
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
@postman/postman-mcp-server
Advanced tools
The Postman MCP Server connects Postman to AI tools, giving AI agents and assistants the ability to access workspaces, manage collections and environments, evaluate APIs, and automate workflows through natural language interactions.
Postman supports the following tool configurations:
For a complete list of the Postman MCP Server's tools, see the Postman MCP Server collection. This collection offers both the remote full and minimal servers, and the local server.
Postman also offers servers as an npm package.
For the best developer experience and fastest setup, use OAuth on the remote server (https://mcp.postman.com). OAuth is fully compliant with the MCP Authorization specification and requires no manual API key configuration. The EU remote server and the local server (this repo/npm package) support only Postman API key authentication.
code toolset produces code that precisely matches your API definitions, organizes it into an intuitive tree structure mirroring your Postman collections and requests, and leverages example responses to create accurate response types and error handling.Designed for developers who want to integrate their AI tools with Postman's context and features. Supports quick natural language queries to advanced agent workflows.
The Postman MCP Server supports the EU region for remote and local servers:
https://mcp.eu.postman.com.--region flag to specify the Postman API region (us or eu), or set the POSTMAN_API_BASE_URL environment variable directly.The remote Postman MCP Server is hosted by Postman over streamable HTTP and provides the easiest method for getting started.
The remote server (https://mcp.postman.com) supports OAuth for the best developer experience and fastest setup, and no API key needed. OAuth also provides stronger security and fine-grained access control compared to a static API key. OAuth is MCP specification–compliant, including Dynamic Client Registration (DCR), OAuth metadata, and PKCE.
Note: The EU remote server (https://mcp.eu.postman.com) only supports API key authentication.
MCP hosts that support OAuth can discover and use it automatically for all tools. The remote server also accepts a Postman API key (Bearer token in the Authorization header).
Why use the remote server?
Consider using the remote Postman MCP server if:
Supported configurations
The remote server supports the following tool configurations:
https://mcp.postman.com/minimal and https://mcp.eu.postman.com/minimal for EU users.https://mcp.postman.com/code and https://mcp.eu.postman.com/code for EU users.https://mcp.postman.com/mcp and https://mcp.eu.postman.com/mcp for EU users.To install the remote Postman MCP Server in Cursor, click the install button.
Note: If your MCP host supports OAuth, use the https://mcp.postman.com server URL with no headers for the fastest setup. Otherwise, ensure the Authorization header uses the Bearer <YOUR_API_KEY> format. OAuth is not available on the EU server.
By default, the server uses Minimal mode. To access Full mode, change the url value to https://mcp.postman.com/mcp in the mcp.json file. To access Code mode, change the value to https://mcp.postman.com/code.
To install the remote Postman MCP Server in VS Code, click the install button or use the Postman VS Code Extension.
By default, the server uses Minimal mode. To access Full mode, change the url value to https://mcp.postman.com/mcp in the mcp.json file. To access Code mode, change the value to https://mcp.postman.com/code.
You can use the Postman MCP Server with MCP-compatible extensions in VS Code, such as GitHub Copilot, Claude for VS Code, or other AI assistants that support MCP. To do so, add the following JSON block to the .vscode/mcp.json configuration file:
OAuth
Add the following JSON block to use the recommended OAuth installation method:
{
"servers": {
"postman": {
"type": "http",
"url": "https://mcp.postman.com/{minimal OR code OR mcp}"
}
}
}
When prompted, enter your Postman API key.
API key
Use the following JSON block to use the API key installation method:
{
"servers": {
"postman": {
"type": "http",
"url": "https://mcp.postman.com/{minimal OR code OR mcp}",
// For the EU server, use "https://mcp.eu.postman.com/{minimal OR code OR mcp}"
"headers": {
"Authorization": "Bearer ${input:postman-api-key}"
}
}
},
"inputs": [
{
"id": "postman-api-key",
"type": "promptString",
"description": "Enter your Postman API key"
}
]
}
When prompted, enter your Postman API key.
To install the MCP server in Claude Code, run the following command in your terminal. On the US server, Claude Code uses OAuth automatically for the best installation experience. To use an API key (required for the EU server), add the --header flag.
