@postman/postman-mcp-server
Version:
Postman MCP Server — connect AI agents (Claude Code, Cursor, VS Code Copilot, Gemini CLI) to your Postman collections, specifications, and environments via Model Context Protocol (MCP)
406 lines (405 loc) • 17.8 kB
JavaScript
import { z } from 'zod';
import { ContentType } from '../clients/postman.js';
import { asMcpError, McpError } from './utils/toolHelpers.js';
export const method = 'createCollectionRequest';
export const title = 'Create a collection request';
export const description = 'Creates a request in a collection. For a complete list of properties, refer to the **Request** entry in the [Postman Collection Format documentation](https://schema.postman.com/collection/json/v2.1.0/draft-07/docs/index.html).\n\n**Note:**\n\nIt is recommended that you pass the \\`name\\` property in the request body. If you do not, the system uses a null value. As a result, this creates a request with a blank name.\n';
export const parameters = z.object({
collectionId: z.string().describe("The collection's ID."),
folder: z
.string()
.describe('The folder ID in which to create the request. By default, the system creates the request at the collection level.')
.optional(),
name: z
.string()
.describe("The request's name. It is recommended that you pass the `name` property in the request body. If you do not, the system uses a null value. As a result, this creates a request with a blank name.")
.optional(),
description: z.string().nullable().describe("The request's description.").optional(),
method: z
.preprocess((v) => (typeof v === 'string' ? v.toUpperCase() : v), z.enum([
'GET',
'PUT',
'POST',
'PATCH',
'DELETE',
'COPY',
'HEAD',
'OPTIONS',
'LINK',
'UNLINK',
'PURGE',
'LOCK',
'UNLOCK',
'PROPFIND',
'VIEW',
]))
.describe("The request's HTTP method.")
.optional(),
url: z.string().nullable().describe("The request's URL.").optional(),
headerData: z
.array(z.object({
key: z.string().describe("The header's key.").optional(),
value: z.string().describe("The header's value.").optional(),
description: z.string().describe("The header's description.").optional(),
}))
.describe("The request's headers.")
.optional(),
queryParams: z
.array(z.object({
key: z.string().describe("The query parameter's key.").optional(),
value: z.string().describe("The query parameter's value.").optional(),
description: z.string().describe("The query parameter's description.").optional(),
enabled: z.boolean().describe('If true, the query parameter is enabled.').optional(),
}))
.describe("The request's query parameters.")
.optional(),
dataMode: z
.enum(['raw', 'urlencoded', 'formdata', 'binary', 'graphql'])
.describe("The request body's data mode.")
.optional(),
data: z
.array(z.object({
key: z.string().describe("The form data's key.").optional(),
value: z.string().describe("The form data's value.").optional(),
description: z.string().describe("The form data's description.").optional(),
enabled: z.boolean().describe('If true, the form data entry is enabled.').optional(),
type: z.enum(['text', 'file']).describe("The form data's type.").optional(),
uuid: z.string().describe("The form data entry's unique identifier.").optional(),
}))
.nullable()
.describe("The request body's form or urlencoded data.")
.optional(),
rawModeData: z.string().nullable().describe("The request body's raw mode data.").optional(),
graphqlModeData: z
.object({
query: z.string().describe('The GraphQL query.').optional(),
variables: z.string().describe('The GraphQL query variables, in JSON format.').optional(),
})
.nullable()
.describe("The request body's GraphQL mode data.")
.optional(),
dataOptions: z
.object({
raw: z
.object({ language: z.string().describe("The raw mode data's language type.").optional() })
.describe('Options for the `raw` data mode.')
.optional(),
urlencoded: z
.record(z.string(), z.unknown())
.describe('Options for the `urlencoded` data mode.')
.optional(),
params: z
.record(z.string(), z.unknown())
.describe('Options for the `params` data mode.')
.optional(),
binary: z
.record(z.string(), z.unknown())
.describe('Options for the `binary` data mode.')
.optional(),
graphql: z
.record(z.string(), z.unknown())
.describe('Options for the `graphql` data mode.')
.optional(),
})
.nullable()
.describe('Additional options for the request body data.')
