Skip to main content
mcpSource-backed

Postman MCP Server for Claude

Official Postman MCP Server for connecting Claude, Codex, Cursor, VS Code, Gemini CLI, and other MCP clients to Postman workspaces, collections, specifications, mocks, monitors, environments, API definitions, and code generation workflows.

by Postman · submitted by oktofeesh1·added 2026-06-04·
Review first review before installing

Open the source and read safety notes before installing.

Citation facts

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Source URLs
https://learning.postman.com/docs/reference/postman-api/postman-mcp-server/overview, https://github.com/postmanlabs/postman-mcp-server, https://www.postman.com/
Safety notes
Postman MCP can operate on real Postman resources. Treat collection edits, workspace changes, environment updates, monitor changes, mock changes, specification creation, documentation updates, and generated code as review-required operations., Start with the `minimal` remote endpoint when the task only needs basic Postman operations. Use `code` or `full` only after reviewing the broader tool surface and the resources exposed to the assistant., The `full` configuration exposes all available Postman API tools, which Postman documents as 100+ tools. Do not use it by default for exploratory chats or untrusted repositories., Postman recommends reviewing and confirming operations that make changes or are destructive. Require a human check before accepting assistant-generated deletes, bulk updates, monitor edits, mock edits, documentation rewrites, collection rewrites, or spec-to-code changes., Pass specific resource IDs when possible. Postman notes this reduces extra API calls and helps avoid the assistant selecting the wrong workspace, collection, environment, monitor, mock, or specification by name., Local stdio and Docker modes run the Postman MCP server on the user's machine and require a Postman API key. Pin the npm package version or Docker image when reproducibility matters, and keep credentials out of committed MCP configs., EU remote endpoints do not support OAuth according to Postman's docs; use API-key authentication there and verify the region before connecting customer or regulated API assets.
Privacy notes
Tool calls can expose Postman workspace metadata, collection names, request URLs, headers, examples, documentation, comments, environments, variable names, API specifications, mocks, monitors, and generated code context to the connected AI client., Environment variables and collection variables may contain credentials, internal hostnames, customer identifiers, test tokens, bearer tokens, session cookies, webhook URLs, or staging API details. Scrub secrets before pasting raw Postman data into prompts, issues, tickets, or chat tools., OAuth grants and Postman API keys represent a real Postman identity. Rotate exposed API keys, remove stale MCP configs, and audit workspace membership when a project or assistant no longer needs access., Claude, Codex, IDE logs, MCP client transcripts, terminal history, screenshots, generated code, and support bundles can retain Postman-derived API details outside Postman's normal access controls., The remote server sends MCP requests to Postman-hosted endpoints. Local stdio and Docker modes still call Postman APIs with the configured API key when managing cloud-hosted Postman resources.
Author
Postman
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-04

Decision playbook

Review trust signals before you adopt

Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.

Compare context
Selected

0

Current score

78

Baseline

Delta

No baseline selected

No major trust-signal divergence detected in the current selection.

Source and provenance checks

Complete

Confirm ownership and provenance before trusting install instructions.

  • Source link availableRequired

    Open the canonical repository and verify ownership.

    Done
  • Source provenance statusRequired

    Marked as source-backed.

    Done
  • Metadata reviewed

    Registry metadata indicates a reviewed listing.

    Done

Safety and privacy checks

Complete

Validate risk disclosures before installation or API wiring.

  • Safety notes presentRequired

    Review the listed safety guidance before running commands.

    Done
  • Privacy notes presentRequired

    Review data handling notes before connecting accounts or secrets.

    Done
  • Trust level risk gateRequired

    Trust level does not block evaluation.

    Done

Package and install checks

Needs review

Check package metadata and artifact integrity signals.

  • Install payload available

    Install or copy payload is available for review.

    Done
  • Package verification flag

    No package verification flag provided.

    Pending
  • Checksum metadata

    No checksum provided for downloaded artifact.

    Pending

Compare-driven decision checks

Needs review

Use compare context to validate trade-offs before adoption.

  • Compare tray has multiple entries

    Add at least one more entry to compare trust differences.

    Pending
  • Baseline comparison available

    No baseline peer selected yet.

    Pending
  • Diverging trust signals identified

    No major trust-signal divergence found.

