Postman RunnerBLOCK
MCP Server for running Postman Collections with Newman
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://smithery.ai/server/mcp-postman)
An MCP (Model Context Protocol) server that enables running Postman collections using Newman. This server allows LLMs to execute API tests and get detailed results through a standardized interface.
[](https://youtu.be/d1WgTqwMsog)
AI Agent Listing
[](https://aiagentslisting.com/mcp/postman-mcp-server-2)
Features
- Run Postman collections using Newman
- Support for environment files
- Support for global variables
- Detailed test results including:
- Overall success/failure status
- Test summary (total, passed, failed)
- Detailed failure information
- Execution timings
Installation
Installing via Smithery
To install Postman Runner for Claude Desktop automatically via Smithery:
npx -y @smithery/cli install mcp-postman --client claude
Manual Installation
# Clone the repository git clone cd mcp-postman # Install dependencies pnpm install # Build the project pnpm build
Usage
Configuration
Add the server to your Claude desktop configuration file at ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"postman-runner": {
"command": "node",
"args": ["/absolute/path/to/mcp-postman/build/index.js"]
}
}
}Available Tools
run-collection
Runs a Postman collection and returns the test results.
Parameters:
collection(required): Path or URL to the Postman collection- `
c363e455a9e3OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-postman -- npx -y [email protected]
{
"mcpServers": {
"mcp-postman": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (1)
0 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
run-collection | write | Run a Postman Collection using Newman |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (9)
@modelcontextprotocol/sdk, newman, zod, @types/express, @types/newman, @types/node, @typescript-eslint/eslint-plugin, @typescript-eslint/parser
options.environment One can optionally pass an environment file path or URL as string to this property and that will be used to read Postman Environment Variables from. This property also accepts envi
options.envVar One can optionally pass environment variables as an array of key-value string object pairs. It will be used to read Postman Environment Variables as well as overwrite environment variab
options.globalVar One can optionally pass global environment variables as an array of key-value string object pairs. It will be used to read Postman Global Environment Variables as well as overwrite g
Gates applied: no_behavioural_pass.
c363e455a9e3full audit observations/trust-audit/mcp-server/shannonlal__postman-runner.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | c363e455a9e3 | BLOCK | D | 69 | first audit |
Questions
What is the Postman Runner MCP server?
MCP Server for running Postman Collections with Newman
What tools does Postman Runner expose?
1 in total: 0 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Postman Runner safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Postman Runner need?
No credential environment variables were found in its source, so it appears to need none.
How does Postman Runner run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-postman at 1.0.2.
How current is this page?
The grade is for one exact copy of the source (c363e455a9e3), read on 2026-10-07. The repository is watched and re-audited when it changes.