postman-mcp-server

The server uses `zod` for robust input validation, which helps prevent malformed requests. API keys are strictly handled via environment variables (`POSTMAN_API_KEY`) and are not hardcoded. The Postman API Client includes user-agent headers with server context for traceability. Explicit warnings are provided in tool descriptions against including sensitive information directly in collection variables or when publishing documentation. No direct use of `eval` or similar dangerous patterns was observed. The main security considerations would be the secure management of the `POSTMAN_API_KEY` itself, and the potential for an agent to perform destructive actions (e.g., deleting collections, workspaces) if given too broad permissions.