Postman MCP Server

Postman workspaces, collections, and environments within AI coding assistants.

Data last scanned today · Reviewed yesterday

58★ 285TypeScriptApache-2.0

Overview

The Postman MCP Server bridges AI agents with your Postman data, enabling direct access to workspaces, collections, and API environments. Compatible with platforms like Claude Code, Cursor, and VS Code, it allows your agent to interact with API definitions or retrieve documentation context directly from Postman. The server supports multiple modes based on your workflow needs. You can use the Minimal configuration for basic element modification, the Code mode for generating client code from API definitions, or the Full mode to access over 100 Postman API tools. Additionally, a Learn mode provides searchable access to Postman documentation for feature discovery.

Our verdict

This project holds a high risk level with a security score of 33/100. The primary security concern is that it lacks any authentication method for local installations, meaning anyone with access to the configuration file can execute commands. Furthermore, the server operates without a read-only mode, providing full write access upon installation. It is recommended for users who understand these local environment risks and are not managing highly sensitive API credentials.

Supports multiple configurations including Code and Full modes.
Small dependency footprint with only 6 direct packages.
Includes a public collection for testing and discovery.
Actively maintained with recent commit activity.

Lacks authentication methods for local server deployments.
Full write access granted by default with no read-only option.
Community-maintained and not an official vendor product.

Setup

Claude Desktop

{
  "mcpServers": {
    "postman-mcp-server": {
      "args": [
        "-y",
        "@postman/postman-mcp-server"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What authentication methods does the Postman MCP Server support?

The remote server at mcp.postman.com supports OAuth for a seamless experience. Both the EU remote server and the local server installation require a Postman API key for authentication.

›Which server configurations are available?

You can choose between Minimal, Code, Full, and Learn configurations, which offer varying sets of tools ranging from basic operations to advanced enterprise features and documentation searching.

›How do I run the server locally?

You can execute the server locally using the 'npx @postman/postman-mcp-server' command and must set your Postman API key as an environment variable.

›Can I use the Postman MCP Server with different feature sets locally?

Yes, you can enable specific tool sets by appending flags such as '--code' or '--full' when starting the server via the command line.