.optional(),
auth: z
.object({
type: z
.enum([
'basic',
'bearer',
'apikey',
'digest',
'oauth1',
'oauth2',
'hawk',
'awsv4',
'ntlm',
'edgegrid',
'jwt',
'asap',
'noauth',
])
.describe('The authorization type.'),
apikey: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe("The API key's authentication information.")
.optional(),
awsv4: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe('The attributes for AWS Signature authentication.')
.optional(),
basic: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe('The attributes for Basic Auth.')
.optional(),
bearer: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe('The attributes for Bearer Token authentication.')
.optional(),
digest: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe('The attributes for Digest access authentication.')
.optional(),
edgegrid: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe('The attributes for Akamai Edgegrid authentication.')
.optional(),
hawk: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe('The attributes for Hawk authentication.')
.optional(),
ntlm: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe('The attributes for NTLM authentication.')
.optional(),
oauth1: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe('The attributes for OAuth1 authentication.')
.optional(),
oauth2: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe('The attributes for OAuth2 authentication.')
.optional(),
jwt: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe('The attributes for JWT authentication.')
.optional(),
asap: z
.array(z
.object({
key: z.string().describe("The auth method's key value."),
value: z
.union([z.string(), z.array(z.record(z.string(), z.unknown()))])
.describe("The key's value.")
.optional(),
type: z
.enum(['string', 'boolean', 'number', 'array', 'object', 'any'])
.describe("The value's type.")
.optional(),
})
.describe('Information about the supported Postman [authorization type](https://learning.postman.com/docs/sending-requests/authorization/authorization-types/).'))
.describe('The attributes for ASAP authentication.')
.optional(),
})
.nullable()
.describe("The request's authorization settings.")
.optional(),
events: z
.array(z.object({
listen: z.enum(['test', 'prerequest']).describe('The event type.').optional(),
script: z
.object({
id: z.string().describe("The script's ID.").optional(),
type: z
.string()
.describe('The type of script. For example, `text/javascript`.')
.optional(),
exec: z
.array(z.string().nullable())
.describe('A list of script strings, where each line represents a line of code. Separate lines makes it easy to track script changes.')
.optional(),
})
.describe('Information about the Javascript code that can be used to to perform setup or teardown operations in a response.')
.optional(),
}))
.describe("The request's pre-request and test scripts.")
.optional(),
});
export const annotations = {
title: 'Create a collection request',
readOnlyHint: false,
openWorldHint: true,
destructiveHint: false,
idempotentHint: false,
};
export async function handler(args, extra) {
try {
const endpoint = `/collections/${encodeURIComponent(String(args.collectionId))}/requests`;
const query = new URLSearchParams();
if (args.folder !== undefined)
query.set('folder', String(args.folder));
const url = query.toString() ? `${endpoint}?${query.toString()}` : endpoint;
const bodyPayload = {};
if (args.name !== undefined)
bodyPayload.name = args.name;
if (args.description !== undefined)
bodyPayload.description = args.description;
if (args.method !== undefined)
bodyPayload.method = args.method;
if (args.url !== undefined)
bodyPayload.url = args.url;
if (args.headerData !== undefined)
bodyPayload.headerData = args.headerData;
if (args.queryParams !== undefined)
bodyPayload.queryParams = args.queryParams;
if (args.dataMode !== undefined)
bodyPayload.dataMode = args.dataMode;
if (args.data !== undefined)
bodyPayload.data = args.data;
if (args.rawModeData !== undefined)
bodyPayload.rawModeData = args.rawModeData;
if (args.graphqlModeData !== undefined)
bodyPayload.graphqlModeData = args.graphqlModeData;
if (args.dataOptions !== undefined)
bodyPayload.dataOptions = args.dataOptions;
if (args.auth !== undefined)
bodyPayload.auth = args.auth;
if (args.events !== undefined)
bodyPayload.events = args.events;
const options = {
body: JSON.stringify(bodyPayload),
contentType: ContentType.Json,
headers: extra.headers,
};
const result = await extra.client.post(url, options);
return {
content: [
{
type: 'text',
text: `${typeof result === 'string' ? result : JSON.stringify(result, null, 2)}`,
},
],
};
}
catch (e) {
if (e instanceof McpError) {
throw e;
}
throw asMcpError(e);
}
}