Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 6
- 4 10
- 3 1
- 2 0
- 1 0
Trust in production
- Trust it - 65%
- With caveats - 35%
- Wouldn't - 0%
100% would recommend this server
How reviewers scored it
- Setup & docs 4.2
- Auth experience 3.9
- Reliability 4.2
- Maintainer responsiveness 4.1
Why it got an A
Postman's own Apache-2.0 server, with an OAuth-first hosted endpoint in the US (OAuth with PKCE) and a local npm package, released every week or two. The default Minimal mode keeps the tool list small; Full mode adds 100+ tools, including deletes for collections, specs and workspaces. In November 2025 the Shai-Hulud worm published three malicious npm versions (2.4.10 to 2.4.12); they are gone from npm, so pin a current version. Biggest deduction: neither OAuth nor API keys can be limited to read-only, and the EU and local servers need a full-account API key.
How to connect
// .cursor/mcp.json (hosted, OAuth)
{ "mcpServers": { "postman": { "url": "https://mcp.postman.com/minimal" } } }// .vscode/mcp.json (hosted, OAuth sign-in)
{ "servers": { "postman": { "type": "http", "url": "https://mcp.postman.com/minimal" } } }claude mcp add --transport http postman https://mcp.postman.com/minimalIs Postman MCP Server safe?
Is Postman MCP Server safe to use?
Postman MCP Server grades A (strong public trust signals). Login is required, but access is coarse: one sign-in or key covers more than your agent needs, so grant the narrowest account you can.
Does Postman MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Postman MCP Server support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Developer Tools
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
- A Dynatrace Remote MCP ServerDynatrace's hosted MCP server, running inside your Dynatrace SaaS environment, to run and explain DQL, look into problems, vulnerabilities and Kubernetes events, and forecast time series.
- A GitHub MCP ServerOfficial GitHub server for repos, issues, pull requests, Actions, and code security, hosted or local.
- A GitLab MCP ServerGitLab's built-in MCP server for projects, merge requests, work items, code, and CI pipelines, on GitLab.com or your own instance.
Embed this badge
[](https://trustedmcp.io/servers/postman-mcp-server)<a href="https://trustedmcp.io/servers/postman-mcp-server"><img src="https://trustedmcp.io/badge/postman-mcp-server.svg" alt="TrustedMCP grade A" height="80"></a>Community reviews
Recommended it to two teams already
Tried it on a side project first, then rolled it out at work. Scoped the token to just what the agent needs and it respected that. Being official from Postman counts for a lot when I pitch it to security.
Used for Generating boilerplate from existing patterns
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Good defaults, good docs
Set this up for our team after comparing a few options. Being official from Postman counts for a lot when I pitch it to security. I like that access goes through a proper sign-in instead of a long-lived secret on disk.
Used for Debugging sessions in Cursor
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Earned a permanent spot in my config
Started with it as an experiment, now it is a fixture. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Scoped the token to just what the agent needs and it respected that.
Used for Keeping project tickets in sync with code changes
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Saves me a context switch every hour
Set this up for our team after comparing a few options. The OAuth flow worked first time in Claude Code. Releases come often and the changelog is clear. Sign-in flow was painless and I never had to paste a key into a config file.
Used for Letting a coding agent open and triage issues
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Worth the five minutes to set up
Simple to set up in Cursor, simple to reason about. Auth is handled properly, and revoking access later was one click. The API key sits in the config file, so I made a dedicated key with minimal permissions. Easy recommendation.
Used for Onboarding new devs with an agent that answers repo questions
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Clean integration, sensible permissions
Installed it on a Friday, it was part of my workflow by Monday. Scoped the token to just what the agent needs and it respected that. Being official from Postman counts for a lot when I pitch it to security. You can tell it is actively maintained, the rough edges keep getting fixed.
Used for CI failure investigation
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Surprisingly polished
I use this almost daily. Scoped the token to just what the agent needs and it respected that. You can tell it is actively maintained, the rough edges keep getting fixed. It is in our production agent and I sleep fine.
Used for Scripting routine maintenance tasks
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Better than the DIY script it replaced
Hooked Postman MCP Server into Claude Code and it worked on the first try. Read-only mode is the first thing I enable, and it covers most of what I need. Happy to run it in production.
Used for Automating release notes
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Does what it says, no drama
I use this almost daily. Filed an issue and got a reply within two days. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Sign-in flow was painless and I never had to paste a key into a config file.
Used for Looking up Postman data without leaving the editor
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 5/5
The Postman integration I wanted
Hooked Postman MCP Server into Claude Code and it worked on the first try. Updates land regularly, and nothing broke when I upgraded. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Nice to use something maintained by Postman rather than a random fork. Fine in production if you sandbox it.
Used for Internal developer assistant
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 3/5
- Maintainer responsiveness 4/5
No complaints after a month
Our agents call this dozens of times a day. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Scoped the token to just what the agent needs and it respected that. Would recommend without hesitation.
Used for Letting a coding agent open and triage issues
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Trustworthy enough for real work
Replaced a homegrown script with Postman MCP Server and have not looked back. Filed an issue and got a reply within two days. Nice to use something maintained by Postman rather than a random fork. Recommended, with sensible guardrails.
Used for Internal developer assistant
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 4/5
OK for read-only work
Mostly reliable, with the odd timeout. Auth is handled properly, and revoking access later was one click. Worth it, just do not skip the hardening steps.
Used for Code review summaries for pull requests
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Easy win for our agent setup
Clear tool names, sensible outputs, very few surprises. Gave it its own API key so I can revoke it without breaking anything else. Releases come often and the changelog is clear. Good choice if you need Postman in your agent.
Used for Debugging sessions in Cursor
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Quietly reliable
Been running this for about a month now. The OAuth flow worked first time in Claude Code. I like that access goes through a proper sign-in instead of a long-lived secret on disk.
Used for Pairing with Claude Code on a monorepo
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Our team uses it every day
Started with it as an experiment, now it is a fixture. Sign-in flow was painless and I never had to paste a key into a config file.
Used for Keeping project tickets in sync with code changes
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Solid and well behaved
Of the Postman integrations I tried, this one is the most predictable. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. I would use it in prod, but only with a human approving writes.
Used for Scripting routine maintenance tasks
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 3/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.