
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@postman/postman-mcp-server
Advanced tools
This project offers the following Model Context Protocol (MCP) server options:
For more information about the available transports, see the MCP specification.
This is a lightweight solution that's ideal for integration with editors and tools like VS Code.
For Docker set up and installation, see DOCKER.md.
Note: By default, this server provides 37 tools (minimal mode). Use the
--fullflag to access all 106 tools. Use the--regionflag to specify the Postman API region (usoreu), or set thePOSTMAN_API_BASE_URLenvironment variable directly.
Integrate your MCP server with Visual Studio Code and use it with VS Code extensions that support MCP. To do this, do the following:
Create a .vscode/mcp.json file in your project and enter the following:
{
"servers": {
"postman-api-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"@postman/postman-mcp-server",
"--full" // (optional) Use this flag to enable full mode
],
"env": {
"POSTMAN_API_KEY": "${input:postman-api-key}"
}
}
},
"inputs": [
{
"id": "postman-api-key",
"type": "promptString",
"description": "Enter your Postman API key"
}
]
}
Install an MCP-compatible VS Code extension, such as GitHub Copilot, Claude for VS Code, or other AI assistants that support MCP.
Configure the extension to use the postman-api-mcp server, a local STDIO-based server that runs directly from your project files:
npm install command. This installs all the required dependencies.${workspaceFolder} in the mcp.json file with the full path to the Postman MCP repository.To integrate the MCP server with Claude, check the latest Postman MCP server release and download one of the following .dxt files:
For more information, see Anthropic's Claude Desktop Extensions documentation.
The streamable HTTP version is available at https://mcp.postman.com. It supports two tool configurations to better serve different use cases:
https://mcp.postman.com/minimal. This offers faster performance and simplifies use for those who only need basic Postman operations.https://mcp.postman.com/mcp.Note: The streamable EU HTTP server is available at
https://mcp.eu.postman.com.
To integrate the MCP server with Cursor, click the following button:
Ensure the Authorization header uses the Bearer <YOUR_API_KEY> format.
By default, the server provides 37 tools. Use Full (
https://mcp.postman.com/mcp) mode to access all 106 tools.
To install in VS Code, you can use the Postman VS Code Extension. Or you can add the following to the .vscode/mcp.json file:
{
"servers": {
"postman-api-http-server": {
"type": "http",
"url": "https://mcp.postman.com/{minimal | mcp}", // choose "minimal" or "mcp"
"headers": {
"Authorization": "Bearer ${input:postman-api-key}"
}
}
},
"inputs": [
{
"id": "postman-api-key",
"type": "promptString",
"description": "Enter your Postman API key"
}
]
}
When prompted, enter your Postman API key. Afterwards, the agent performs calls to the Postman cloud MCP server at https://mcp.postman.com.
create-collection → createCollectionget-workspaces → getWorkspacesdelete-environment → deleteEnvironment--full flag provides access to all 106 tools.FAQs
A simple MCP server to operate on the Postman API
The npm package @postman/postman-mcp-server receives a total of 651 weekly downloads. As such, @postman/postman-mcp-server popularity was classified as not popular.
We found that @postman/postman-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.