Postman MCP Server by postmanlabs

Published advisories for @postman/postman-mcp-server

From the OSV database, for this npm package. Check that your installed version is past any fix.

• MAL-2025-190909Malicious code in @postman/postman-mcp-server (npm)

Tools Postman MCP Server exposes (42)

Listed by the server itself during our scan of commit f6999e9.

• createCollection

  Creates a collection using the [Postman Collection v2.1.0 schema format](https://schema.postman.com/collection/json/v2.1.0/draft-07/docs/index.html). **Note:** If you do not include the \`workspace\` query parameter, the system creates the collection in the oldest personal Internal workspace you o

• createCollectionRequest

  Creates a request in a collection. For a complete list of properties, refer to the **Request** entry in the [Postman Collection Format documentation](https://schema.postman.com/collection/json/v2.1.0/draft-07/docs/index.html). **Note:** It is recommended that you pass the \`name\` property in the

• createCollectionResponse

  Creates a request response in a collection. For a complete list of request body properties, refer to the **Response** entry in the [Postman Collection Format documentation](https://schema.postman.com/collection/json/v2.1.0/draft-07/docs/index.html). **Note:** It is recommended that you pass the \`

• createEnvironment

  Creates an environment. **Note:** - The request body size cannot exceed the maximum allowed size of 30MB. - If you receive an HTTP \`411 Length Required\` error response, manually pass the \`Content-Length\` header and its value in the request header. - If you do not include the \`workspace\` quer

• createMock

  Creates a mock server in a collection. - Pass the collection UID (ownerId-collectionId), not the bare collection ID. - If you only have a \`collectionId\`, resolve the UID first: 1) Prefer GET \`/collections/{collectionId}\` and read \`uid\`, or 2) Construct \`{ownerId}-{collectionId}\` using o

• createSpec

  Creates an API specification in Postman's [Spec Hub](https://learning.postman.com/docs/design-apis/specifications/overview/). Specifications can be single or multi-file. **Note:** - Postman supports OpenAPI (2.0, 3.0, and 3.1), AsyncAPI (2.0 and 3.0), protobuf (2 and 3), GraphQL, and Smithy specifi

• createSpecFile

  Creates a file for an OpenAPI or a protobuf 2 or 3 specification. **Note:** - If the file path contains a \`/\` (forward slash) character, then a folder is created. For example, if the path is the \`components/schemas.json\` value, then a \`components\` folder is created with the \`schemas.json\`

• createWorkspace

  Creates a new [workspace](https://learning.postman.com/docs/collaborating-in-postman/using-workspaces/creating-workspaces/). **Note:** - This endpoint returns a 403 \`Forbidden\` response if the user does not have permission to create workspaces. [Admins and Super Admins](https://learning.postman.

• duplicateCollection

  Creates a duplicate of the given collection in another workspace. Use the GET \`/collection-duplicate-tasks/{taskId}\` endpoint to get the duplication task's current status.

• generateCollection

  Creates a collection from the given API specification. The specification must already exist or be created before it can be used to generate a collection. The response contains a polling link to the task status.

• generateSpecFromCollection

  Generates an OpenAPI 2.0, 3.0, or 3.1 specification for the given collection. The response contains a polling link to the task status.

• getAllSpecs

  Gets all API specifications in a workspace.

• getAuthenticatedUser

  Gets information about the authenticated user. - This endpoint provides “current user” context (\`user.id\`, \`username\`, \`teamId\`, roles). - When a user asks for “my …” (e.g., “my workspaces, my information, etc.”), call this first to resolve the user ID.

• getCollection

  Get information about a collection. By default this tool returns the lightweight collection map (metadata + recursive itemRefs). Use the model parameter to opt in to Postman's full API responses: - model=minimal — root-level folder/request IDs only - model=full — full Postman collection payload.

• getCollections

  The workspace ID query is required for this endpoint. If not provided, the LLM should ask the user to provide it.

• getDuplicateCollectionTaskStatus

  Gets the status of a collection duplication task.

• getEnabledTools

  IMPORTANT: Run this tool first when a requested tool is unavailable. Returns information about which tools are enabled in the full and minimal tool sets, helping you identify available alternatives.

• getEnvironment

  Gets information about an environment.

• getEnvironments

  Gets information about all of your [environments](https://learning.postman.com/docs/sending-requests/managing-environments/).

• getGeneratedCollectionSpecs

  Gets the API specification generated for the given collection.

• getMock

  Gets information about a mock server. - Resource: Mock server entity. Response includes the associated \`collection\` UID and \`mockUrl\`. - Use the \`collection\` UID to navigate back to the source collection.

