DEVELOPMENT WORKFLOW / Postman
Postman MCP
Connects assistants to Postman collections, workspaces and environments through selectable tool sets.
“The Postman MCP Server implements the Model Context Protocol (MCP) to connect AI agents and coding assistants — including Claude Code, Cursor, VS Code Copilot, GitHub Copilot CLI, and Gemini CLI — directly to your Postman workspaces, collections, specifications, and environments.”
01 / THE REASONING
Why this made the selection.
- Offers Minimal, Code and Full configurations so users can select the relevant API workflow.
- Documents a hosted OAuth path and a separate local API-key path for environments that need local API reachability.
- The pinned README connects an agent to Postman workspaces, collections, specs, and environments, with Minimal as the default tool set.
- The EU and local servers take an API key only, and the remote server cannot reach APIs on the workstation.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- README.md, package.json and LICENSE
- src/index.ts, src/enabledResources.ts, src/env.ts and telemetry flag handling
- Published npm metadata
- 2026-10-14 reread of retained pinned setup/configuration evidence for the specific operational details added in this batch.
- README.md
- LICENSE
Our findings
- The default tool configuration is Minimal; its documented purpose includes modifying collections, workspaces and environments.
- Pinned README supplies exact mode endpoints, EU authentication differences and local-region controls. Published implementation is synced from an internal source; documentation review is not hosted/source parity proof.
- The server reaches Postman workspaces, collections, specifications, and environments. Minimal is the default and is limited to essential tools.
- OAuth is the recommended remote login at mcp.postman.com. The EU remote server and the local server accept only a Postman API key.
- The README says the remote server will not have network access to the workstation, so local API tests need the local server.
Not established by this review
- No MCP server or upstream package was installed or run.
- No authenticated account, client handshake, query, write operation or security test was performed.
- No authenticated session, installation, permission bypass or package-to-source parity test was performed.
- The server was not started and its tools were not called.
- A pin does not verify transitive dependencies.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
DOCUMENTED COMMAND
npx @postman/postman-mcp-serverCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The command above is the README's local stdio server. It needs POSTMAN_API_KEY in the environment; add --code or --full for those tool sets. It was not run.
- For the hosted path, add https://mcp.postman.com/minimal as a remote HTTP server in an OAuth-capable client, complete account authorization and inspect the exposed tool list before use.
- The EU remote server and the local server accept only a Postman API key. Store it in the client environment, not in a chat message.
Before you start
- A Postman account with access to the selected workspace
- Node.js 20 or later and a Postman API key for the local server, or an OAuth-capable remote MCP client for the hosted US endpoint
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/PostmanLabs/postman-mcp-server/blob/9542e557a5592af2d7a2979e6884695576f1609a/README.md
Supports: summary, upstreamDescription, whySelected, bestFor, install, compatibility, transports, limitations, access, review, configExample
https://github.com/PostmanLabs/postman-mcp-server/blob/9542e557a5592af2d7a2979e6884695576f1609a/LICENSE
Supports: license, access.cost