OAuth
Use the recommended OAuth installation method for US servers:
claude mcp add --transport http postman https://mcp.postman.com/minimal
claude mcp add --transport http postman https://mcp.postman.com/code
claude mcp add --transport http postman https://mcp.postman.com/mcp
API key
Use the API key installation method if required and for EU servers:
claude mcp add --transport http postman https://mcp.postman.com/minimal --header "Authorization: Bearer <POSTMAN_API_KEY>"
claude mcp add --transport http postman https://mcp.postman.com/code --header "Authorization: Bearer <POSTMAN_API_KEY>"
claude mcp add --transport http postman https://mcp.postman.com/mcp --header "Authorization: Bearer <POSTMAN_API_KEY>"
To install the remote server in Codex, use one of the following methods, depending on your authentication and region.
OAuth
Use the recommended OAuth installation method with the US server for the best installation experience. This requires no manual API key setup.
For Minimal mode:
codex mcp add postman --remote-url https://mcp.postman.com/minimal
For Code mode:
codex mcp add postman --remote-url https://mcp.postman.com/code
For Full mode:
codex mcp add postman --remote-url https://mcp.postman.com/mcp
API key
If you're using the EU server, a local server, or prefer API key authentication, use the API key method. Set the POSTMAN_API_KEY environment variable and invoke the MCP server using npx.
For Minimal mode:
codex mcp add postman --env POSTMAN_API_KEY=<POSTMAN_API_KEY> -- npx @postman/postman-mcp-server --minimal
For Code mode:
codex mcp add postman --env POSTMAN_API_KEY=<POSTMAN_API_KEY> -- npx @postman/postman-mcp-server --code
For Full mode:
codex mcp add postman --env POSTMAN_API_KEY=<POSTMAN_API_KEY> -- npx @postman/postman-mcp-server --full
To install the MCP server in Windsurf, copy the following JSON config into the .codeium/windsurf/mcp_config.json file.
This configuration uses the remote server (https://mcp.postman.com), which authenticates with OAuth automatically.
{
"mcpServers": {
"postman-full": {
"args": [
"mcp-remote",
"https://mcp.postman.com/mcp"
],
"disabled": false,
"disabledTools": [],
"env": {}
},
"postman-code": {
"args": [
"mcp-remote",
"https://mcp.postman.com/code"
],
"disabled": false,
"disabledTools": [],
"env": {}
},
"postman-minimal": {
"args": [
"mcp-remote",
"https://mcp.postman.com/minimal"
],
"disabled": false,
"disabledTools": [],
"env": {}
}
}
}
To install the MCP server in Antigravity, click Manage MCP servers > View raw config. Then, copy the following JSON config into the .codeium/windsurf/mcp_config.json file.
This configuration uses the remote server (https://mcp.postman.com), which authenticates automatically with OAuth.
{
"mcpServers": {
"postman-full": {
"args": [
"mcp-remote",
"https://mcp.postman.com/mcp"
],
"disabled": false,
"disabledTools": [],
"env": {}
},
"postman-code": {
"args": [
"mcp-remote",
"https://mcp.postman.com/code"
],
"disabled": false,
"disabledTools": [],
"env": {}
},
"postman-minimal": {
"args": [
"mcp-remote",
"https://mcp.postman.com/minimal"
],
"disabled": false,
"disabledTools": [],
"env": {}
}
}
}
You can add the MCP server to your Copilot CLI either with OAuth (recommended) or an API key.
Use the Copilot CLI to interactively add the MCP server:
/mcp add
Or, add the following to your ~/.copilot/mcp-config.json config file:
{
"mcpServers": {
"postman": {
"type": "http",
"url": "https://mcp.postman.com/minimal" // Use "https://mcp.postman.com/mcp" for Full mode, or "https://mcp.postman.com/code"` for Code mode.
}
}
}
API key
Use the following method to install on EU servers or if API key is required:
{
"mcpServers": {
"postman": {
"type": "http",
"url": "https://mcp.eu.postman.com/minimal",
"headers": {
"Authorization": "Bearer ${input:postman-api-key}"
}
}
},
"inputs": [
{
"id": "postman-api-key",
"type": "promptString",
"description": "Enter your Postman API key"
}
]
}
By default, this uses Minimal mode. To access Full mode, change the url value to https://mcp.postman.com/mcp. To access Code mode, change the value to https://mcp.postman.com/code.
For more information, see the Copilot CLI documentation.
The local server uses STDIO transport and is hosted locally on an environment of your choice.
Why use the local server?
Consider using the local Postman MCP server if:
Supported configurations
The local server supports the following tool configurations:
--full flag to enable this configuration.Note:
--region flag to specify the Postman API region (us or eu), or set the POSTMAN_API_BASE_URL environment variable directly. By default, the server uses the us option.To install the local Postman MCP Server in VS Code, click the install button.
