Postman MCP Server Cursor IDE Setup 2026

How do you connect Postman to Cursor IDE? The fastest path is Postman's official remote MCP server: add a postman entry to ~/.cursor/mcp.json pointing at https://mcp.postman.com/mcp with an Authorization: Bearer header holding your Postman API key, restart Cursor, and it can list your workspaces, run requests from existing collections, and generate new requests from an OpenAPI spec — all from chat. There's also a local option (@postman/postman-mcp-server via npx) if your team prefers a self-hosted process over the hosted endpoint.

Postman's MCP server is unusual in scope: instead of exposing a small fixed set of tools, it can turn every request in a connected collection into something the AI can call directly, alongside tools for managing workspaces, environments, and specs. That's the actual value here — your existing Postman collections stop being something you only reference manually and become something Cursor can execute.

What the Postman MCP Server Can Do

Once connected, typical prompts include:

Two modes control how much of this surface is exposed: Full mode gives access to workspace and collection management on top of request execution, while Minimal mode (or Code mode, depending on which endpoint you point at) trims it down to the essentials for agentic workflows that mostly need to run requests, not manage Postman itself.

Prerequisites

Method 1: Remote Server with OAuth (Recommended)

Postman hosts its own MCP server, and for the US region it supports OAuth — no API key to generate or paste into a config file.

Step 1: Add the Server to ~/.cursor/mcp.json

{
  "mcpServers": {
    "postman": {
      "type": "http",
      "url": "https://mcp.postman.com/mcp"
    }
  }
}

Step 2: Authorize in the Browser

Restart Cursor. On first tool call, Cursor opens a browser window for Postman's OAuth authorization — approve it, and the session persists without a secret sitting in your config file.

To scope which tools are exposed, swap the URL: https://mcp.postman.com/mcp for Full mode (workspace and collection management plus request execution), or https://mcp.postman.com/code for Code mode (narrower, execution-focused). The EU region doesn't support OAuth yet — see Method 2 for the API-key route if your workspace lives there.

Method 2: Local Server with a Postman API Key

Use this if your org's policy prefers a self-managed key over an OAuth grant, your workspace is on the EU region, or you want the process running locally rather than hitting a hosted endpoint.

Step 1: Generate a Postman API Key

1. Log in to Postman and go to Settings → API keys
2. Click Generate API Key
3. Name it something identifiable, like "cursor-mcp-2026"
4. Copy the key immediately

Step 2: Add to ~/.cursor/mcp.json

{
  "mcpServers": {
    "postman": {
      "command": "npx",
      "args": ["-y", "@postman/postman-mcp-server", "--full"],
      "env": {
        "POSTMAN_API_KEY": "your-postman-api-key-here"
      }
    }
  }
}

Drop the --full flag to run in Minimal mode instead, or swap it for --code for Code mode. Add --region eu to the args array if your workspace is on Postman's EU infrastructure — it defaults to us.

Step 3: Restart Cursor and Verify

Quit and reopen Cursor, then check Settings → MCP for a connected postman entry. Test in chat:

List my Postman workspaces

Real workspace names coming back confirms the key and (if applicable) region are correct.

Practical Workflows

Turn an Existing Collection into Callable Tools

List the requests in my 'Internal Admin API' collection, then run the 
'List Pending Approvals' request and summarize what comes back.

Generate a Collection from a Spec You're Writing

I just added three new endpoints to /docs/openapi.yaml. Generate or 
update a Postman collection to match, and run the new GET /invoices 
endpoint against staging to confirm it works.

Debug a Failing Integration

Run the 'Create Subscription' request from my Billing collection against 
staging with this test payload, then compare the actual response against 
what our webhook handler expects.

Cross-Check API Behavior Before Writing Client Code

Run the 'Get User Profile' request and show me the real response shape, 
then generate a TypeScript interface that matches it exactly instead of 
guessing from the docs.

Full Mode vs. Minimal Mode vs. Code Mode

If you're not sure which to pick, start with Full mode — it's the default, and you can narrow scope later once you've seen which tools you actually use.

Troubleshooting

OAuth popup never appears, or the connection shows "unauthorized"
Confirm your Cursor version supports http/url-based remote MCP entries. If it does and the popup still doesn't fire, check that nothing is blocking mcp.postman.com on your network, then disconnect and reconnect the server from Cursor's MCP settings to force a fresh OAuth attempt.

"Invalid API key" on the local server
The key was pasted incorrectly, revoked, or generated for the wrong region. Regenerate it under Settings → API keys and confirm the --region flag (or its absence, for US) matches where the key actually lives.

Requests run but return unexpected data
Check which environment is active — Postman environments define variables like base URLs and auth tokens, and running a request against the wrong environment (staging config hitting a production-shaped request, or vice versa) produces confusing results that look like a broken integration but are actually a scoping mismatch. Ask Cursor which environment it used before debugging further.

Server not appearing in Cursor at all
For the local method, confirm Node.js 18+ is installed and npx resolves on your PATH. Run the command manually in a terminal to see the actual startup error rather than Cursor's generic failure state.

When Not to Use This

If your team's Postman usage is mostly manual, ad hoc API exploration by one or two people, wiring up MCP is more setup than it's worth — just use the Postman app directly. This earns its keep once you have existing collections worth reusing programmatically, or when writing integration code where "run this exact request against staging and show me the real response" beats guessing at a shape from documentation. Also be careful with write-capable requests (anything that creates, updates, or deletes real data) — running a Full-mode connection against a production workspace means an AI agent can execute real state-changing requests, not just read ones, so scope environments and API key permissions accordingly before letting an agent loop unattended.

Frequently Asked Questions

Q: Does the Postman MCP server require an API key, or does OAuth cover everything?
A: OAuth covers the US-region remote server and doesn't require a key at all — that's the recommended default. The EU-region remote server and the local npx-based server both require a Postman API key instead, since OAuth support isn't available for those paths yet.

Q: What's the difference between Full mode and Code mode?
A: Full mode exposes the broadest tool set — workspace and collection management plus request execution — and is the default. Code mode narrows the surface toward the request-run-verify loop that agentic coding workflows use most, trading some management capability for a tighter, more predictable tool set.

Q: Can this MCP server create or modify real data through write requests?
A: Yes, if the underlying collection includes requests that create, update, or delete data, and the connection has permission to run them. Treat a Full-mode connection pointed at a production workspace with the same caution as any other integration with write access — scope API key permissions and be deliberate about which environment an agent is running requests against.

Q: Does this replace running Postman's own app or CLI (Newman) for API testing?
A: Not for CI or scheduled test suites — Newman and Postman's own runner are still the right tool for automated pipeline testing. This MCP server is for interactive, conversational use inside Cursor: running a request ad hoc, checking a response shape while writing code, or generating a new collection from a spec you're actively editing.

Q: My workspace is on Postman's EU region — can I still use OAuth?
A: Not currently. OAuth support is US-region only as of this writing. EU-region workspaces need the API-key route, either through the EU remote server endpoint or the local npx server with --region eu set.

Related Guides

---