Api Testing Mcp

@cocaxcode/api-testing-mcp

The most complete MCP server for API testing. Period. 42 MCP tools · Zero config · Works in any MCP client

Overview · Just Talk to It · Installation · Features · Tool Reference · Storage · Architecture

---

Quick Overview

The most complete MCP server for API testing — 42 tools, zero config, nothing else comes close. This is not just a request sender. It is a full testing workbench: HTTP requests with assertions, multi-step flows with variable extraction, OpenAPI import with schema-aware mock data, load testing with percentile metrics, response diffing across environments, bulk test runners, reusable collections, environment groups with directory scoping and persistent defaults, Postman import/export, and cURL export. All from natural conversation. No accounts, no cloud, no generated files. Everything runs inline and stores as plain JSON you own.

---

Just Talk to It

You don't need to learn tool names or parameters. Describe what you want and the AI picks the right tool.

"Create a group called my-project and add this directory as scope"
"Set up a dev environment with BASE_URL http://localhost:3000"
"Switch to prod for this session"
"Set dev as the default environment"
"Import my API spec from /api-docs-json"
"Show me all user endpoints"
"GET /users"
"Create a user with random data"
"Verify that DELETE /users/5 returns 204"
"Login as admin, extract the token, then fetch dashboard stats"
"How fast is /health with 50 concurrent requests?"
"Run all my saved smoke tests"
"Compare the users endpoint between dev and prod"
"Export the create-user request as curl"
"Export my collection to Postman"

If you've imported an OpenAPI spec, the AI already knows every endpoint, every required field, every valid enum value. When you say "create a blog post", it reads the schema and builds the request correctly — no guessing.

---

Installation

Claude Code

claude mcp add --scope user api-testing -- npx -y @cocaxcode/api-testing-mcp@latest

Claude Desktop

Add to your config file (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):

{
  "mcpServers": {
    "api-testing": {
      "command": "npx",
      "args": ["-y", "@cocaxcode/api-testing-mcp@latest"]
    }
  }
}

Cursor / Windsurf

Add to .cursor/mcp.json or .windsurf/mcp.json in your project root:

{
  "mcpServers": {
    "api-testing": {
      "command": "npx",
      "args": ["-y", "@cocaxcode/api-testing-mcp@latest"]
    }
  }
}

VS Code / Codex CLI / Gemini CLI

VS Code — add to .vscode/mcp.json:

{
  "servers": {
    "api-testing": {
      "command": "npx",
      "args": ["-y", "@cocaxcode/api-testing-mcp@latest"]
    }
  }
}

Codex CLI (OpenAI):

codex mcp add api-testing -- npx -y @cocaxcode/api-testing-mcp@latest

Or add to ~/.codex/config.toml:

[mcp_servers.api-testing]
command = "npx"
args = ["-y", "@cocaxcode/api-testing-mcp@latest"]

Gemini CLI — add to ~/.gemini/settings.json:

{
  "mcpServers": {
    "api-testing": {
      "command": "npx",
      "args": ["-y", "@cocaxcode/api-testing-mcp@latest"]
    }
  }
}

Quick Start

Once installed, set up an environment so relative paths resolve automatically:

"Create an environment called dev with BASE_URL http://localhost:3000"

If your API has a Swagger/OpenAPI spec, import it:

"Import my API spec from http://localhost:3000/api-docs-json"

Verify with: "List my environments" — you should see the one you just created.

---

Features

HTTP Requests

Send any HTTP method with headers, query params, JSON body, auth, and {{variable}} interpolation. Relative URLs auto-resolve against BASE_URL.

"POST to /api/users with name Jane and email jane@company.com using my bearer token"

Supports: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS — Bearer / API Key / Basic auth — custom timeouts.

Compression modes (v0.13+)

AI agents pay for every byte that lands in their context window. By default, request now returns a compressed response that cuts 70-95% of those tokens without losing debugging value. Three optional parameters control it:

| Param | Values | What it does | |---|---|---| | verbosity | 'minimal' / 'normal' (default) / 'full' | Controls detail level | | only_fields | ['user.id', 'items[*].name'] | Returns only these body paths (dot-notation + wildcards) | | max_body_bytes | number (default 2048) | Body size cap for 'normal' |

Modes:

• minimal — only status, timing, size_bytes, first 200 chars of body. Perfect for health checks, polling loops, or fire-and-forget calls. Saves ~95% tokens.
• normal (default) — filtered headers (drops Date, Server, CF-*, Set-Cookie, etc.) + body truncated to max_body_bytes. Covers ~80% of debugging use cases. Saves ~75% tokens.
• full — complete response untouched. Use when you explicitly need every header or the full body.

