--- title: "Postman MCP: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/mcp-servers/postman/ description: "Connects assistants to Postman collections, workspaces and environments through selectable tool sets." --- # Postman MCP: review, setup & limitations · Undominated.ai > Connects assistants to Postman collections, workspaces and environments through selectable tool sets. [← Explore all mcp servers](/mcp-servers/) DEVELOPMENT WORKFLOW / Postman # Postman MCP Connects assistants to Postman collections, workspaces and environments through selectable tool sets. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/PostmanLabs/postman-mcp-server) SOURCE REVIEW Reviewed 2026-10-14 Evidence 2 linked sources Publisher Postman Licence [Apache-2.0 ↗](https://github.com/PostmanLabs/postman-mcp-server/blob/9542e557a5592af2d7a2979e6884695576f1609a/LICENSE) Revision 9542e557a559 [Read what was—and wasn’t—checked ↓](#review) “The Postman MCP Server implements the Model Context Protocol (MCP) to connect AI agents and coding assistants — including Claude Code, Cursor, VS Code Copilot, GitHub Copilot CLI, and Gemini CLI — directly to your Postman workspaces, collections, specifications, and environments.” [Postman · upstream description ↗](https://github.com/PostmanLabs/postman-mcp-server/blob/9542e557a5592af2d7a2979e6884695576f1609a/README.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Offers Minimal, Code and Full configurations so users can select the relevant API workflow. - Documents a hosted OAuth path and a separate local API-key path for environments that need local API reachability. - The pinned README connects an agent to Postman workspaces, collections, specs, and environments, with Minimal as the default tool set. - The EU and local servers take an API key only, and the remote server cannot reach APIs on the workstation. ### A good fit for - Inspect one collection/specification and propose a bounded update with workspace identity preserved. - Generate client code from an API definition, then validate it against the intended environment separately. - Editing one Postman collection or environment through the default Minimal configuration - Generating client code from an API definition with the Code configuration ### Weigh up before choosing - Minimal means fewer tools, not read-only access; it includes operations that modify Postman elements. - The hosted US endpoint supports OAuth. The documented EU and local paths require API-key authentication. - Collection execution can send requests and run associated scripts. A hosted server cannot reach private workstation endpoints without an appropriate network path. - Mode selection changes the tool surface: minimal, code, full and learn serve different workflows. Minimal includes element mutation and is not an authorization role. - Local EU mode uses --region eu or POSTMAN_API_BASE_URL; do not carry a US endpoint assumption into an EU-configured account. - Full mode is the large tool set, not the default. - OAuth is not available on the EU server. - Local API testing has to use the local server. - A pin does not verify transitive dependencies. - This review did not execute the resource. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - README.md, package.json and LICENSE - src/index.ts, src/enabledResources.ts, src/env.ts and telemetry flag handling - Published npm metadata - 2026-10-14 reread of retained pinned setup/configuration evidence for the specific operational details added in this batch. - README.md - LICENSE ### Our findings - The default tool configuration is Minimal; its documented purpose includes modifying collections, workspaces and environments. - Pinned README supplies exact mode endpoints, EU authentication differences and local-region controls. Published implementation is synced from an internal source; documentation review is not hosted/source parity proof. - The server reaches Postman workspaces, collections, specifications, and environments. Minimal is the default and is limited to essential tools. - OAuth is the recommended remote login at mcp.postman.com. The EU remote server and the local server accept only a Postman API key. - The README says the remote server will not have network access to the workstation, so local API tests need the local server. ### Not established by this review - No MCP server or upstream package was installed or run. - No authenticated account, client handshake, query, write operation or security test was performed. - No authenticated session, installation, permission bypass or package-to-source parity test was performed. - The server was not started and its tools were not called. - A pin does not verify transitive dependencies. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Connect a server deliberately. [Upstream setup instructions ↗](https://github.com/PostmanLabs/postman-mcp-server/blob/9542e557a5592af2d7a2979e6884695576f1609a/README.md) DOCUMENTED COMMAND npx @postman/postman-mcp-server Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The command above is the README's local stdio server. It needs POSTMAN_API_KEY in the environment; add --code or --full for those tool sets. It was not run. - For the hosted path, add https://mcp.postman.com/minimal as a remote HTTP server in an OAuth-capable client, complete account authorization and inspect the exposed tool list before use. - The EU remote server and the local server accept only a Postman API key. Store it in the client environment, not in a chat message. ### Before you start - A Postman account with access to the selected workspace - Node.js 20 or later and a Postman API key for the local server, or an OAuth-capable remote MCP client for the hosted US endpoint ### Compatibility Remote MCP clients ### Implementation TypeScript ### Transports Streamable HTTP · stdio ### Account-scoped MCP integration - Read or modify Postman data permitted by the connected account - Collection runs send requests to selected APIs and may have external side effects ### Cost model Apache-licensed local server; Postman account entitlements, API calls and assistant usage remain separate. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Official setup and capabilities ↗](https://github.com/PostmanLabs/postman-mcp-server/blob/9542e557a5592af2d7a2979e6884695576f1609a/README.md) Checked 2026-10-14 https://github.com/PostmanLabs/postman-mcp-server/blob/9542e557a5592af2d7a2979e6884695576f1609a/README.md Supports: summary, upstreamDescription, whySelected, bestFor, install, compatibility, transports, limitations, access, review, configExample - [Licence at reviewed source revision ↗](https://github.com/PostmanLabs/postman-mcp-server/blob/9542e557a5592af2d7a2979e6884695576f1609a/LICENSE) Checked 2026-10-07 https://github.com/PostmanLabs/postman-mcp-server/blob/9542e557a5592af2d7a2979e6884695576f1609a/LICENSE Supports: license, access.cost KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Apollo MCP Server ↗ Exposes a chosen set of GraphQL operations as MCP tools backed by an existing graph.](/mcp-servers/apollo/)[### CircleCI MCP ↗ Inspects CircleCI pipeline failures and performs explicitly authorized workflow actions through its hosted MCP service.](/mcp-servers/circleci/)[### Buildkite MCP server ↗ Exposes Buildkite pipelines, builds, jobs, and tests to an MCP client, locally or through Buildkite's remote server.](/mcp-servers/buildkite-mcp-server/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Inspect resource evidence](/tools/) - [Choose a host](/agents/) - [Inspect reusable workflows](/skills/) - [Use Undominated data](/api/)