Postman MCP Server: Setup for Claude, Cursor and Other Apps

• Creates a new collection

  Creates a collection from a Postman Collection v2.1 definition. Without a workspace it goes into your oldest personal workspace.

  Try: “Create a collection called Orders API with a GET /orders request.”

  Write · createCollection

• Adds a request to a collection

  Adds one request to an existing collection. Postman advises always giving it a name, because a missing name gives a blank request.

  Try: “Add a POST /login request to my Auth collection.”

  Write · createCollectionRequest

• Adds a saved response to a request

  Adds a saved example response under a request in a collection.

  Try: “Save this 404 JSON body as an example response on the Get user request.”

  Write · createCollectionResponse

• Creates an environment

  Creates an environment with its variables, in a workspace you name or your oldest personal workspace.

  Try: “Create a staging environment with base_url set to https://staging.example.com.”

  Write · createEnvironment

• Creates a mock server

  Creates a mock server for a collection. It needs the collection UID (owner ID and collection ID joined), not the bare ID.

  Try: “Spin up a mock server for the Payments collection.”

  Write · createMock

• Creates an API specification

  Creates a spec in Postman Spec Hub from OpenAPI, AsyncAPI, protobuf, GraphQL or Smithy files. A path with a slash makes a folder.

  Try: “Create an OpenAPI 3.1 spec called Inventory API in my team workspace.”

  Write · createSpec

• Adds a file to a specification

  Adds a file to an OpenAPI or protobuf spec. A multi-file spec can have only one root file.

  Try: “Add components/schemas.json to the Inventory API spec.”

  Write · createSpecFile

• Creates a workspace

  Creates a workspace. It fails with a 403 if your team admin has restricted who can create workspaces.

  Try: “Create a team workspace named Mobile APIs.”

  Write · createWorkspace

• Copies a collection to another workspace

  Copies a collection into another workspace as a background task. Check progress with getDuplicateCollectionTaskStatus.

  Try: “Copy the Orders collection into my Sandbox workspace.”

  Write · duplicateCollection

• Builds a collection from a spec

  Creates a collection from an API spec that already exists. It returns a link to poll for the task result.

  Try: “Generate a collection from the Inventory API spec.”

  Write · generateCollection

• Builds a spec from a collection

  Generates an OpenAPI 2.0, 3.0 or 3.1 spec from a collection as a background task.

  Try: “Generate an OpenAPI 3.1 spec from my Orders collection.”

  Write · generateSpecFromCollection

• Lists specs in a workspace

  Returns every API specification in a workspace.

  Try: “List the API specs in my Platform workspace.”

  Network · getAllSpecs

• Shows who you are signed in as

  Returns your user ID, username, team ID and roles. The tool text tells the assistant to call it first for any "my ..." request.

  Try: “Which Postman account am I using?”

  Network · getAuthenticatedUser

• Reads a collection

  Returns a lightweight map of a collection by default. Pass a model option for root-level IDs only or the full collection.

  Try: “Show me the folder structure of the Orders collection.”

  Network · getCollection

• Lists collections in a workspace

  Lists the collections in a workspace. The workspace ID is required, so the assistant asks you for it.

  Try: “List the collections in my Platform workspace.”

  Network · getCollections

• Checks a collection copy

  Returns the status of a collection duplication task.

  Try: “Has my collection copy finished?”

  Network · getDuplicateCollectionTaskStatus

• Lists the tools that are on

  Returns which tools are in the full and minimal sets. The tool text says to run it first when a tool seems missing.

  Try: “Which Postman tools do you have available?”

  Network · getEnabledTools

• Reads an environment

  Returns one environment and its variables.

  Try: “Show the variables in my staging environment.”

  Network · getEnvironment

• Lists your environments

  Returns all the environments you can see.

  Try: “What Postman environments do I have?”

  Network · getEnvironments

• Gets the spec made from a collection

  Returns the API spec that was generated for a given collection.

  Try: “Get the spec generated from the Orders collection.”

  Network · getGeneratedCollectionSpecs

• Reads a mock server

  Returns a mock server, including the collection it uses and its mock URL.

  Try: “What is the URL of my Payments mock server?”

  Network · getMock

• Lists mock servers

  Lists active mock servers. By default only the ones you created, scoped by workspace or team.

  Try: “List the mock servers in my Platform workspace.”

  Network · getMocks

• Reads spec details

  Returns information about one API specification.

  Try: “Show the details of the Inventory API spec.”

  Network · getSpec

• Lists collections made from a spec

  Returns all collections generated from a given spec.

  Try: “Which collections came from the Inventory API spec?”

  Network · getSpecCollections

• Reads a full spec definition

  Returns the complete contents of an OpenAPI or AsyncAPI spec.

  Try: “Read the full definition of the Inventory API spec.”