    Pending

Setup at a glance

CLI install

Copy-ready — paste the snippet to get started.

15 minutes

Adoption plan

Balanced adoption plan

Current risk score 16/100. Use staged verification before broader rollout.

Risk 16

Pre-adoption checks

Validate source and review signals before any execution.

  • Confirm source provenanceRequired

    Source URL/provenance metadata is present.

    Done
  • Confirm metadata review state

    Listing has review metadata.

    Done
  • Verify install payload

    Install/config payload exists and can be inspected.

    Done

Security checks

Confirm safety, privacy, and package integrity signals.

  • Review safety notesRequired

    Safety notes are present.

    Done
  • Review privacy notesRequired

    Privacy notes are present.

    Done
  • Verify package integrity metadata

    No package verification/checksum metadata.

    Pending

Rollout

Adopt in controlled steps based on the selected plan.

  • Run in isolated sandbox firstRequired

    Use a constrained sandbox and observe behavior across multiple tasks.

    Pending
  • Roll out graduallyRequired

    Roll out to a small cohort before wider usage.

    Pending
  • Set monitoring and fallback

    Define rollback path and monitor errors after adoption.

    Pending

Evidence readiness

Evidence readiness matrix · balanced

Required evidence gates are covered (5/6 signals complete).

Risk 15

Source provenance

Present

Source repository/provenance is listed.

Required in this preset

Metadata review

Present

Review metadata is present.

Required in this preset

Safety notes

Present

Safety notes are present.

Required in this preset

Privacy notes

Present

Privacy notes are present.

Optional in this preset

Package integrity

Missing

Package integrity metadata is missing.

Optional in this preset

Install payload

Present

Install payload is available.

Required in this preset

Required evidence gates are covered for this preset.

Decision timeline

Decision timeline · balanced

5/6 steps complete with no blocking gaps for this preset.

Risk 14

triage

Confirm source provenanceRequired

Source/provenance metadata is available.

Done

triage

Check metadata review statusRequired

Review metadata is available.

Done

verify

Review safety notesRequired

Safety notes are available.

Done

verify

Review privacy notes

Privacy notes are available.

Done

verify

Validate package integrity metadata

Package integrity metadata is missing.

Pending

rollout

Verify install payload and commandsRequired

Install payload is available.

Done

No required blockers for this timeline preset.

Prerequisite readiness

Prerequisite readiness

6 prerequisites to line up before setup. Have accounts and credentials ready first.

0/6 ready
Account & credentials3Install & runtime2Configuration115 minutes

Safety & privacy surface

Safety & privacy surface

7 safety and 5 privacy notes across 5 risk areas. Review closely: credentials & tokens, permissions & scopes, network access.

5 areas
  • SafetyGeneralPostman MCP can operate on real Postman resources. Treat collection edits, workspace changes, environment updates, monitor changes, mock changes, specification creation, documentation updates, and generated code as review-required operations.
  • SafetyNetwork accessStart with the `minimal` remote endpoint when the task only needs basic Postman operations. Use `code` or `full` only after reviewing the broader tool surface and the resources exposed to the assistant.
  • SafetyGeneralThe `full` configuration exposes all available Postman API tools, which Postman documents as 100+ tools. Do not use it by default for exploratory chats or untrusted repositories.
  • SafetyExecution & processesPostman recommends reviewing and confirming operations that make changes or are destructive. Require a human check before accepting assistant-generated deletes, bulk updates, monitor edits, mock edits, documentation rewrites, collection rewrites, or spec-to-code changes.
  • SafetyNetwork accessPass specific resource IDs when possible. Postman notes this reduces extra API calls and helps avoid the assistant selecting the wrong workspace, collection, environment, monitor, mock, or specification by name.
  • SafetyCredentials & tokensLocal stdio and Docker modes run the Postman MCP server on the user's machine and require a Postman API key. Pin the npm package version or Docker image when reproducibility matters, and keep credentials out of committed MCP configs.
  • SafetyCredentials & tokensEU remote endpoints do not support OAuth according to Postman's docs; use API-key authentication there and verify the region before connecting customer or regulated API assets.
  • PrivacyNetwork accessTool calls can expose Postman workspace metadata, collection names, request URLs, headers, examples, documentation, comments, environments, variable names, API specifications, mocks, monitors, and generated code context to the connected AI client.
  • PrivacyCredentials & tokensEnvironment variables and collection variables may contain credentials, internal hostnames, customer identifiers, test tokens, bearer tokens, session cookies, webhook URLs, or staging API details. Scrub secrets before pasting raw Postman data into prompts, issues, tickets, or chat tools.
  • PrivacyCredentials & tokensOAuth grants and Postman API keys represent a real Postman identity. Rotate exposed API keys, remove stale MCP configs, and audit workspace membership when a project or assistant no longer needs access.
  • PrivacyPermissions & scopesClaude, Codex, IDE logs, MCP client transcripts, terminal history, screenshots, generated code, and support bundles can retain Postman-derived API details outside Postman's normal access controls.
  • PrivacyCredentials & tokensThe remote server sends MCP requests to Postman-hosted endpoints. Local stdio and Docker modes still call Postman APIs with the configured API key when managing cloud-hosted Postman resources.

