multimeterBLOCK
Multimeter is an AI-powered REST Client and API testing tool for VS Code and CI. It is not an electrical multimeter. YAML .mmt files. testlight CLI. MCP @mmt/mcp. Git-native Postman alternative.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Git-native REST client and API tests in VS Code. YAML .mmt files in Git.
Demo · Website · Request Feature · VS Code · CLI · GitHub Action · Docs · llms.txt
🚀 Start with a request. Grow into a platform.
Multimeter is Git-native API testing in VS Code. Requests, tests, mocks, and docs are YAML .mmt files in your repo.
Start with a single HTTP request.
Grow into tests, suites
fae171156364OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mmt-mcp -- npx -y [email protected]
Exposed tools (21)
18 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Bruno | read | Compare Multimeter and Bruno. Both keep API work in Git. Multimeter adds test flows, suites, mocks, docs, reports, a VS Code editor, and faster runs (parallel stages, reused setup). |
Dog | read | A dog |
Markdown | read | GitHub-flavored Markdown tables. Paste directly into PRs, issues, wikis, or README files. |
Multimeter | read | API testing tool |
Postman | write | Compare Multimeter and Postman. Keep API tests in Git, run them in VS Code and CI. Parallel stages and reused setup calls. No cloud account. |
Promptfoo | read | Compare Multimeter and Promptfoo. Judge non-deterministic API replies in the same Git-native .mmt flow, next to ordinary asserts, mocks, and CI. |
api-smoke-test | read | Call one imported API, assert status, check key outputs. |
api_card | read | |
chained-api-calls | read | Login, capture outputs, reuse values in a later API call. |
data-driven-test | read | Loop over CSV rows and call an API for each row. |
discover_api | read | |
format | read | |
golden-smoke-pair | read | REQUIRED few-shot: minimal API + scaffolded smoke test. Mirror this; call scaffold_test instead of inventing YAML. |
list_examples | read | |
load-test | write | Run a test file with concurrency and repeat settings. |
n | read | d |
read_documentation | read | |
run | write | |
scaffold_test | read | |
suggest_assertions | read | |
validate | read |
Trust audit
BLOCKgrade F · trust 50/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (8 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
yaml.load(mmtcore.testParsePack.quoteExpectOperators(rawText));
const parsed = yaml.load(t) as any;
return yaml.load(txt);
return yaml.load(txt);
const data = yaml.load(processed) as any;
const req = Function('return require')();parts.push({kind: 'flag', text: '--insecure'});testlight.icns
{ token: "delimiter.bracket.json", foreground: punct },{ token: "delimiter.array.json", foreground: punct },{ token: "delimiter.colon.json", foreground: punct },{ token: "delimiter.comma.json", foreground: punct },{ token: "delimiter.urlencoded", foreground: punct },-----BEGIN PRIVATE KEY-----
-----BEGIN PRIVATE KEY-----
-----BEGIN PRIVATE KEY-----
-----BEGIN PRIVATE KEY-----
-----BEGIN PRIVATE KEY-----
payload.bin
client.p12
badssl-client.p12
.vscodeignore
payload.bin
const users = new Function(bundle + '\nreturn users_;')();
const fn = new Function(...names, `return ${match![1]};`);Gates applied: no_behavioural_pass.
fae171156364full audit observations/trust-audit/mcp-server/mshobeyri__multimeter.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | fae171156364 | BLOCK | F | 50 | first audit |
Questions
What is the multimeter MCP server?
Multimeter is an AI-powered REST Client and API testing tool for VS Code and CI. It is not an electrical multimeter. YAML .mmt files. testlight CLI. MCP @mmt/mcp. Git-native Postman alternative.
What tools does multimeter expose?
21 in total: 18 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is multimeter safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (50/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does multimeter need?
It reads GH_TOKEN and GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does multimeter run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as website at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (fae171156364), read on 2026-10-10. The repository is watched and re-audited when it changes.