By default, the server uses Full mode. To access Minimal mode, remove the --full flag from the mcp.json configuration file. To access Code mode, replace the --full flag with --code.
You can manually integrate your MCP server with Cursor or VS Code to use it with extensions that support MCP. To do this, create a mcp.json file in your project and add the following JSON block to it:
{
"servers": {
"postman": {
"type": "stdio",
"command": "npx",
"args": [
"@postman/postman-mcp-server",
"--full", // (optional) Use this flag to enable full mode...
"--code", // (optional) ...or this flag to enable code mode.
"--region us" // (optional) Use this flag to specify the Postman API region (us or eu). Defaults to us.
],
"env": {
"POSTMAN_API_KEY": "${input:postman-api-key}"
}
}
},
"inputs": [
{
"id": "postman-api-key",
"type": "promptString",
"description": "Enter your Postman API key"
}
]
}
To install the local Postman MCP Server in Cursor, click the install button.
By default, the server uses Full mode. To access Minimal mode, remove the --full flag from the mcp.json configuration file. To access Code mode, replace the --full flag with --code.
To integrate the MCP server with Claude, check the latest Postman MCP Server release and get the .mcpb file.
postman-mcp-server-minimal.mcpbpostman-mcp-server-full.mcpbpostman-mcp-server-code.mcpbFor more information, see the Claude Desktop Extensions documentation.
To install the MCP server in Claude Code, run the following command in your terminal:
For Minimal mode:
claude mcp add postman --env POSTMAN_API_KEY=YOUR_KEY -- npx @postman/postman-mcp-server@latest
For Code mode:
claude mcp add postman --env POSTMAN_API_KEY=YOUR_KEY -- npx @postman/postman-mcp-server@latest --code
For Full mode:
claude mcp add postman --env POSTMAN_API_KEY=YOUR_KEY -- npx @postman/postman-mcp-server@latest --full
To install the local server, use the API key installation method. Set the POSTMAN_API_KEY environment variable and invoke the MCP server using npx.
For Minimal mode:
codex mcp add postman --env POSTMAN_API_KEY=<POSTMAN_API_KEY> -- npx @postman/postman-mcp-server --minimal
For Code mode:
codex mcp add postman --env POSTMAN_API_KEY=<POSTMAN_API_KEY> -- npx @postman/postman-mcp-server --code
For Full mode:
codex mcp add postman --env POSTMAN_API_KEY=<POSTMAN_API_KEY> -- npx @postman/postman-mcp-server --full
To manually install the MCP server in Windsurf, do the following:
Copy the following JSON config into the .codeium/windsurf/mcp_config.json file:
{
"mcpServers": {
"postman": {
"args": [
"@postman/postman-mcp-server"
],
"command": "npx",
"disabled": false,
"disabledTools": [],
"env": {
"POSTMAN_API_KEY": "<POSTMAN_API_KEY>"
}
}
}
}
To install the MCP server in Antigravity, click Manage MCP servers > View raw config. Then, copy the following JSON config into the .codeium/windsurf/mcp_config.json file:
{
"mcpServers": {
"postman": {
"args": [
"@postman/postman-mcp-server"
],
"command": "npx",
"disabled": false,
"disabledTools": [],
"env": {
"POSTMAN_API_KEY": "XXXX"
}
}
}
}
Use the Copilot CLI to interactively add the MCP server:
/mcp add
Alternatively, create or edit the configuration file ~/.copilot/mcp-config.json and add:
{
"mcpServers": {
"postman": {
"command": "npx",
"args": ["@postman/postman-mcp-server"],
"env": {
"POSTMAN_API_KEY": "YOUR_API_KEY"
}
}
}
}
For more information, see the Copilot CLI documentation.
To install the MCP server as a Gemini CLI extension, run the following command in your terminal:
gemini extensions install https://github.com/postmanlabs/postman-mcp-server
For Docker set up and installation, see DOCKER.md.
If you're migrating from Postman MCP Server version 1.x to 2.x, be aware of the following:
create-collection → createCollectionget-workspaces → getWorkspacesdelete-environment → deleteEnvironment--full flag provides access to all tools.FAQs
A simple MCP server to operate on the Postman API
The npm package @postman/postman-mcp-server receives a total of 893 weekly downloads. As such, @postman/postman-mcp-server popularity was classified as not popular.
We found that @postman/postman-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.