Safety notes

  • Postman MCP can operate on real Postman resources. Treat collection edits, workspace changes, environment updates, monitor changes, mock changes, specification creation, documentation updates, and generated code as review-required operations.
  • Start with the `minimal` remote endpoint when the task only needs basic Postman operations. Use `code` or `full` only after reviewing the broader tool surface and the resources exposed to the assistant.
  • The `full` configuration exposes all available Postman API tools, which Postman documents as 100+ tools. Do not use it by default for exploratory chats or untrusted repositories.
  • Postman recommends reviewing and confirming operations that make changes or are destructive. Require a human check before accepting assistant-generated deletes, bulk updates, monitor edits, mock edits, documentation rewrites, collection rewrites, or spec-to-code changes.
  • Pass specific resource IDs when possible. Postman notes this reduces extra API calls and helps avoid the assistant selecting the wrong workspace, collection, environment, monitor, mock, or specification by name.
  • Local stdio and Docker modes run the Postman MCP server on the user's machine and require a Postman API key. Pin the npm package version or Docker image when reproducibility matters, and keep credentials out of committed MCP configs.
  • EU remote endpoints do not support OAuth according to Postman's docs; use API-key authentication there and verify the region before connecting customer or regulated API assets.

Privacy notes

  • Tool calls can expose Postman workspace metadata, collection names, request URLs, headers, examples, documentation, comments, environments, variable names, API specifications, mocks, monitors, and generated code context to the connected AI client.
  • Environment variables and collection variables may contain credentials, internal hostnames, customer identifiers, test tokens, bearer tokens, session cookies, webhook URLs, or staging API details. Scrub secrets before pasting raw Postman data into prompts, issues, tickets, or chat tools.
  • OAuth grants and Postman API keys represent a real Postman identity. Rotate exposed API keys, remove stale MCP configs, and audit workspace membership when a project or assistant no longer needs access.
  • Claude, Codex, IDE logs, MCP client transcripts, terminal history, screenshots, generated code, and support bundles can retain Postman-derived API details outside Postman's normal access controls.
  • The remote server sends MCP requests to Postman-hosted endpoints. Local stdio and Docker modes still call Postman APIs with the configured API key when managing cloud-hosted Postman resources.

Prerequisites

  • Postman account with access to the workspaces, collections, specifications, mocks, monitors, and environments the assistant should inspect or manage.
  • MCP-capable client such as Claude Code, Claude Desktop, Codex CLI, Cursor, VS Code, Windsurf, Gemini CLI, Kiro, or another compatible environment.
  • Authentication choice: OAuth for the US remote server when the MCP client supports it, or a Postman API key for EU remote, local stdio, Docker, or API-key fallback setup.
  • Tool-mode choice: `minimal` for essential Postman operations, `code` for API-definition search and client-code generation, or `full` for the complete Postman API tool surface.
  • Region choice: US endpoints under `mcp.postman.com`, EU endpoints under `mcp.eu.postman.com`, or local stdio with `--region eu` / `POSTMAN_API_BASE_URL`.
  • Resource IDs, workspace names, collection names, environment names, or spec names ready when the task needs precise changes.

