Is com.postman/postman-mcp-server safe to use?

com.postman/postman-mcp-server has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "@postman/postman-mcp-server". Review the Security section above for details before installing.

How do I install com.postman/postman-mcp-server?

com.postman/postman-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with com.postman/postman-mcp-server?

com.postman/postman-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses and and and transport.

Is com.postman/postman-mcp-server actively maintained?

com.postman/postman-mcp-server is actively maintained — last commit was 2 days ago. It has 287 GitHub stars.

com.postman/postman-mcp-server

@postman/postman-mcp-server

A basic MCP server to operate on the Postman API.

287 9.3k/wk GitHub npm

1 open CVE

No license

Actively maintained

Last commit 2d ago

Works with most clients

Transport: , , ,

0 tools

Grade F

MCPpedia last refreshed this data 1d ago

Edit this pageView history

Other

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktop, , , · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "com-postman-postman-mcp-server-2": {
      "args": [
        "-y",
        "@postman/postman-mcp-server"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/com-postman-postman-mcp-server-2)](https://mcppedia.org/s/com-postman-postman-mcp-server-2)

Read me

What com.postman/postman-mcp-server does

The Postman MCP Server implements the Model Context Protocol (MCP) to connect AI agents and coding assistants — including Claude Code, Cursor, VS Code Copilot, GitHub Copilot CLI, and Gemini CLI — directly to your Postman workspaces, collections, specifications, and environments.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y '@postman/postman-mcp-server' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

58/100across 5 weighted dimensions

How we score →

0255075100

−42

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

1 open

MAL-2025-190909info

Malicious code in @postman/postman-mcp-server (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c7c276129c0d99cb4f8aa63e9f3911b1f38145837396ac3b00ba48533a6050b8) The package @postman/postman-mcp-server was found to contain malicious code. ## Source: google-open-source-security (0c419e14201055a516cc9ef8dfe3f0ecc29ae793e9b304eeb4da6589465ab1d4) This package was compromised by the Sha1-Hulud: The Second Coming NPM worm. The malicious payload steals tokens and credentials and publishes them to GitHub. T

source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is com.postman/postman-mcp-server safe to use?: com.postman/postman-mcp-server has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "@postman/postman-mcp-server". Review the Security section above for details before installing.
How do I install com.postman/postman-mcp-server?: com.postman/postman-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with com.postman/postman-mcp-server?: com.postman/postman-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses and and and transport.
Is com.postman/postman-mcp-server actively maintained?: com.postman/postman-mcp-server is actively maintained — last commit was 2 days ago. It has 287 GitHub stars.

Similar servers

Others in other

View all →

Headroom95

Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.

62.5k 3

Pi Lean Ctx94

Pi Coding Agent extension (CLI-first) — routes bash/read/grep/find/ls through lean-ctx CLI for strong token savings. Optional MCP bridge can register advanced tools.

3.4k 6

Sigmap94

97% token reduction for AI coding sessions — zero deps, 21 languages, MCP server

604 6

Brigade93

One local source for the MCP servers, tools, and memory your AI coding agents share, synced into each tool's native config with a review gate and a receipt for every change. No daemon, no lock-in.

62 5

MCP Security Weekly

Get CVE alerts and security updates for com.postman/postman-mcp-server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Other

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktop, , , · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "com-postman-postman-mcp-server-2": {
      "args": [
        "-y",
        "@postman/postman-mcp-server"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/com-postman-postman-mcp-server-2)](https://mcppedia.org/s/com-postman-postman-mcp-server-2)

Read me

What com.postman/postman-mcp-server does

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y '@postman/postman-mcp-server' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

Postman MCP Server

The Postman MCP Server implements the Model Context Protocol (MCP) to connect AI agents and coding assistants — including Claude Code, Cursor, VS Code Copilot, GitHub Copilot CLI, and Gemini CLI — directly to your Postman workspaces, collections, specifications, and environments.

Postman also offers the server as an npm package.

For the full installation guide with agent-specific setup, see Postman's MCP Server product page.

Postman MCP Server collection

The Postman MCP Server collection is the quickest way to explore, test, and connect to the Postman MCP Server. Use it to:

Browse the complete list of available tools across all configurations.
Connect to and test the remote server — Full and Minimal.
Connect to and test the local server.

Tool configurations

Minimal — (Default) Only includes essential tools for basic Postman operations. Ideal for users who want to modify a single Postman element, such as collections, workspaces, or environments.
Code — Includes tools to generate high-quality, well-organized client code from public and internal API definitions. Ideal for users who need to consume APIs or get API context to their agents.
Full — Includes all available Postman API tools (100+ tools). Ideal for users who engage in advanced collaboration and Postman's Enterprise features.
Learn — Searches Postman Docs for guides, tutorials, and reference content. Ideal for agents who need to discover Postman features, look up API concepts, or find learning resources.

Authentication

For the best developer experience and fastest setup, use OAuth on the remote server (https://mcp.postman.com). OAuth is fully compliant with the MCP Authorization specification and requires no manual API key configuration.

The EU remote server and the local server support only Postman API key authentication.

Quick start

Remote (any OAuth-compatible MCP host):

Add this URL to your MCP host's configuration:

https://mcp.postman.com/minimal

Change /minimal to /code or /mcp for Code or Full mode. For EU or API key auth, pass Authorization: Bearer <POSTMAN_API_KEY> as a header.

Local:

npx @postman/postman-mcp-server

Add --code or --full for Code or Full mode. Set POSTMAN_API_KEY as an environment variable.

For IDE-specific setup instructions, see the following table. For more information, see the Postman MCP Server docs.

Supported agents and IDEs

Agent / IDE	Remote	Local
Claude Code	Docs	Docs
Claude Desktop	Docs	Docs
Cursor	[Docs](https://learning.postman.com/docs/reference/postman-api/postman-mc

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

58/100across 5 weighted dimensions

How we score →

0255075100

−42

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

1 open

MAL-2025-190909info

Malicious code in @postman/postman-mcp-server (npm)

source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is com.postman/postman-mcp-server safe to use?: com.postman/postman-mcp-server has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "@postman/postman-mcp-server". Review the Security section above for details before installing.
How do I install com.postman/postman-mcp-server?: com.postman/postman-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with com.postman/postman-mcp-server?: com.postman/postman-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses and and and transport.
Is com.postman/postman-mcp-server actively maintained?: com.postman/postman-mcp-server is actively maintained — last commit was 2 days ago. It has 287 GitHub stars.

Similar servers

Others in other

View all →

Headroom95

Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.

62.5k 3

Pi Lean Ctx94

Pi Coding Agent extension (CLI-first) — routes bash/read/grep/find/ls through lean-ctx CLI for strong token savings. Optional MCP bridge can register advanced tools.

3.4k 6

Sigmap94

97% token reduction for AI coding sessions — zero deps, 21 languages, MCP server

604 6

Brigade93

One local source for the MCP servers, tools, and memory your AI coding agents share, synced into each tool's native config with a review gate and a receipt for every change. No daemon, no lock-in.

62 5

MCP Security Weekly

Get CVE alerts and security updates for com.postman/postman-mcp-server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?