
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@postman/postman-mcp-server
Advanced tools
The Postman MCP Server connects Postman to AI tools, giving AI agents and assistants the ability to access workspaces, manage collections and environments, evaluate APIs, and automate workflows through natural language interactions.
Postman supports the following tool configurations:
Designed for developers who want to integrate their AI tools with Postman’s context and features. Supports quick natural language queries queries to advanced agent workflows.
The Postman MCP Server supports the EU region for remote and local servers:
https://mcp.eu.postman.com.--region flag to specify the Postman API region (us or eu), or set the POSTMAN_API_BASE_URL environment variable directly.The remote Postman MCP Server is hosted by Postman over streamable HTTP and provides the easiest method for getting started. If your MCP host doesn't support remote MCP servers, you can use the local Postman MCP Server.
The remote server supports the following tool configurations:
https://mcp.postman.com/minimal.https://mcp.postman.com/mcp.Note: The remote EU HTTP server is available at https://mcp.eu.postman.com.
Before getting started, make certain you have a valid Postman API Key.
To install the remote Postman MCP Server in Visual Studio Code, click the install button or use the Postman VS Code Extension.
Note: By default, the server provides 37 tools. Use full mode (https://mcp.postman.com/mcp) to access all 106 tools.
To manually configure the remote Postman MCP Server in VS Code, add the following JSON block to the .vscode/mcp.json file:
{
"servers": {
"postman-api-http-server": {
"type": "http",
"url": "https://mcp.postman.com/{minimal | mcp}", // use "minimal" (default) or "mcp" (full)
"headers": {
"Authorization": "Bearer ${input:postman-api-key}"
}
}
},
"inputs": [
{
"id": "postman-api-key",
"type": "promptString",
"description": "Enter your Postman API key"
}
]
}
When prompted, enter your Postman API key. Afterwards, the agent performs calls to the Postman cloud MCP server at https://mcp.postman.com.
To install the remote Postman MCP Server in Cursor, click the install button.
Note: Ensure that the Authorization header uses the Bearer <YOUR_API_KEY> format.
To install the MCP server in Claude Code, run the following command in your terminal:
Minimal
claude mcp add --transport http postman https://mcp.postman.com/minimal
Full
claude mcp add --transport http postman https://mcp.postman.com/mcp
If remote MCP servers aren't supported by your MCP host, you can install the Postman MCP Server to your local machine.
STDIO is a lightweight solution that's ideal for integration with editors and tools like Visual Studio Code. Install an MCP-compatible VS Code extension, such as GitHub Copilot, Claude for VS Code, or other AI assistants that support MCP.
Note: For Docker set up and installation, see DOCKER.md.
The local server supports the following tool configurations:
--full flag to enable this configuration.Before getting started, you'll need the following:
To configure the extension to use the local Postman MCP Server, do the following:
npm install command. This installs all the required dependencies.${workspaceFolder} in the mcp.json file with the full path to the Postman MCP repository.To install the local Postman MCP Server in Visual Studio Code, click the install button.
Note:
--full flag to access all 106 tools.--region flag to specify the Postman API region (us or eu), or set the POSTMAN_API_BASE_URL environment variable directly. By default, the server uses the us option.You can manually integrate your MCP server with VS Code to use it with extensions that support MCP. To do this, create a .vscode/mcp.json file in your project and add the following JSON block to it:
{
"servers": {
"postman-api-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"@postman/postman-mcp-server",
"--full" // (optional) Use this flag to enable full mode
],
"env": {
"POSTMAN_API_KEY": "${input:postman-api-key}"
}
}
},
"inputs": [
{
"id": "postman-api-key",
"type": "promptString",
"description": "Enter your Postman API key"
}
]
}
To install the local Postman MCP Server in Cursor, click the install button.
To integrate the MCP server with Claude, check the latest Postman MCP Server release and get the .mcpb file.
postman-api-mcp-minimal.mcpb - Contains the 37 essential tools for common Postman operations.postman-api-mcp-full.mcpb - Contains all available Postman tools.For more information, see Anthropic's Claude Desktop Extensions documentation.
To install the MCP server in Claude Code, run the following command in your terminal:
Minimal
claude mcp add postman -- npx @postman/mcp-server@latest
Full
claude mcp add postman -- npx @postman/mcp-server@latest --full
To install the MCP server as a Gemini CLI extension, run the following command in your terminal:
gemini extensions install https://github.com/postmanlabs/postman-mcp-server
If you're migrating from Postman MCP Server version 1.x to 2.x, be aware of the following:
create-collection → createCollectionget-workspaces → getWorkspacesdelete-environment → deleteEnvironment--full flag provides access to all 106 tools.FAQs
A simple MCP server to operate on the Postman API
The npm package @postman/postman-mcp-server receives a total of 651 weekly downloads. As such, @postman/postman-mcp-server popularity was classified as not popular.
We found that @postman/postman-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.