Postman MCP Server by postmanlabs

Findings (30)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/release.js:77
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/release.js:81
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/release.js:99
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/release.js:106
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/release.js:107
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/release.js:115
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @faker-js/faker@5.5.3: 1 known vulnerability

  GHSA-qxc2-j82w-r537

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.3.0: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@5.0.8: 4 known vulnerabilities

  GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@4.1.1: 11 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-5jgf-p345-68v8, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +6 more

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ip-address@10.2.0: 8 known vulnerabilities

  GHSA-22jq-vg5j-6vgg, GHSA-2vr4-cq9g-pvrc, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv +3 more

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.16: 1 known vulnerability

  GHSA-2v37-7h3g-55p8

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  node-forge@1.4.0: 12 known vulnerabilities

  GHSA-4487-j8r4-4g2f, GHSA-4642-5mcj-2rqw, GHSA-525v-9gp9-w22h, GHSA-5cwg-6vw7-rj6p, GHSA-5x38-2vff-x55p +7 more

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@7.2.4: 10 known vulnerabilities

  GHSA-4w7w-66w2-5vf9, GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-fx2h-pf6j-xcff +5 more

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@2.0.11: 1 known vulnerability

  GHSA-rmxm-3fg6-px4f

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  @humanfs/node@0.16.6: 1 known vulnerability

  GHSA-p498-v437-472g

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@4.1.10: 2 known vulnerabilities

  GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  csv-parse@4.16.3: 1 known vulnerability

  GHSA-8cw4-87c7-c6xx

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  hono@4.12.32: 9 known vulnerabilities

  GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239, GHSA-crvj-82cr-hjcx +4 more

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.3: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  postcss@8.5.22: 1 known vulnerability

  GHSA-fxqj-rqcc-2cmp

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.15.0: 4 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.15.3: 3 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  vitest@4.1.10: 1 known vulnerability

  GHSA-82fw-gwwq-j7x9

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a preinstall script

  npx only-allow pnpm

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  POSTMAN_MCP_TELEMETRY, GATEWAY_BASE_URL_OVERRIDE_ENV

Network activity

Tools exposed (42)

• createCollection

  Creates a collection using the [Postman Collection v2.1.0 schema format](https://schema.postman.com/collection/json/v2.1.0/draft-07/docs/index.html). **Note:** If you do not include the \`workspace\` query parameter, the system creates the collection in the oldest personal Internal workspace you o

• createCollectionRequest

  Creates a request in a collection. For a complete list of properties, refer to the **Request** entry in the [Postman Collection Format documentation](https://schema.postman.com/collection/json/v2.1.0/draft-07/docs/index.html). **Note:** It is recommended that you pass the \`name\` property in the

• createCollectionResponse

  Creates a request response in a collection. For a complete list of request body properties, refer to the **Response** entry in the [Postman Collection Format documentation](https://schema.postman.com/collection/json/v2.1.0/draft-07/docs/index.html). **Note:** It is recommended that you pass the \`

• createEnvironment

  Creates an environment. **Note:** - The request body size cannot exceed the maximum allowed size of 30MB. - If you receive an HTTP \`411 Length Required\` error response, manually pass the \`Content-Length\` header and its value in the request header. - If you do not include the \`workspace\` quer

• createMock

  Creates a mock server in a collection. - Pass the collection UID (ownerId-collectionId), not the bare collection ID. - If you only have a \`collectionId\`, resolve the UID first: 1) Prefer GET \`/collections/{collectionId}\` and read \`uid\`, or 2) Construct \`{ownerId}-{collectionId}\` using o

• createSpec

  Creates an API specification in Postman's [Spec Hub](https://learning.postman.com/docs/design-apis/specifications/overview/). Specifications can be single or multi-file. **Note:** - Postman supports OpenAPI (2.0, 3.0, and 3.1), AsyncAPI (2.0 and 3.0), protobuf (2 and 3), GraphQL, and Smithy specifi

• createSpecFile

  Creates a file for an OpenAPI or a protobuf 2 or 3 specification. **Note:** - If the file path contains a \`/\` (forward slash) character, then a folder is created. For example, if the path is the \`components/schemas.json\` value, then a \`components\` folder is created with the \`schemas.json\`

• createWorkspace

  Creates a new [workspace](https://learning.postman.com/docs/collaborating-in-postman/using-workspaces/creating-workspaces/). **Note:** - This endpoint returns a 403 \`Forbidden\` response if the user does not have permission to create workspaces. [Admins and Super Admins](https://learning.postman.

• duplicateCollection

  Creates a duplicate of the given collection in another workspace. Use the GET \`/collection-duplicate-tasks/{taskId}\` endpoint to get the duplication task's current status.

• generateCollection

  Creates a collection from the given API specification. The specification must already exist or be created before it can be used to generate a collection. The response contains a polling link to the task status.

• generateSpecFromCollection

  Generates an OpenAPI 2.0, 3.0, or 3.1 specification for the given collection. The response contains a polling link to the task status.

• getAllSpecs

  Gets all API specifications in a workspace.

• getAuthenticatedUser

  Gets information about the authenticated user. - This endpoint provides “current user” context (\`user.id\`, \`username\`, \`teamId\`, roles). - When a user asks for “my …” (e.g., “my workspaces, my information, etc.”), call this first to resolve the user ID.