Schema details

Install type
cli
Troubleshooting
No
Source repository stats
Scope
Source repo
Collection metadata
Estimated setup
15 minutes
Difficulty
intermediate
Tool listing metadata
Full copyable content
{
  "mcpServers": {
    "postman": {
      "type": "http",
      "url": "https://mcp.postman.com/minimal"
    }
  }
}

About this resource

Content

Postman MCP Server is Postman's official Model Context Protocol server for letting AI agents work with Postman resources. It connects MCP clients such as Claude, Codex, Cursor, VS Code, Gemini CLI, Windsurf, Kiro, and GitHub Copilot CLI to Postman workspaces, collections, specifications, mocks, monitors, environments, API definitions, and code-generation workflows.

The safest starting point is the remote minimal endpoint with OAuth in a US Postman account. Move to the code endpoint when the task is API-definition search or client-code generation, and use full only when the assistant truly needs the complete Postman API tool surface. For EU accounts, local stdio, or API-key fallback, keep the Postman API key out of committed configuration and review every write operation before accepting it.

Features

  • Official Postman MCP Server documented by Postman.
  • Remote streamable HTTP server hosted by Postman.
  • Local stdio server available through the Postman MCP Server GitHub repository, npm package, and Docker image.
  • US remote endpoints with OAuth support for clients that implement the MCP authorization flow.
  • EU remote endpoints with API-key authentication.
  • Tool configurations for minimal, code, and full modes.
  • Full mode with 100+ available Postman API tools.
  • Code mode for searching public and internal API definitions and generating client code.
  • Minimal mode for essential Postman operations with smaller context and faster setup.
  • Client setup docs for Claude Code, Codex, Cursor, VS Code, Windsurf, Antigravity, GitHub Copilot CLI, Gemini CLI, and Kiro.
  • Best-practice guidance for using explicit resource IDs, confirming destructive changes, and telling the assistant to use Postman MCP instead of curl or the Postman CLI.

Use Cases

  • Ask Claude to inspect a Postman workspace, list collections, and summarize API documentation gaps before a release review.
  • Create or update Postman Collections from an API specification, then review the generated collection before publishing it.
  • Keep code and Postman specifications synchronized by asking the assistant to compare repository changes with a named Postman spec.
  • Update collection documentation, request examples, or comments after an API endpoint changes.
  • Create or update environments and variables for local, staging, or test API workflows after a human approves the exact values.
  • Use Code mode to search API definitions and generate client code from public or internal APIs.
  • Review monitors and mocks attached to a workspace before changing API test or mock behavior.

Installation

Claude Code

For the US remote server with OAuth, start with Minimal mode:

claude mcp add --transport http postman https://mcp.postman.com/minimal

Use Code or Full mode only when needed:

claude mcp add --transport http postman https://mcp.postman.com/code
claude mcp add --transport http postman https://mcp.postman.com/mcp

For API-key setup, including EU endpoints, pass a bearer token header and keep the key out of committed shell history and project files:

claude mcp add --transport http postman https://mcp.eu.postman.com/minimal --header "Authorization: Bearer <POSTMAN_API_KEY>"

Codex

For OAuth on the US remote server:

codex mcp add postman --remote-url https://mcp.postman.com/minimal

For API-key or local stdio setup, pin the package version after checking the current Postman docs and npm metadata:

codex mcp add postman --env POSTMAN_API_KEY=<POSTMAN_API_KEY> -- npx -y @postman/postman-mcp-server@2.8.9 --minimal

Manual Codex config:

[mcp_servers.postman-mcp-server]
command = "npx"
args = ["-y", "@postman/postman-mcp-server@2.8.9", "--minimal"]

[mcp_servers.postman-mcp-server.env]
POSTMAN_API_KEY = "<POSTMAN_API_KEY>"

VS Code

For OAuth with a remote server:

{
  "servers": {
    "postman": {
      "type": "http",
      "url": "https://mcp.postman.com/minimal"
    }
  }
}

For API-key authentication:

{
  "servers": {
    "postman": {
      "type": "http",
      "url": "https://mcp.postman.com/minimal",
      "headers": {
        "Authorization": "Bearer ${input:postman-api-key}"
      }
    }
  },
  "inputs": [
    {
      "id": "postman-api-key",
      "type": "promptString",
      "description": "Enter your Postman API key"
    }
  ]
}

Tool Modes

  • minimal: default remote mode for essential Postman operations.
  • code: API-definition search and client-code generation.
  • full: complete Postman API tool surface, documented by Postman as 100+ tools.
  • quiet: local stdio option that suppresses debug and info logs; Postman documents it as useful for avoiding a Windows Windsurf startup timeout.