Typical savings on a 5 KB JSON response (≈1,500 tokens):

| Mode | Tokens consumed | Savings | |---|---|---| | full | ~1,500 | 0% (baseline) | | normal | ~300-400 | ~75% | | minimal | ~50-80 | ~95% | | only_fields: ['data.id'] | ~30 | ~98% |

> For a head-to-head comparison against curl, WebFetch and other native alternatives with measured numbers, see [Native alternatives](#native-alternatives-real-token-cost) below.

Recovering full responses: every compressed response includes a call_id. If you need the full body later, call inspect_last_response({ call_id }) — no need to re-execute the request. This works for request, assert, and each step of flow_run. Responses are kept in a 20-slot ring buffer and persisted to .api-testing/last-responses/ with a 1-hour TTL.

// Example: normal (default) response
{
  "call_id": "k3m9a2xp",
  "status": 200,
  "statusText": "OK",
  "method": "GET",
  "url": "https://api.example.com/users/1",
  "timing": { "total_ms": 142 },
  "size_bytes": 5324,
  "headers": { "content-type": "application/json" },
  "body": { "id": 1, "email": "...", "...": "..." },
  "body_truncated": true,
  "hint": "Body truncated to 2048 bytes (full size: 5324B). Call inspect_last_response({ call_id: \"k3m9a2xp\" }) for the full body.",
  "tokens_saved_estimate": 820
}

Native alternatives: real token cost

How this MCP compares against the native options Claude Code has when api-testing is not available (Bash + curl, WebFetch, etc.).

TL;DR: compared to raw curl, request saves between 65% and 97% of context tokens depending on the mode, with no loss of debugging information. Measured on a real call to GET /api/v1/blog returning 8 posts (~8.7 KB of JSON, 19 response headers):

| How the agent calls it | Uses MCP? | Tokens consumed | Delta vs curl | |---|:-:|---|---| | Bash + curl (raw stdout) | ❌ native | ~2,170 | baseline | | WebFetch (LLM summary) | ❌ native | ~400-800 | −65%, but no auth / no envs / no inspect | | request verbosity=full | ✅ MCP | ~2,170 | 0% (same as curl, no compression) | | request verbosity=normal (default) | ✅ MCP | ~750 | −65% | | request verbosity=minimal | ✅ MCP | ~50 | −97% | | request with only_fields: ["data[*].id","data[*].title"] | ✅ MCP | ~190 | −91% |

> Why this table's numbers differ slightly from the "Compression modes" section above: these come from a single real-world response, while the previous table shows typical savings on a synthetic 5 KB response. Trend and order of magnitude are the same.

Notes:

• The default mode (normal) already saves 65% without any configuration: it filters out noisy headers (Date, Server, CF-*, Set-Cookie…) and caps the body at 2048 bytes.
• only_fields accepts dot-paths with array index and wildcard support (items[*].name) — returns only the fields you ask for.
• The MCP also adds features that have no direct native equivalent: {{variable}} interpolation, stored environments, auth schemas, flows, Postman import/export, and inspect_last_response to recover the full body without re-hitting the server.
• Every registered MCP adds a fixed overhead of ~300-600 tokens per session (its instructions block + tool names). Typical break-even: 1-2 real calls per session.

Assertions

Validate responses with structured pass/fail results:

"Verify that GET /api/health returns 200, body.status is ok, and responds in under 500ms"

PASS — 3/3 assertions passed
  status === 200
  body.status === "ok"
  timing.total_ms 
What the tool executes

flowrun({ steps: [ { name: "login", method: "POST", url: "/auth/login", body: { email: "admin@test.com", password: "SecurePass#99" }, extract: { "TOKEN": "body.accesstoken" } }, { name: "get-users", method: "GET", url: "/api/users", headers: { "Authorization": "Bearer {{TOKEN}}" } } ] })

### OpenAPI Import

Import specs from a URL or local file (JSON and YAML). Once imported, the AI knows every endpoint, parameter, and schema.

"Import my API spec from http://localhost:3000/api-docs-json" "Import the spec from ./openapi.yaml" "What parameters does POST /users expect?"

Supports OpenAPI 3.x with full `$ref` resolution, `allOf`, `oneOf`, `anyOf`. OpenAPI 2.0 partially supported.

### Mock Data Generation

Generate realistic fake data from your OpenAPI schemas. Respects types, formats (`email`, `uuid`, `date-time`), enums, and required fields.

