
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
@postman/postman-mcp-server
Advanced tools
This project offers the following Model Context Protocol (MCP) server options:
For more information about the available transports, see the MCP specification.
This is a lightweight solution that's ideal for integration with editors and tools like VS Code.
For Docker set up and installation, see DOCKER.md.
Note: By default, this server provides 37 tools (minimal mode). Use the
--fullflag to access all 106 tools.
Integrate your MCP server with Visual Studio Code and use it with VS Code extensions that support MCP. To do this, do the following:
Create a .vscode/mcp.json file in your project and enter the following:
{
"servers": {
"postman-api-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"@postman/postman-mcp-server",
"--full" // (optional) Use this flag to enable full mode
],
"env": {
"POSTMAN_API_KEY": "${input:postman-api-key}"
}
}
},
"inputs": [
{
"id": "postman-api-key",
"type": "promptString",
"description": "Enter your Postman API key"
}
]
}
Install an MCP-compatible VS Code extension, such as GitHub Copilot, Claude for VS Code, or other AI assistants that support MCP.
Configure the extension to use the postman-api-mcp server, a local STDIO-based server that runs directly from your project files:
npm install command. This installs all the required dependencies.${workspaceFolder} in the mcp.json file with the full path to the Postman MCP repository.To integrate the MCP server with Claude, check the latest Postman MCP server release and download one of the available .dxt files:
For more information, see Anthropic's Claude Desktop Extensions documentation.
The streamable HTTP version is available at https://mcp.postman.com. It supports two tool configurations to better serve different use cases:
https://mcp.postman.com/minimal. This offers faster performance and simplifies use for those who only need basic Postman operations.https://mcp.postman.com/mcp.To integrate the MCP server with Cursor, click the following button:
Ensure the Authorization header uses the Bearer <YOUR_API_KEY> format.
By default, the server provides 37 tools. Use Full (
https://mcp.postman.com/mcp) mode to access all 106 tools.
To install in VS Code, you can use the Postman VS Code Extension. Or you can add the following to the .vscode/mcp.json file:
{
"servers": {
"postman-api-http-server": {
"type": "http",
"url": "https://mcp.postman.com/{minimal | mcp}", // choose "minimal" or "mcp"
"headers": {
"Authorization": "Bearer ${input:postman-api-key}"
}
}
},
"inputs": [
{
"id": "postman-api-key",
"type": "promptString",
"description": "Enter your Postman API key"
}
]
}
When prompted, enter your Postman API key. Afterwards, the agent performs calls to the Postman cloud MCP server at https://mcp.postman.com.
create-collection → createCollectionget-workspaces → getWorkspacesdelete-environment → deleteEnvironment--full flag provides access to all 106 tools.FAQs
A simple MCP server to operate on the Postman API
The npm package @postman/postman-mcp-server receives a total of 1,374 weekly downloads. As such, @postman/postman-mcp-server popularity was classified as popular.
We found that @postman/postman-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.