Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Postman-Devrel/postman-claude-code-plugin --skill bootstrapgit clone --depth 1 https://github.com/Postman-Devrel/postman-claude-code-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/postman-devrel/postman-claude-code-plugin/bootstrap)<a href="https://agentmods.dev/skills/postman-devrel/postman-claude-code-plugin/bootstrap"><img src="https://agentmods.dev/badge/skills/postman-devrel/postman-claude-code-plugin/bootstrap/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/postman-devrel/postman-claude-code-plugin/bootstrap"><img src="https://agentmods.dev/badge/skills/postman-devrel/postman-claude-code-plugin/bootstrap.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00146 | $0.01654 |
| Opus 5.5 | $0.00058 | $0.00662 |
| Sonnet 5.5 | $0.00029 | $0.00331 |
| Haiku 4.5 | $0.00015 | $0.00165 |
Grade A, and why
bootstrap scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Make HTTP calls with `postman request`, never `curl` or another client — it How it starts
The opening of the file, as written. The whole thing — 181 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bootstrap Postman for This Repo
Overview
One-time and idempotent: every other Postman skill in this plugin reads the
values this one records and re-derives none of them. Finding an existing
postman/ tree or an OpenAPI file is a signal to inspect, not to assume this
repo is already set up.
Rules
- Make HTTP calls with
postman request, nevercurlor another client — it reuses saved auth and env vars, syncs to the workspace, and runs test assertions. - Never invent a subcommand or a flag. Run
-hfirst and believe it. - Lint specs with
postman spec lint, neverpostman api …— the API Builder is deprecated in v12+ and the CLI prints no warning. - Local commands need no login; only commands reaching the Postman cloud do. Don't force a login the task doesn't need.
- A missing
postmanbinary means install it. Route topostman-mcp-serveronly after an install has been attempted and actually failed. - Never fabricate a workspace id, spec path, or collections directory. Report the gap and stop.
- Never echo an API key or session token into output, logs, or summaries.
- "Present" is not "current": check the version and existing links before setting anything up.
- Wire up an existing repo only. Never scaffold a new API or a starter spec.
- Write no host-specific paths — one
skills/directory loads on Claude Code, Cursor and Kimi Code.
Ask the CLI: -h
The CLI is self-describing at different levels. Walk down only as far as the question needs:
postman -h # resources: collection, spec, mock, monitor, workspace, api, flows…
postman <resource> -h # that resource's actions
postman <resource> <action> -h # real flags, defaults, and worked `Eg.` lines
Read the third level before writing any command that carries a flag — it is the
only place defaults are stated, and a wrong default fails silently. Live output
is authoritative over any summary, including this file. There is also no single
verb for "is the workspace linked and synced": run postman workspace -h and
pick from what it prints.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 181 lines · 146 tokens per session scan A b6fe5c7eb249
bootstrap is a skill published in the GitHub repository Postman-Devrel/postman-claude-code-plugin (41 stars, last pushed 22d ago), licensed Apache-2.0. It adds 146 tokens to every session and 1,654 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-20.
Other skills, from other repositories
postman
Full API lifecycle management through Postman. Sync OpenAPI specs to collections, generate typed client code, run API tests, create mock servers, publish documentation, audit security against OWASP Top 10, and discover APIs across workspaces. Requires the Postman MCP Server. Use this skill when the user mentions…
postman-api-readiness
Analyze any API for AI agent compatibility. Scans OpenAPI specs across 8 pillars (48 checks), scores agent-readiness 0-100, and provides prioritized fix recommendations. Use this skill when the user asks: "Is my API agent-ready?", "Scan my API", "Analyze my OpenAPI spec", "What's wrong with my API for AI agents?"…
flow-next-impl-review
Carmack-level implementation review of changes via the configured backend. Use when asked to review code or a diff in a flow-next repo.
flow-next-resolve-pr
Resolve PR review feedback. Fetches unresolved threads, triages, fixes, replies and resolves via GraphQL. Use when asked to address review comments.
qveris
Access third-party professional data and tools through QVeris: find services, review supported scope when needed, call them, and generate production REST code. Use when existing tools are insufficient, a provider is unknown, comparison or fallback is needed, or the user requests QVeris.
qveris-cli
Use QVeris CLI to find and call third-party professional data and tools when existing tools are insufficient, a provider is unknown, comparison or fallback is needed, or the user requests QVeris.