  Network · getSpecDefinition

• Reads one spec file

  Returns the contents of a single file in a spec.

  Try: “Show me components/schemas.json from the Inventory API spec.”

  Network · getSpecFile

• Lists a spec's files

  Lists all files in an API spec.

  Try: “What files make up the Inventory API spec?”

  Network · getSpecFiles

• Finds items by tag

  Returns workspaces, APIs and collections that share a tag. It needs a Postman Enterprise plan and returns a 404 on lower plans.

  Try: “Find everything tagged payments.”

  Network · getTaggedEntities

• Reads a workspace

  Returns one workspace, including whether it is personal, team, private or public.

  Try: “Who can see my Platform workspace?”

  Network · getWorkspace

• Lists your workspaces

  Lists the workspaces you can access. For "my workspaces" the assistant first looks up your user ID.

  Try: “List my Postman workspaces.”

  Network · getWorkspaces

• Makes a mock server public

  Publishes a mock server, which sets its access control to public so anyone with the URL can call it.

  Try: “Publish the Payments mock server.”

  Write · publishMock

• Replaces a collection's contents

  Overwrites a collection with the definition you send. If item IDs are left out, the existing items are removed and new ones created.

  Try: “Replace the Orders collection with this updated definition.”

  Write · putCollection

• Replaces an environment's contents

  Overwrites all of an environment with the details you send. Only shared variable values can be changed this way.

  Try: “Overwrite the staging environment with these variables.”

  Write · putEnvironment

• Runs a collection on your computer

  Runs every request in a collection with Postman's newman runner, using an optional environment. Collection scripts run and the requests hit whatever servers they point at. The results are also posted to your Postman account.

  Try: “Run the Smoke Tests collection against staging and tell me what failed.”

  Runs code · runCollection

• Searches Postman

  Searches requests, collections, workspaces, specs, flows, environments, mocks and documents, in your organisation, the public Postman network, or both.

  Try: “Search the public Postman network for a Stripe API collection.”

  Network · searchPostmanElements

• Updates a collection from its spec

  Re-syncs a collection that was generated from a spec so it matches the spec. It runs as a background task and supports OpenAPI only.

  Try: “Sync the Orders collection with its Inventory API spec.”

  Write · syncCollectionWithSpec

• Updates a spec from its collection

  Re-syncs a spec linked to a collection so it matches the collection. It runs as a background task and supports OpenAPI only.

  Try: “Update the spec from the latest Orders collection.”

  Write · syncSpecWithCollection

• Edits a request in a collection

  Updates a request in a collection. It cannot move the request to another folder.

  Try: “Change the Get user request to use the v2 path.”

  Write · updateCollectionRequest

• Edits a mock server

  Changes a mock server's name, environment, privacy or active server response.

  Try: “Make the Payments mock server private.”

  Write · updateMock

• Edits a spec file

  Updates one file in a spec. You can change only one property per call, such as the content or the type.

  Try: “Update the content of schemas.json in the Inventory API spec.”

  Write · updateSpecFile

• Renames or edits a spec

  Updates spec properties such as its name.

  Try: “Rename the Inventory API spec to Inventory API v2.”

  Write · updateSpecProperties

• Edits a workspace

  Changes a workspace's name, description or visibility. Some visibility changes are blocked on Free and Solo plans.

  Try: “Rename my Platform workspace to Platform APIs.”

  Write · updateWorkspace

Watch out for

• runCollection sends real requests from your machine

  It runs the collection with newman, including its scripts, and calls whatever URLs it holds, including DELETE or POST requests. The vendor marks the tool destructive. Only run collections you trust, against test environments. github.com

• Versions 2.4.10 to 2.4.12 of the npm package were compromised

  OSV advisory MAL-2025-190909 (November 2025) marks those three releases of @postman/postman-mcp-server as carrying malicious code from the Shai-Hulud npm worm, which steals tokens and credentials. The current release, 2.15.0, is not listed. Do not run those versions; npx without a version pulls the latest, so check with npm ls if you pinned one. osv.dev

• Some tools overwrite or publish things

  putCollection and putEnvironment replace existing content, and publishMock makes a mock server public. Ask the assistant to confirm before using them on shared workspaces. github.com

• The Full set adds delete tools

  The /mcp endpoint and the --full flag enable 100+ tools, including ones that delete collections, workspaces and monitors. The default Minimal set has no delete tools. github.com

• Run results are posted to your Postman account

  After runCollection the server posts the results, including request and response details, to the Postman API. Do not run collections that carry secrets you do not want stored there. github.com

• Tool text tells the assistant what to call first

  The server asks the assistant to read its instructions before any API answer, and getEnabledTools and getAuthenticatedUser say to run them first. This steers the assistant but does not change what the tools can do. github.com

Security advisories