A command for connecting Claude Code to Postman, an API development and testing tool. It guides authentication, verifies the connection, and helps select a workspace.

Use it during first-time Postman configuration, with either OAuth login or an API key, and when checking that the Postman MCP server is available.

It prepares the Postman connection required by other commands, avoiding setup errors before API work begins.

setup — Command by Postman-Devrel

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/postman-devrel/postman-claude-code-plugin/setup

Clone the repo

git clone --depth 1 https://github.com/Postman-Devrel/postman-claude-code-plugin

Per session 20 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,327 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00020	$0.01327
Opus 5	$0.00010	$0.00664
Sonnet 5	$0.00004	$0.00265
Haiku 4.5	$0.00002	$0.00133

Measured yesterday against content hash 565cb4cf09a0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/setup.md · 142 lines

How it starts

The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.

First-Run Configuration

Walk the user through Postman setup for Claude Code. Validate everything works before they use other commands.

Workflow

Step 1: Check MCP Connection

Verify the Postman MCP Server is available by calling getAuthenticatedUser.

If it works: Skip to Step 4 (workspace verification).

If it fails: Check whether mcp__postman__authenticate is available.

Available → offer the user a choice: OAuth (recommended) or API key. Default to OAuth unless they ask for API key.
Not available → the MCP server isn't loaded. Show the "MCP tools not available" error below and stop.

Step 2: OAuth Authentication (Recommended)

Present:

Let's connect your Postman account via OAuth — no key copying required.

I'll generate an authorization URL. Open it in your browser, sign in, and paste the callback URL back here.

Call mcp__postman__authenticate — it returns an authorization URL.

Show the URL:

Open this URL in your browser:
<authorization URL>

After you authorize, your browser will redirect to a localhost URL.
The page may not load — that's expected. Copy the full URL from the address bar and paste it here.

Wait for the user to paste the callback URL.
Call mcp__postman__complete_authentication with the pasted URL as callback_url.
The MCP server may restart after saving the OAuth token, temporarily dropping the connection. This is expected.
- Wait a few seconds, then retry getAuthenticatedUser up to 3 times with short pauses between attempts.
- If tools become unavailable (server disconnected), tell the user:
```
The MCP server is restarting after saving your credentials — this is normal.
Give it a moment and I'll retry the connection...
```
- If tools are still unavailable after retries:
```
The server hasn't reconnected yet. Restart Claude Code and run /postman:setup again.
Your OAuth token is already saved — you won't need to re-authorize.
```
Once getAuthenticatedUser succeeds, proceed to Step 4.

Read the full file on GitHub · 142 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 142 lines · 20 tokens per session scan A 565cb4cf09a0

Subscribe to this mod's changes

setup is a command published in the GitHub repository Postman-Devrel/postman-claude-code-plugin (38 stars, last pushed 26d ago), licensed Apache-2.0. It adds 20 tokens to every session and 1,327 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs Security Testing ai-agent api-development claude-code mcp plugin postman

refine-title

深度分析 Issue 或 PR 内容，并将其标题重构为 Conventional Commits 格式.

ModelEngine-Group/fit-framework · 23 tokens

warden-cost

Dollar accounting — what does each active rule actually save, in money? Translates the token-measured verdict into dollars using a price table and the agent's own token-type mix, with a per-session net and a break-even. Read-only; spends no tokens.

vukkt/token-warden · 53 tokens

routine

Execute one maintenance routine defined in scv/routines/ .md (task + guardrails + exit-criteria contract), or list defined routines. SCV never schedules — pair with host features like /loop or cron yourself. Use whenever the user asks to run a recurring maintenance task, or asks what routines exist — not only when…

wookiya1364/scv-claude-code · 75 tokens

setup