• getCollection

  Get information about a collection. By default this tool returns the lightweight collection map (metadata + recursive itemRefs). Use the model parameter to opt in to Postman's full API responses: - model=minimal — root-level folder/request IDs only - model=full — full Postman collection payload.

• getCollections

  The workspace ID query is required for this endpoint. If not provided, the LLM should ask the user to provide it.

• getDuplicateCollectionTaskStatus

  Gets the status of a collection duplication task.

• getEnabledTools

  IMPORTANT: Run this tool first when a requested tool is unavailable. Returns information about which tools are enabled in the full and minimal tool sets, helping you identify available alternatives.

• getEnvironment

  Gets information about an environment.

• getEnvironments

  Gets information about all of your [environments](https://learning.postman.com/docs/sending-requests/managing-environments/).

• getGeneratedCollectionSpecs

  Gets the API specification generated for the given collection.

• getMock

  Gets information about a mock server. - Resource: Mock server entity. Response includes the associated \`collection\` UID and \`mockUrl\`. - Use the \`collection\` UID to navigate back to the source collection.

• getMocks

  Gets all active mock servers. By default, returns only mock servers you created across all workspaces. - Always pass either the \`workspace\` or \`teamId\` query to scope results. Prefer \`workspace\` when known. - If you need team-scoped results, set \`teamId\` from the current user: call GET \`/m

• getSpec

  Gets information about an API specification.

• getSpecCollections

  Gets all of an API specification's generated collections.

• getSpecDefinition

  Gets the complete contents of an OpenAPI or AsyncAPI specification's definition.

• getSpecFile

  Gets the contents of an API specification's file.

• getSpecFiles

  Gets all the files in an API specification.

• getTaggedEntities

  **Requires an Enterprise plan.** Tagging is only available on Postman Enterprise plans. This tool returns a 404 error on Free, Basic, and Professional accounts. Gets Postman elements (entities) by a given tag. Tags enable you to organize and search workspaces, APIs, and collections that contain sha

• getWorkspace

  Gets information about a workspace. **Note:** This endpoint's response contains the \`visibility\` field. [Visibility](https://learning.postman.com/docs/collaborating-in-postman/using-workspaces/managing-workspaces/#changing-workspace-visibility) determines who can access the workspace: - \`person

• getWorkspaces

  Gets all workspaces you have access to. - For “my …” requests, first call GET \`/me\` and pass \`createdBy={me.user.id}\`. - This endpoint's response contains the visibility field. Visibility determines who can access the workspace: - \`personal\` — Only you can access the workspace. - \`team\`

• publishMock

  Publishes a mock server. Publishing a mock server sets its **Access Control** configuration setting to public.

• putCollection

  Replaces the contents of a collection using the [Postman Collection v2.1.0 schema format](https://schema.postman.com/collection/json/v2.1.0/draft-07/docs/index.html). Include the collection's ID values in the request body. If you do not, the endpoint removes the existing items and creates new items.

• putEnvironment

  Replaces all the contents of an environment with the given information. **Note:** - The request body size cannot exceed the maximum allowed size of 30MB. - If you receive an HTTP \`411 Length Required\` error response, manually pass the \`Content-Length\` header and its value in the request header

• runCollection

  Runs a Postman collection by ID with detailed test results and execution statistics. Supports optional environment for variable substitution. Note: Advanced parameters like custom delays and other runtime options are not yet available.

• searchPostmanElements

  Search for Postman entities (requests, collections, workspaces, specs, flows, environments, mocks, and documents). **Ownership:** - `organization` — Search within all resources owned by your organization (default). - `external` — Search within the public Postman network (third-party and community A

• syncCollectionWithSpec

  Syncs a collection generated from an API specification. This is an asynchronous endpoint that returns an HTTP \`202 Accepted\` response. **Note:** - This endpoint only supports the OpenAPI 2.0, 3.0, and 3.1 specification types. - You can only sync collections generated from the given spec ID.

• syncSpecWithCollection

  Syncs an API specification linked to a collection. This is an asynchronous endpoint that returns an HTTP \`202 Accepted\` response. **Note:** - This endpoint only supports the OpenAPI 2.0, 3.0, and 3.1 specification types. - You can only sync collections generated from the given specification ID.

• updateCollectionRequest

  Updates a request in a collection. For a complete list of properties, refer to the **Request** entry in the [Postman Collection Format documentation](https://schema.postman.com/collection/json/v2.1.0/draft-07/docs/index.html). **Note:** - You must pass a collection ID (\`12ece9e1-2abf-4edc-8e34-de

• updateMock

  Updates a mock server. - Resource: Mock server entity associated with a collection UID. - Use this to change name, environment, privacy, or default server response. - To activate a server response, set \`config.serverResponseId\` to the server response's \`id\`. Pass \`null\` to deactivate.

• updateSpecFile

  Updates a file for an OpenAPI or protobuf 2 or 3 specification. **Note:** - This endpoint does not accept an empty request body. You must pass one of the accepted values. - This endpoint does not accept multiple request body properties in a single call. For example, you cannot pass both the \`cont

• updateSpecProperties

  Updates an API specification's properties, such as its name.

• updateWorkspace

  Updates a workspace's property, such as its name or visibility. **Note:** - This endpoint does not support the following visibility changes: - \`private\` to \`public\`, \`public\` to \`private\`, and \`private\` to \`personal\` for **Free** and **Solo** [plans](https://www.postman.com/pricing/)