Remote US endpoints:

  • https://mcp.postman.com/minimal
  • https://mcp.postman.com/code
  • https://mcp.postman.com/mcp

Remote EU endpoints:

  • https://mcp.eu.postman.com/minimal
  • https://mcp.eu.postman.com/code
  • https://mcp.eu.postman.com/mcp

Examples

Inspect a workspace

When interacting with Postman resources, use the Postman MCP server. List collections in workspace <WORKSPACE_ID> and summarize stale documentation without making changes.

Update collection docs

Use Postman MCP to draft documentation updates for collection <COLLECTION_ID>. Show the proposed diff and wait for approval before applying it.

Sync a specification

Compare the OpenAPI changes in this branch with Postman spec <SPEC_ID>. Tell me what would change in the generated collection before updating anything.

Generate client code

Use Postman MCP Code mode to find the API definition for this endpoint and generate a TypeScript client example. Do not modify Postman resources.

Source Notes

  • Postman's overview describes the Postman MCP Server as a way for AI agents such as Claude, Cursor, and VS Code to manage Postman workspaces, collections, specifications, mocks, and monitors.
  • Postman's overview links the official Postman MCP Server GitHub repository and the Postman MCP Server collection.
  • Postman's remote setup guide documents streamable HTTP endpoints, OAuth for the US remote server, API-key fallback, EU API-key-only behavior, and Minimal, Code, and Full tool configurations.
  • Postman's local setup guide documents stdio transport, API-key-only local authentication, npm package, Docker image, region selection, Minimal, Code, Full, and Quiet modes.
  • Postman's best-practices page recommends telling the assistant to use Postman MCP, reviewing destructive operations, and passing resource IDs to reduce API calls and avoid ambiguous resource selection.
  • The npm package metadata checked at submission time showed @postman/postman-mcp-server@2.8.9, Node.js >=20.0.0, MCP package name com.postman/postman-mcp-server, and repository https://github.com/postmanlabs/postman-mcp-server.

Duplicate Check

Checked current upstream/main, open PR titles, open PR changed files, source URLs, and content files for Postman MCP, postman-mcp-server, mcp.postman.com, mcp.eu.postman.com, @postman/postman-mcp-server, postmanlabs/postman-mcp-server, getmcp, and the Postman MCP docs and collection URLs. Existing content only contains generic mcpServers code variable names in a GitHub Copilot interoperability entry; no dedicated Postman MCP Server entry, Postman MCP source URL duplicate, or open content PR for this server was found.

Editorial Disclosure

Postman is a commercial API platform, but this listing is not sponsored, paid, affiliate-backed, or submitted by Postman. Use Postman's current docs, package metadata, account permissions, region requirements, privacy terms, and workspace policies as the source of truth before connecting API assets to any AI client.

Source citations

Add this badge to your README

Show that Postman MCP Server for Claude is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/mcp/postman-mcp-server.svg)](https://heyclau.de/entry/mcp/postman-mcp-server)

How it compares

Postman MCP Server for Claude side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

1 trust signal differ across this comparison (Submitter).

Field

Official Postman MCP Server for connecting Claude, Codex, Cursor, VS Code, Gemini CLI, and other MCP clients to Postman workspaces, collections, specifications, mocks, monitors, environments, API definitions, and code generation workflows.

Open dossier

Explore OpenAPI and Swagger specifications from Claude through a hosted MCP server that returns API overviews and per-operation schema details.

Open dossier

Connect Claude to Twilio's hosted MCP server for read-only search and retrieval across public Twilio API specifications, Twilio Docs, SendGrid Docs, Segment Docs, and support articles.

Open dossier

Manage Webflow sites, pages, CMS collections, collection items, assets, and forms from Claude — with the official Webflow MCP server that connects AI agents to the Webflow Data API via OAuth.

