Is com.postman/postman-mcp-server safe to use?

com.postman/postman-mcp-server has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "@postman/postman-mcp-server". Review the Security section above for details before installing.

How do I install com.postman/postman-mcp-server?

com.postman/postman-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can com.postman/postman-mcp-server do?

com.postman/postman-mcp-server provides 4 tools: Authentication, Docker, Contributing, Keywords. See the full tools list on the server page for descriptions and parameters.

What AI clients work with com.postman/postman-mcp-server?

com.postman/postman-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is com.postman/postman-mcp-server actively maintained?

com.postman/postman-mcp-server is actively maintained - last commit was 0 days ago. It has 329 GitHub stars.

com.postman/postman-mcp-server

Official

@postman/postman-mcp-server

Give your AI agents trusted access to the full Postman platform.

329 6.4k/wk 4 tools GitHub npm

1 open CVE

Apache-2.0 license

Actively maintained

Last commit 0d ago

Works with most clients

Transport: stdio, sse, http

4 tools · ~252 tok

Grade A · 0.1% of 200K ctx

MCPpedia last refreshed this data 8h ago

Edit this pageView history

com.postman/postman-mcp-server is an MCP server that give your AI agents trusted access to the full Postman platform. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 95/100 on MCPpedia's security, maintenance and efficiency rubric.

Developer Tools

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "postman-code": {
      "env": {},
      "args": [
        "mcp-remote",
        "https://mcp.postman.com/code"
      ],
      "disabled": false,
      "disabledTools": []
    },
    "postman-full": {
      "env": {},
      "args": [
        "mcp-remote",
        "https://mcp.postman.com/mcp"
      ],
      "disabled": false,
      "disabledTools": []
    },
    "postman-minimal": {
      "env": {},
      "args": [
        "mcp-remote",
        "https://mcp.postman.com/minimal"
      ],
      "disabled": false,
      "disabledTools": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/com-postman-postman-mcp-server)](https://mcppedia.org/s/com-postman-postman-mcp-server)

Read me

What com.postman/postman-mcp-server does

Give your AI agents trusted access to the full Postman platform.

Test This Server

This server supports HTTP transport. Be the first to test it - help the community know if it works.

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

95/100across 5 weighted dimensions

How we score →

0255075100

−5

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

1 open

MAL-2025-190909info

Malicious code in @postman/postman-mcp-server (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c7c276129c0d99cb4f8aa63e9f3911b1f38145837396ac3b00ba48533a6050b8) The package @postman/postman-mcp-server was found to contain malicious code. ## Source: google-open-source-security (0c419e14201055a516cc9ef8dfe3f0ecc29ae793e9b304eeb4da6589465ab1d4) This package was compromised by the Sha1-Hulud: The Second Coming NPM worm. The malicious payload steals tokens and credentials and publishes them to GitHub. T

source →

Inventory

Tools (4)

Click any tool to inspect its schema.

~252 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is com.postman/postman-mcp-server safe to use?: com.postman/postman-mcp-server has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "@postman/postman-mcp-server". Review the Security section above for details before installing.
How do I install com.postman/postman-mcp-server?: com.postman/postman-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can com.postman/postman-mcp-server do?: com.postman/postman-mcp-server provides 4 tools: Authentication, Docker, Contributing, Keywords. See the full tools list on the server page for descriptions and parameters.
What AI clients work with com.postman/postman-mcp-server?: com.postman/postman-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is com.postman/postman-mcp-server actively maintained?: com.postman/postman-mcp-server is actively maintained - last commit was 0 days ago. It has 329 GitHub stars.

Similar servers

Others in developer-tools

View all →

XcodeBuildMCP97

XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.

6.6k 2

Supabase MCP Server96

Manage Supabase projects — databases, auth, storage, and edge functions

3.0k 4

Mcp Gitlab96

MCP server for using the GitLab API

2.1k 12

Codebase Memory Mcp95

Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.

