See SUPPORT.md for which channel fits your question.

Keywords

Model Context Protocol · MCP Server · Postman · AI Agents · Claude Code · Cursor · VS Code · Specifications · REST API · API Testing · TypeScript · OpenAPI