Open dossier
Next steps
Trust
Review statusReviewedMaintainer reviewedReviewedMaintainer reviewedReviewedMaintainer reviewedReviewedMaintainer reviewed
Package trustPackage not verifiedPackage not verifiedPackage not verifiedPackage not verified
Source provenanceSource-backedSource-backedSource-backedSource-backed
SubmitterDiffersoktofeesh1oktofeesh1MkDev11
Install riskReview firstReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
Brand
Categorymcpmcpmcpmcp
SourceSource-backedSource-backedSource-backedSource-backed
AuthorPostmanJan WilmakeTwilioWebflow
Added2026-06-042026-06-032026-06-052026-06-18
Platforms
Harness
Source repo
Safety notesPostman MCP can operate on real Postman resources. Treat collection edits, workspace changes, environment updates, monitor changes, mock changes, specification creation, documentation updates, and generated code as review-required operations. Start with the `minimal` remote endpoint when the task only needs basic Postman operations. Use `code` or `full` only after reviewing the broader tool surface and the resources exposed to the assistant. The `full` configuration exposes all available Postman API tools, which Postman documents as 100+ tools. Do not use it by default for exploratory chats or untrusted repositories. Postman recommends reviewing and confirming operations that make changes or are destructive. Require a human check before accepting assistant-generated deletes, bulk updates, monitor edits, mock edits, documentation rewrites, collection rewrites, or spec-to-code changes. Pass specific resource IDs when possible. Postman notes this reduces extra API calls and helps avoid the assistant selecting the wrong workspace, collection, environment, monitor, mock, or specification by name. Local stdio and Docker modes run the Postman MCP server on the user's machine and require a Postman API key. Pin the npm package version or Docker image when reproducibility matters, and keep credentials out of committed MCP configs. EU remote endpoints do not support OAuth according to Postman's docs; use API-key authentication there and verify the region before connecting customer or regulated API assets.The current server exposes OpenAPI exploration tools, not a general API execution tool. It returns overviews and operation details from specs rather than calling the target API endpoints. Treat OpenAPI specs as potentially sensitive. Internal paths, request schemas, server URLs, security schemes, operation names, and business domain language can reveal system design. Do not point the hosted endpoint at private or pre-release OpenAPI specs unless the spec is approved for third-party processing. Self-host the Worker for private API contracts. Review operation details before asking Claude to write integration code. OpenAPI descriptions and examples are model context and can contain stale, incomplete, or user-controlled text. Swagger 2.0 specs may be converted through the Swagger converter service before the server returns operation details. Use OpenAPI 3.x specs directly when you want fewer intermediaries.Twilio describes the current hosted MCP server as a Public Beta. Treat tool behavior, indexed coverage, and connection instructions as changeable until Twilio declares general availability. The current hosted server is read-only and exposes search/retrieve tools for public API specifications and documentation. It does not execute Twilio API calls or send messages on your behalf. Do not confuse documentation retrieval with production readiness. Review generated Messaging, Voice, Verify, SendGrid, Segment, or other Twilio code against the canonical docs, product limits, regulatory requirements, and your normal approval process before running it. Future Twilio MCP releases may add OAuth-authenticated execute-ready tools. Re-review permissions, approval prompts, audit logging, and data handling before enabling any tool that can call live APIs. Keep MCP client approval settings enabled for prompts that might transform retrieved API schemas into runnable code, migration scripts, webhook handlers, message sends, or account-management actions.CMS collection item create, update, and delete operations write directly to your Webflow project — confirm before applying changes to live sites. Publishing operations make content publicly visible immediately; review changes before asking Claude to publish. The remote server requires OAuth authorization — you control which sites Claude can access during the OAuth flow.