"Generate mock data for creating a user"

```json
{
  "email": "user42@example.com",
  "name": "Test User 73",
  "password": "TestPass123!",
  "role": "admin"
}

Load Testing

Fire N concurrent requests and get performance metrics:

"How fast is the health endpoint with 50 concurrent requests?"

LOAD TEST — GET /api/health
Requests:    50 concurrent
Successful:  50 | Failed: 0
Req/sec:     23.31

  Min: 45ms | Avg: 187ms
  p50: 156ms | p95: 412ms | p99: 523ms
  Max: 567ms

Response Diffing

Execute two requests and compare their responses field by field. Detect regressions or compare environments.

"Compare the users endpoint between dev and prod"

Bulk Testing

Run every saved request in a collection (or filter by tag) and get a summary:

"Run all my saved smoke tests"

BULK TEST — 8/8 passed | 1.2s total
  health       — GET  /health      → 200 (45ms)
  list-users   — GET  /users       → 200 (123ms)
  create-post  — POST /blog        → 201 (89ms)
  login        — POST /auth/login  → 200 (156ms)

Collections

Save requests for reuse with tags. Build regression suites.

"Save this request as create-user with tags auth, smoke"
"List all requests tagged smoke"

Environments

Environments hold your variables — BASE_URL, tokens, API keys — and keep them separated by context. The system has three core concepts:

Group. A group organizes environments and binds them to directories. A group has N scopes (directories) that share its environments, and exactly one default environment. When you create an environment inside a group, it belongs to that group. When you cd into a directory that is a scope of a group, its environments become available automatically.

Default. The default environment activates automatically when you enter a scope of its group. It persists between sessions — restart your editor, reopen your terminal, and the default is still there. Set it once and forget about it.

Active. The active environment is what is being used right now for variable resolution. It starts as the default when you enter a scope, but you can switch it at any time. The active selection is session-only — it resets to the default on restart.

Global environments (not associated with any group) still exist. They require explicit activation with env_switch and do not persist between sessions.

Practical example:

"Create a group called my-api"
"Add this directory as scope to my-api"
"Create a dev environment with BASE_URL http://localhost:3000"   
Import details

**Collection:** Postman v2.1 format. Folders become tags. Auth inherited from folders/collection level. Supports raw JSON, x-www-form-urlencoded, form-data bodies.

**Environment:** Prefers `currentValue` over `value`. Skips disabled variables. Optional `activate` flag.

Export details

**Collection:** Requests grouped in folders by tag. Auth mapped to Postman's native format. `{{variables}}` preserved as-is.

**Environment:** All variables exported as `enabled: true` in Postman-compatible format.

### Native Export & Import

Export collections and environments to a portable `.atm/` folder. Share with your team or copy between projects.

"Export my collection and dev environment"

your-project/ └── .atm/ ├── collection.json └── dev.env.json

> **Note:** `.atm/` is automatically added to `.gitignore` on first export.

### cURL Export

Convert any saved request into a ready-to-paste cURL command with resolved variables.

"Export the create-user request as curl"

```bash
curl -X POST \
  'https://api.example.com/users' \
  -H 'Authorization: Bearer eyJhbGci...' \
  -H 'Content-Type: application/json' \
  -d '{"name":"Jane","email":"jane@company.com"}'

---

Tool Reference

42 tools across 10 categories:

| Category | Tools | Count | |----------|-------|:-----:| | Requests | request | 1 | | Inspect | inspect_last_response | 1 | | Testing | assert | 1 | | Flows | flow_run | 1 | | Collections | collection_save, collection_list, collection_get, collection_delete | 4 | | Environments | env_create, env_list, env_set, env_get, env_switch, env_rename, env_delete, env_spec, env_project_clear, env_project_list | 10 | | Groups | env_group_create, env_group_list, env_group_delete, env_group_add_scope, env_group_remove_scope, env_set_default, env_set_group | 7 | | API Specs | api_import, api_spec_list, api_endpoints, api_endpoint_detail | 4 | | Mock | mock | 1 | | Utilities | load_test, export_curl, diff_responses, bulk_test, export_collection, import_collection, export_environment, import_environment, export_postman_collection, import_postman_collection, export_postman_environment, import_postman_environment | 12 |

> Tip: You don't need to call tools directly. Describe what you want and the AI picks the right one.

---

Storage

Everything is local. No database, no cloud sync, no telemetry. All data lives in ~/.api-testing/ as plain JSON files you can read, back up, or delete at any time.

~/.api-testing/
├── groups/               # Environment groups with scopes and defaults
├── environments/         # Environment variables — tokens, keys, passwords
├── collections/          # Saved requests (shareable, no secrets)
├── specs/                # Imported OpenAPI specs
└── project-envs.json     # Session-only active environments (cleared on restart)

Global storage vs project exports. The ~/.api-testing/ directory is your private, global store — this is where credentials live and they never leave. When you export a collection or environment, it goes to .atm/ in your project root. That folder is auto-added to .gitignore on first export, but even if you choose to commit it, your credentials stay in ~/.api-testing/ and are never copied into .atm/. You can safely share .atm/ exports with your team without leaking secrets.

Override the default storage path:

{
  "env": { "API_TESTING_DIR": "/path/to/custom/.api-testing" }
}

> Warning: If you override API_TESTING_DIR to

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: cocaxcode
• Source: cocaxcode/api-testing-mcp
• License: MIT
• Homepage: https://www.npmjs.com/package/@cocaxcode/api-testing-mcp

Install and usage instructions live in the source repository linked above.