
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@cocaxcode/api-testing-mcp
Advanced tools
MCP server para testing de APIs. Ligero, local, sin dependencias cloud.
MCP server for API testing. Lightweight, local, zero cloud dependencies.
Test your APIs directly from Claude Code, Claude Desktop, Cursor, or any MCP client — without leaving your workflow.
{{VARIABLE}} in URLs, headers, and bodyAdd to your claude_desktop_config.json:
{
"mcpServers": {
"api-testing": {
"command": "npx",
"args": ["-y", "@cocaxcode/api-testing-mcp"]
}
}
}
claude mcp add api-testing -- npx -y @cocaxcode/api-testing-mcp
{
"mcpServers": {
"api-testing": {
"command": "npx",
"args": ["-y", "@cocaxcode/api-testing-mcp"],
"env": {
"API_TESTING_DIR": "/path/to/your/.api-testing"
}
}
}
}
requestExecute an HTTP request with optional authentication and variable interpolation.
Relative URLs (starting with /) automatically use BASE_URL from the active environment — no need to write {{BASE_URL}} every time.
// Relative URL — auto-prepends BASE_URL from active environment
request({ method: "GET", url: "/api/users" })
// Equivalent to:
request({ method: "GET", url: "{{BASE_URL}}/api/users" })
// Full example with all options
request({
method: "GET",
url: "/api/users",
headers: { "Authorization": "Bearer {{TOKEN}}" },
query: { "page": "1" },
timeout: 5000
})
Auth examples:
// Bearer token
request({ method: "GET", url: "...", auth: { type: "bearer", token: "abc123" } })
// API Key
request({ method: "GET", url: "...", auth: { type: "api-key", key: "mykey", header: "X-API-Key" } })
// Basic Auth
request({ method: "GET", url: "...", auth: { type: "basic", username: "user", password: "pass" } })
Response format:
{
"status": 200,
"statusText": "OK",
"headers": { "content-type": "application/json" },
"body": { "users": [] },
"timing": { "total_ms": 142.35 },
"size_bytes": 1024
}
collection_saveSave a request to your local collection for reuse.
collection_save({
name: "get-users",
request: { method: "GET", url: "https://api.example.com/users" },
tags: ["users", "read"]
})
collection_listList all saved requests. Optionally filter by tag.
collection_list({ tag: "users" })
collection_getGet the full details of a saved request.
collection_get({ name: "get-users" })
collection_deleteDelete a saved request from the collection.
collection_delete({ name: "get-users" })
env_createCreate a new environment with optional initial variables.
env_create({
name: "dev",
variables: { "BASE_URL": "http://localhost:3000", "TOKEN": "dev-token" }
})
env_listList all environments and which one is active.
env_setSet a variable in an environment (defaults to active environment).
env_set({ key: "TOKEN", value: "new-token-value" })
env_getGet a specific variable or all variables from an environment.
env_get({ key: "BASE_URL" })
env_get({}) // returns all variables
env_switchSwitch the active environment. Active environment variables are used for {{interpolation}}.
env_switch({ name: "prod" })
All data is stored locally as JSON files in .api-testing/ (in your current working directory by default):
.api-testing/
├── active-env # Name of the active environment
├── collections/
│ ├── get-users.json
│ └── create-post.json
└── environments/
├── dev.json
└── prod.json
You can version these files in git if you want to share collections and environments with your team.
git clone https://github.com/cocaxcode/api-testing-mcp.git
cd api-testing-mcp
npm install
npm test
npm run build
npx @modelcontextprotocol/inspector node dist/index.js
MIT
FAQs
The most complete MCP server for API testing. 36 tools: HTTP requests (with token-optimized responses), assertions, request flows, OpenAPI import, mock data, load testing, collections, environments, native export/import, Postman import/export, cURL export
The npm package @cocaxcode/api-testing-mcp receives a total of 123 weekly downloads. As such, @cocaxcode/api-testing-mcp popularity was classified as not popular.
We found that @cocaxcode/api-testing-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.