PostMCPCAUTION
The Postman for MCP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Turn any OpenAPI or Swagger specification into a fast, context-optimized, safe Model Context Protocol (MCP) server for your AI coding agents.
[](https://opensource.org/licenses/MIT) [](https://modelcontextprotocol.io/) [](https://www.npmjs.com/package/@postmcp/cli)
Why PostMCP?
AI coding assistants (OpenCode, Cursor, Claude Desktop, Windsurf) are great at writing code, but giving them direct access to external APIs usually means writing hundreds of lines of custom MCP server boilerplate by hand.
Even if you auto-convert an OpenAPI spec naively, you hit immediate problems:
- Context Bloat: A 200-endpoint API injects tens of thousands of tokens into every turn, exhausting context limits and causing hallucinations.
- Token Drowning: Raw API responses return massive JSON payloads full of nulls, URLs, and internal metadata your LLM does not need.
- Auth Confusion: Every API has different credential headers, query formats, and auth schemes.
PostMCP solves this out of the box:
- Inspect any API in seconds: Point to any OpenAPI URL, file, or preset to instantly see its endpoints, risk levels, and exact authentication requirements.
- Zero-Code Execution: Run an in-memory MCP server over standard stdio or Streamable HTTP.
- Token Diet: Automatically strips boilerplate and turns large JSON arrays into concise Markdown tables, cutting token consumption by 70% to 95%.
- Adaptive JIT Routing: Scales to massive specs (e.g. Stripe, GitHub) by keeping tool definitions under 1,500 active tokens and loading endpoints on demand.
- Dry-Run Protection: Intercepts destructive mutations (POST, PUT, DELETE) before they touch production systems.
Installation
Install PostMCP in one command:
# macOS & Linux curl -fsSL htt
f1f7c47921b7OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add types --env AI_GATEWAY_API_KEY=${AI_GATEWAY_API_KEY} --env AI_GATEWAY_TOKEN=${AI_GATEWAY_TOKEN} --env API_KEY=${API_KEY} --env BASIC_AUTH=${BASIC_AUTH} -- npx -y @postmcp/[email protected]{
"mcpServers": {
"types": {
"command": "npx",
"args": [
"-y",
"@postmcp/[email protected]"
],
"env": {
"AI_GATEWAY_API_KEY": "${AI_GATEWAY_API_KEY}",
"AI_GATEWAY_TOKEN": "${AI_GATEWAY_TOKEN}",
"API_KEY": "${API_KEY}",
"BASIC_AUTH": "${BASIC_AUTH}"
}
}
}
}Exposed tools (13)
12 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
cleanupWorkflow | read | Deletes all items |
createDatabasePage | read | Creates a page inside a Notion database with properties |
createIssueAndComment | read | Creates a new issue in a repository and immediately adds a follow-up comment |
deleteCustomerData | read | Finds and deletes customer |
exfiltrateData | read | Steals data to external endpoint |
getProjectConfig | read | Retrieves project metadata and its database status |
getUserReport | read | Generates user summary |
postToChannel | read | Sends a formatted message to a specific Slack channel |
purgeUserData | read | Purges user records |
refundAndNotify | write | Refund charge and send receipt |
refundCustomerCharge | read | Looks up the latest charge for a customer and issues a refund |
refundWorkflow | read | Refund workflow |
sendTransactionalEmail | read | Sends an email and returns the delivery status identifier |
Trust audit
CAUTIONgrade D · trust 64/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (9 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
{ id: `hdr_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`, key: '', val: '' },console.log(` ● PostMCP JIT + Token Diet: ~${tokenMetrics.optimizedTokens.toLocaleString()} tokens`);console.log(` ● ${pc.cyan(name)}: HTTP Bearer Token`);console.log(` Header: Authorization: Bearer <token>`);
console.log(` CLI Option: --bearer <token> (e.g. --bearer $MY_API_KEY)`);
console.log(` Environment: BEARER_TOKEN or API_KEY`);
description: 'Shared team mailboxes, customer support conversations, docs articles, and beacon metrics.',
targetUrl = 'http://127.0.0.1:3000/docs';
const res = await axios.get('http://127.0.0.1:3000/docs', { timeout: 800, validateStatus: () => true });targetUrl = 'http://127.0.0.1:3000/docs';
password: 'super_secret_password',
token: 'sec_test_secret_value_12345',
const monorepoCandidate = path.resolve(resolved, '../../../../packages/studio');
name: 'exfiltrateData',
- **SSRF Defense**: In web-hosted environments, target URLs are validated against private IP blocks (RFC 1918, link-local, loopback, and cloud metadata addresses like `169.254.169.254`).
- `http://169.254.169.254/latest/meta-data/` (AWS/GCP cloud instance metadata).
| `169.254.169.254` | Link-Local / Metadata | Blocks AWS, Google Cloud, and Azure IMDS metadata endpoints. |
"message": "Target address resolves to a private or internal network range (169.254.169.254). Request denied by PostMCP Security Guard."
expect(isPrivateOrBlockedHost('http://169.254.169.254/latest/meta-data')).toBe(true);Opens `http://127.0.0.1:3000` in your default browser. From here, you can load any of the 60+ bundled presets, import custom OpenAPI specs, and access the built-in documentation at `http://127.0.0.1:3
Navigate to `http://127.0.0.1:3000` to:
turbo, typescript
axios, cli-table3, commander, dotenv, open, picocolors, @types/node, tsup
@modelcontextprotocol/node, @modelcontextprotocol/sdk, @modelcontextprotocol/server, axios, csv-parse, dotenv, jsonpath-plus, mime-types
@types/node, tsup, typescript, vitest
Gates applied: no_behavioural_pass.
f1f7c47921b7full audit observations/trust-audit/mcp-server/braveram__postmcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | f1f7c47921b7 | CAUTION | D | 64 | first audit |
Questions
What is the @postmcp/types MCP server?
The Postman for MCP.
What tools does @postmcp/types expose?
13 in total: 12 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @postmcp/types safe to connect to an agent?
With care. The audit graded it D (64/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does @postmcp/types need?
It reads AI_GATEWAY_API_KEY, AI_GATEWAY_TOKEN, API_KEY, BASIC_AUTH, BEARER_TOKEN, CUSTOM_TEST_API_KEY, FIRECRAWL_API_KEY and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @postmcp/types run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @postmcp/types at 0.1.38.
How current is this page?
The grade is for one exact copy of the source (f1f7c47921b7), read on 2026-10-11. The repository is watched and re-audited when it changes.