A basic MCP server to operate on the Postman API.
Remote endpoints: streamable-http: https://mcp.postman.com/mcp streamable-http: https://mcp.postman.com/minimal streamable-http: https://mcp.eu.postman.com/mcp streamable-http: https://mcp.eu.postman.com/minimal
The Postman MCP Server is a legitimate tool from Postman, Inc. with proper authentication mechanisms and reasonable code structure. It uses OAuth for remote servers and API key auth for local/EU servers, with credentials sourced from environment variables rather than hardcoded. However, the codebase contains some concerns: it accepts and processes user-supplied collection data with complex nested schemas that could be difficult to fully validate, relies on newman (a third-party testing library) for collection execution which could pose risks if untrusted collections are executed, and the code lacks comprehensive input validation for deeply nested collection structures. The permissions align well with the server's stated purpose of managing Postman workspaces and collections. Supply chain analysis found 3 known vulnerabilities in dependencies (1 critical, 0 high severity). Package verification found 1 issue.
4 files analyzed · 9 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: POSTMAN_API_KEY
Available as Local & Remote
This plugin can run on your machine or connect to a hosted endpoint. during install.
From the project's GitHub README.
The Postman MCP Server connects Postman to AI tools, giving AI agents and assistants the ability to access workspaces, manage collections and environments, evaluate APIs, and automate workflows through natural language interactions. Learn more on the Postman MCP Server product page.
Postman also offers the server as an npm package.
The Postman MCP Server collection is the quickest way to explore, test, and connect to the Postman MCP Server. Use it to:
For the best developer experience and fastest setup, use OAuth on the remote server (https://mcp.postman.com). OAuth is fully compliant with the MCP Authorization specification and requires no manual API key configuration.
The EU remote server and the local server support only Postman API key authentication.
Remote (any OAuth-compatible MCP host):
Add this URL to your MCP host's configuration:
https://mcp.postman.com/minimal
Change /minimal to /code or /mcp for Code or Full mode. For EU or API key auth, pass Authorization: Bearer <POSTMAN_API_KEY> as a header.
Local:
npx @postman/postman-mcp-server
Add --code or --full for Code or Full mode. Set POSTMAN_API_KEY as an environment variable.
For IDE-specific setup instructions, see the table below. For more information, see the Postman MCP Server docs.
| Agent / IDE | Remote | Local |
|---|---|---|
| Claude Code | Docs | Docs |
| Claude Desktop | — | Docs |
| Cursor | Docs | Docs |
| VS Code | Docs | Docs |
| Codex | Docs | Docs |
| Windsurf | Docs | Docs |
| Antigravity | Docs | Docs |
| GitHub Copilot CLI | Docs | Docs |
| Gemini CLI | Docs | Docs |
| Kiro | Docs | Docs |
| Docker | — | Docs |
The Postman MCP Server supports the EU region for remote and local servers:
https://mcp.eu.postman.com/mcp (Full), https://mcp.eu.postman.com/code, and https://mcp.eu.postman.com/minimal.--region eu flag, or set the POSTMAN_API_BASE_URL environment variable directly.For Docker setup and installation, see DOCKER.md.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.