Privacy notesTool calls can expose Postman workspace metadata, collection names, request URLs, headers, examples, documentation, comments, environments, variable names, API specifications, mocks, monitors, and generated code context to the connected AI client. Environment variables and collection variables may contain credentials, internal hostnames, customer identifiers, test tokens, bearer tokens, session cookies, webhook URLs, or staging API details. Scrub secrets before pasting raw Postman data into prompts, issues, tickets, or chat tools. OAuth grants and Postman API keys represent a real Postman identity. Rotate exposed API keys, remove stale MCP configs, and audit workspace membership when a project or assistant no longer needs access. Claude, Codex, IDE logs, MCP client transcripts, terminal history, screenshots, generated code, and support bundles can retain Postman-derived API details outside Postman's normal access controls. The remote server sends MCP requests to Postman-hosted endpoints. Local stdio and Docker modes still call Postman APIs with the configured API key when managing cloud-hosted Postman resources.The hosted MCP endpoint receives the API identifier or raw spec URL you ask Claude to inspect, plus the operationId or route requested through `getApiOperation`. The service fetches OpenAPI documents via OpenAPI Search/OAPIS redirects or from the raw spec URL you provide. Returned overviews and operation details can include endpoint paths, parameters, request bodies, response schemas, server URLs, security scheme names, examples, and descriptions in the model conversation. The public setup path does not require API credentials and should not be used to send API keys, Bearer tokens, cookies, or internal auth headers. The repository is deployed as a Cloudflare Worker. Hosted-service logging, retention, and operational access are controlled by the service operator. Self-host when you need your own logging and retention boundary.The hosted endpoint can receive your natural-language search queries, requested API IDs, product interests, integration plans, and troubleshooting topics through the MCP client. Returned documentation can enter the model conversation alongside your prompt, code, route names, environment names, webhook examples, or product decisions. Do not paste Twilio Account SIDs, Auth Tokens, API keys, SendGrid keys, Segment write keys, phone numbers, customer identifiers, message bodies, call recordings, transcripts, or production webhook payloads into prompts while using the public docs server. Use synthetic examples when asking Claude to draft Messaging, Voice, Verify, SendGrid, Segment, or support workflows from retrieved docs.Site structure, page content, CMS collection schemas, collection items, form submissions, and asset metadata from your Webflow workspace are surfaced in Claude's context. OAuth authentication scopes access to specific sites you authorize — no credentials are stored in your MCP config when using the remote server.
Prerequisites
  • Postman account with access to the workspaces, collections, specifications, mocks, monitors, and environments the assistant should inspect or manage.
  • MCP-capable client such as Claude Code, Claude Desktop, Codex CLI, Cursor, VS Code, Windsurf, Gemini CLI, Kiro, or another compatible environment.
  • Authentication choice: OAuth for the US remote server when the MCP client supports it, or a Postman API key for EU remote, local stdio, Docker, or API-key fallback setup.
  • Tool-mode choice: `minimal` for essential Postman operations, `code` for API-definition search and client-code generation, or `full` for the complete Postman API tool surface.
  • MCP-capable client with remote HTTP transport support, such as Claude Code or another modern MCP client
  • Network access to `https://openapi-mcp.openapisearch.com/mcp`
  • OpenAPI Search identifier, OAPIS identifier, or raw OpenAPI spec URL for the API you want Claude to inspect
  • Understanding that the hosted service fetches and processes the OpenAPI spec instead of running locally in your project
  • MCP-capable client with remote HTTP transport support, such as Claude Code, Claude Desktop connector support, Cursor, OpenCode, Codex, or another compatible client
  • Network access to `https://mcp.twilio.com/docs`
  • Agreement that the current hosted Twilio MCP server should receive the Twilio, SendGrid, or Segment documentation questions your team asks through the MCP client
  • Separate Twilio, SendGrid, or Segment account credentials only when you later write or run application code outside this read-only MCP server
  • A Webflow account — authenticate via OAuth on first use when using the remote server.
  • For the local server: Node.js 22.3.0+ and a Webflow API token from Account Settings → Integrations → API Access.
  • An MCP client such as Claude Code or Claude Desktop.
Install
claude mcp add --transport http postman https://mcp.postman.com/minimal
claude mcp add --transport http openapi https://openapi-mcp.openapisearch.com/mcp
claude mcp add --transport http twilio-docs https://mcp.twilio.com/docs
claude mcp add --transport http webflow https://mcp.webflow.com/sse
Config
{
  "mcpServers": {
    "postman": {
      "type": "http",
      "url": "https://mcp.postman.com/minimal"
    }
  }
}
{
  "mcpServers": {
    "openapi": {
      "url": "https://openapi-mcp.openapisearch.com/mcp",
      "type": "http"
    }
  }
}
{
  "mcpServers": {
    "twilio-docs": {
      "url": "https://mcp.twilio.com/docs",
      "type": "http"
    }
  }
}
{
  "mcpServers": {
    "webflow": {
      "command": "npx",
      "args": ["webflow-mcp-server"],
      "env": {
        "WEBFLOW_TOKEN": "your-webflow-api-token"
      }
    }
  }
}
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed
Open 4 picks in the interactive comparison tool

Related guides

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.