• getMocks

  Gets all active mock servers. By default, returns only mock servers you created across all workspaces. - Always pass either the \`workspace\` or \`teamId\` query to scope results. Prefer \`workspace\` when known. - If you need team-scoped results, set \`teamId\` from the current user: call GET \`/m

• getSpec

  Gets information about an API specification.

• getSpecCollections

  Gets all of an API specification's generated collections.

• getSpecDefinition

  Gets the complete contents of an OpenAPI or AsyncAPI specification's definition.

• getSpecFile

  Gets the contents of an API specification's file.

• getSpecFiles

  Gets all the files in an API specification.

• getTaggedEntities

  **Requires an Enterprise plan.** Tagging is only available on Postman Enterprise plans. This tool returns a 404 error on Free, Basic, and Professional accounts. Gets Postman elements (entities) by a given tag. Tags enable you to organize and search workspaces, APIs, and collections that contain sha

• getWorkspace

  Gets information about a workspace. **Note:** This endpoint's response contains the \`visibility\` field. [Visibility](https://learning.postman.com/docs/collaborating-in-postman/using-workspaces/managing-workspaces/#changing-workspace-visibility) determines who can access the workspace: - \`person

• getWorkspaces

  Gets all workspaces you have access to. - For “my …” requests, first call GET \`/me\` and pass \`createdBy={me.user.id}\`. - This endpoint's response contains the visibility field. Visibility determines who can access the workspace: - \`personal\` — Only you can access the workspace. - \`team\`

• publishMock

  Publishes a mock server. Publishing a mock server sets its **Access Control** configuration setting to public.

• putCollection

  Replaces the contents of a collection using the [Postman Collection v2.1.0 schema format](https://schema.postman.com/collection/json/v2.1.0/draft-07/docs/index.html). Include the collection's ID values in the request body. If you do not, the endpoint removes the existing items and creates new items.

• putEnvironment

  Replaces all the contents of an environment with the given information. **Note:** - The request body size cannot exceed the maximum allowed size of 30MB. - If you receive an HTTP \`411 Length Required\` error response, manually pass the \`Content-Length\` header and its value in the request header

• runCollection

  Runs a Postman collection by ID with detailed test results and execution statistics. Supports optional environment for variable substitution. Note: Advanced parameters like custom delays and other runtime options are not yet available.

• searchPostmanElements

  Search for Postman entities (requests, collections, workspaces, specs, flows, environments, mocks, and documents). **Ownership:** - `organization` — Search within all resources owned by your organization (default). - `external` — Search within the public Postman network (third-party and community A

• syncCollectionWithSpec

  Syncs a collection generated from an API specification. This is an asynchronous endpoint that returns an HTTP \`202 Accepted\` response. **Note:** - This endpoint only supports the OpenAPI 2.0, 3.0, and 3.1 specification types. - You can only sync collections generated from the given spec ID.

• syncSpecWithCollection

  Syncs an API specification linked to a collection. This is an asynchronous endpoint that returns an HTTP \`202 Accepted\` response. **Note:** - This endpoint only supports the OpenAPI 2.0, 3.0, and 3.1 specification types. - You can only sync collections generated from the given specification ID.

• updateCollectionRequest

  Updates a request in a collection. For a complete list of properties, refer to the **Request** entry in the [Postman Collection Format documentation](https://schema.postman.com/collection/json/v2.1.0/draft-07/docs/index.html). **Note:** - You must pass a collection ID (\`12ece9e1-2abf-4edc-8e34-de

• updateMock

  Updates a mock server. - Resource: Mock server entity associated with a collection UID. - Use this to change name, environment, privacy, or default server response. - To activate a server response, set \`config.serverResponseId\` to the server response's \`id\`. Pass \`null\` to deactivate.

• updateSpecFile

  Updates a file for an OpenAPI or protobuf 2 or 3 specification. **Note:** - This endpoint does not accept an empty request body. You must pass one of the accepted values. - This endpoint does not accept multiple request body properties in a single call. For example, you cannot pass both the \`cont

At a glance

Stars

325

Forks

85

Language

TypeScript

License

Apache-2.0

Created

Jun 2025

Last update

Oct 30, 2026

Type

MCP Server

Price

Free

Topics

Questions about Postman MCP Server

Guides

• How to Install an MCP Server in Claude, Cursor and VS Code
• MCP Server Security: How to Vet a Server Before You Use It
• MCP Tool Poisoning: Malicious Descriptions and Rug Pulls
• Glossary of MCP, skills and agent security terms
• More Developer Tools agents, MCP servers & skills