Gostman

Protocols

- REST, GraphQL (with a schema browser and subscriptions), gRPC (reflection or .proto files), WebSocket (including Socket.IO and MQTT) and SSE

- MCP: test MCP servers over HTTP or a local command

Requests

- Bodies: JSON, text, XML, SOAP, form, multipart (with large file attachments) and binary

- Auth: Basic, Bearer, JWT, OAuth 2 and more; cookie jar; proxy and client certificates

- Code generation for the request exactly as it is sent; paste a curl command to import it

- Open a long JSON response as a tree with depth controls and a JSONPath filter; large bodies stay usable

- Variables view: a short form of a request, for people who only fill in values

Variables and secrets

- Environments, collection variables, globals and session values, with a clear order of precedence

- Typed variables: number, whole number, true or false, JSON, a choice from a list, required

- Dynamic values: UUID v4 and v7, dates in any format, random numbers, faker names

- Test data templates: keep a JSON or XML document in a variable and send it as base64

- Secrets from Vault, AWS, Azure, Google Cloud, KeePassXC, 1Password and Bitwarden, never saved in files

Testing and automation

- Checks, JSONPath extraction and scripts, with Postman, Bruno and Insomnia script styles

- Collection runner with data files, parallel runs and HTML reports

- Flows: chain requests with conditions, retries and branches

- Load testing, a mock server that serves saved examples, and a capture proxy

- OpenAPI: design specs in an editor, check responses against a contract, generate docs

Files and teams

- Collections are plain YAML files in a folder, so you review them in Git; no account and no cloud sync

- Import from Postman, Bruno, Insomnia, Hoppscotch, OpenAPI and WSDL, with scripts; export to the same formats

- Encrypted share links; a folder you didn't create opens restricted until you trust it

Command line and CI

- One Go binary: gostman run, send, flow, load, scan, lint, mock, import, export

- Same engine as the apps, so results match; exit codes for CI

For coding agents

- MCP server: Claude, Cursor and others call your saved requests without seeing your secrets

- Agents can only reach hosts you allow, and every change they make is logged

Everywhere

- Desktop app for Windows, Mac and Linux, and the same app in the browser at gostman.com/web, which installs and works offline

- Self-host the web app with Docker or gostman serve

- No telemetry, free and open source with no paid tier

• Backend developers testing and debugging REST, GraphQL, gRPC and WebSocket APIs
• Teams that keep API collections in Git and review changes in pull requests
• CI pipelines that run an API test collection on every pull request
• People moving off Postman who want no login and no cloud sync
• Coding agents calling saved requests through MCP without seeing the secrets