Model Context Protocol moderate risk

Postmancer

Postmancer is a standalone MCP server for AI assistants to interact with RESTful APIs, enabling HTTP requests, API collection management, and response testing.

Connections & Capabilities

Connects To

Docker

Capabilities

readwriteexec

Quickstart

Install

npm install -g

Config

{
  "mcpServers": {
    "postmancer": {
      "command": "npx",
      "args": ["-y", "postmancer"],
      "env": {
        "LOG_LEVEL": "info"
      }
    }
  }
}

Exposed MCP Tools (7)

high

http_request

Sends HTTP requests to any specified URL.

Can be used to access or modify data on any accessible API endpoint.

safe

list_collections

Lists all saved API collections.

Read-only operation that does not modify any data.

safe

list_requests

Lists all requests within a specific collection.

Read-only operation that does not modify any data.

moderate

save_request

Saves a new request to a specified collection.

Adds data to a collection, but does not directly impact external systems.

high

request_from_collection

Executes a saved request from a specified collection.

Executes a pre-defined HTTP request, potentially modifying data.

moderate

set_environment_variable

Sets an environment variable for use in request templates.

Modifies the environment, potentially affecting future requests.

safe

get_environment_variables

Retrieves all currently set environment variables.

Read-only operation that does not modify any data.

Safety Assessment

Postmancer's safety depends heavily on configuration and the APIs it interacts with. It's relatively safe if used with well-defined, non-destructive APIs and strong encryption. However, it becomes risky when used with APIs that allow data modification or deletion, especially without proper access controls and key management.

Collections path can be configured to limit scope.
Encryption keys can be set for sensitive data.
Logging provides some auditability.
No inherent internet access; relies on configured API endpoints.

Can make arbitrary HTTP requests, potentially to internal or sensitive endpoints.
Collections and environment variables are stored on disk, requiring secure storage.
Encryption keys default if not explicitly set, posing a risk.
No built-in rate limiting or request validation.