48.6k 6

MCP Security Weekly

Get CVE alerts and security updates for com.postman/postman-mcp-server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Developer Tools

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "postman-code": {
      "env": {},
      "args": [
        "mcp-remote",
        "https://mcp.postman.com/code"
      ],
      "disabled": false,
      "disabledTools": []
    },
    "postman-full": {
      "env": {},
      "args": [
        "mcp-remote",
        "https://mcp.postman.com/mcp"
      ],
      "disabled": false,
      "disabledTools": []
    },
    "postman-minimal": {
      "env": {},
      "args": [
        "mcp-remote",
        "https://mcp.postman.com/minimal"
      ],
      "disabled": false,
      "disabledTools": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/com-postman-postman-mcp-server)](https://mcppedia.org/s/com-postman-postman-mcp-server)

Read me

What com.postman/postman-mcp-server does

Give your AI agents trusted access to the full Postman platform.

Test This Server

This server supports HTTP transport. Be the first to test it - help the community know if it works.

README

Postman MCP Server

The Postman MCP Server implements the Model Context Protocol (MCP) to connect AI agents and coding assistants — including Claude Code, Cursor, VS Code Copilot, GitHub Copilot CLI, and Gemini CLI — directly to your Postman workspaces, collections, specifications, and environments.

Postman also offers the server as an npm package.

For the full installation guide with agent-specific setup, see Postman's MCP Server product page.

Postman MCP Server collection

The Postman MCP Server collection is the quickest way to explore, test, and connect to the Postman MCP Server. Use it to:

Browse the complete list of available tools across all configurations.
Connect to and test the remote server — Full and Minimal.
Connect to and test the local server.

Tool configurations

Minimal — (Default) Only includes essential tools for basic Postman operations. Ideal for users who want to modify a single Postman element, such as collections, workspaces, or environments.
Code — Includes tools to generate high-quality, well-organized client code from public and internal API definitions. Ideal for users who need to consume APIs or get API context to their agents.
Full — Includes all available Postman API tools (100+ tools). Ideal for users who engage in advanced collaboration and Postman's Enterprise features.
Learn — Searches Postman Docs for guides, tutorials, and reference content. Ideal for agents who need to discover Postman features, look up API concepts, or find learning resources.

Authentication

For the best developer experience and fastest setup, use OAuth on the remote server (https://mcp.postman.com). OAuth is fully compliant with the MCP Authorization specification and requires no manual API key configuration.

The EU remote server and the local server support only Postman API key authentication.

Quick start

Remote (any OAuth-compatible MCP host):

Add this URL to your MCP host's configuration:

https://mcp.postman.com/minimal

Change /minimal to /code or /mcp for Code or Full mode. For EU or API key auth, pass Authorization: Bearer <POSTMAN_API_KEY> as a header.

Local:

npx @postman/postman-mcp-server

Add --code or --full for Code or Full mode. Set POSTMAN_API_KEY as an environment variable.

For IDE-specific setup instructions, see the following table. For more information, see the Postman MCP Server docs.

Supported agents and IDEs

Agent / IDE	Remote	Local
Claude Code	Docs	Docs
Claude Desktop	Docs	Docs
Cursor	[Docs](https://learning.postman.com/docs/reference/postman-api/postman-mc

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

95/100across 5 weighted dimensions

How we score →

0255075100

−5

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

1 open

MAL-2025-190909info

Malicious code in @postman/postman-mcp-server (npm)

source →

Inventory

Tools (4)

Click any tool to inspect its schema.

~252 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is com.postman/postman-mcp-server safe to use?: com.postman/postman-mcp-server has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "@postman/postman-mcp-server". Review the Security section above for details before installing.
How do I install com.postman/postman-mcp-server?: com.postman/postman-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can com.postman/postman-mcp-server do?: com.postman/postman-mcp-server provides 4 tools: Authentication, Docker, Contributing, Keywords. See the full tools list on the server page for descriptions and parameters.
What AI clients work with com.postman/postman-mcp-server?: com.postman/postman-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is com.postman/postman-mcp-server actively maintained?: com.postman/postman-mcp-server is actively maintained - last commit was 0 days ago. It has 329 GitHub stars.