{"id":"postman_com","version":"1.0","url":"https://www.postman.com","host":"postman.com","name":"Postman","category":"software","generatedAt":"2026-10-03T11:34:58.057Z","durationMs":83150,"checks":[{"id":"robots_assistants","door":"discover","title":"Robots policy for user triggered agents","status":"partial","points":2,"maxPoints":4,"finding":"Some user triggered agents are restricted in robots.txt.","evidence":[{"label":"ChatGPT User","value":"partly restricted","url":"https://www.postman.com/robots.txt"},{"label":"Claude User","value":"partly restricted","url":"https://www.postman.com/robots.txt"},{"label":"Perplexity User","value":"partly restricted","url":"https://www.postman.com/robots.txt"},{"label":"Gemini Deep Research","value":"partly restricted","url":"https://www.postman.com/robots.txt"}],"why":"When a customer asks an agent to look something up, it fetches the page as a user triggered agent. A site that blocks those agents cannot be consulted.","fix":"Allow the ChatGPT User, Claude User and Perplexity User agents in robots.txt for public product, pricing and help pages.","test":"web"},{"id":"llms_txt","door":"discover","title":"llms.txt guide for agents","status":"pass","points":3,"maxPoints":3,"finding":"llms.txt is published with 91 links.","evidence":[{"label":"File","value":"https://www.postman.com/llms.txt","url":"https://www.postman.com/llms.txt"}],"why":"An llms.txt file gives an agent a short map of what you offer and where the authoritative pages are.","fix":"Publish /llms.txt with links to product, pricing, support and location pages.","test":"web"},{"id":"structured_data","door":"discover","title":"Structured data on the home page","status":"partial","points":1,"maxPoints":3,"finding":"Only generic structured data is present, with no product, price or question markup.","evidence":[{"label":"Type","value":"Organization"},{"label":"Type","value":"ItemList"}],"why":"Schema.org markup lets an agent read products, prices and questions as data instead of guessing from the layout.","fix":"Add JSON LD for your organization type, Product or Service, Offer and FAQPage on the pages customers ask about most.","test":"web"},{"id":"server_rendered","door":"discover","title":"Content available without running scripts","status":"pass","points":3,"maxPoints":3,"finding":"Most of the visible text is in the first HTML response.","evidence":[{"label":"Text in first response","value":"7843 characters"},{"label":"Text after scripts","value":"6283 characters"}],"why":"Many agents read raw HTML and do not run scripts. Text that appears only after scripts run is invisible to them.","fix":"Render product, pricing and help content on the server so the first response contains the text.","test":"web"},{"id":"sitemap_content","door":"discover","title":"Sitemap that includes help and pricing pages","status":"pass","points":2,"maxPoints":2,"finding":"Sitemap lists 26 entries including pricing pages.","evidence":[{"label":"Sitemap","value":"https://www.postman.com/sitemap.xml","url":"https://www.postman.com/sitemap.xml"}],"why":"A sitemap tells an agent where answers live. That cuts wrong guesses and stale pages.","fix":"Publish a sitemap that includes help center, pricing and product pages.","test":"web"},{"id":"mcp_server","door":"connect","title":"MCP server","status":"pass","points":8,"maxPoints":8,"finding":"A live MCP server answers at https://mcp.postman.com/mcp and requires OAuth with published resource metadata.","evidence":[{"label":"Endpoint","value":"https://mcp.postman.com/mcp","url":"https://mcp.postman.com/mcp"}],"why":"An MCP server is the native way for an agent to use your services with the customer's approval. It replaces screen scraping and password sharing.","fix":"Publish a remote MCP server with OAuth. Start with read only tools such as account status, orders or location search, and publish a server card at /.well-known/mcp/server-card.","test":"web"},{"id":"a2a_agent_card","door":"connect","title":"Agent card for agent to agent calls","status":"fail","points":0,"maxPoints":2,"finding":"No agent card was found.","evidence":[],"why":"An agent card lets other agents discover what your own agent can do and how to authenticate.","fix":"Publish /.well-known/agent-card.json describing skills and authentication.","test":"web"},{"id":"openapi_docs","door":"connect","title":"Public API documentation","status":"partial","points":2,"maxPoints":3,"finding":"A developer portal exists, but no public OpenAPI document was found.","evidence":[{"label":"Developer portal","value":"https://www.postman.com/product/mcp-server/","url":"https://www.postman.com/product/mcp-server/"}],"why":"A published OpenAPI document lets developers and agents build against stable, described endpoints.","fix":"Publish an OpenAPI document for customer facing APIs on a developer portal.","test":"web"},{"id":"open_banking","door":"connect","title":"Developer and data sharing program","status":"partial","points":2,"maxPoints":4,"finding":"A developer portal or aggregator connection is mentioned, without a described data sharing program.","evidence":[{"label":"Developer portal","value":"https://www.postman.com/product/mcp-server/","url":"https://www.postman.com/product/mcp-server/"}],"why":"A data sharing program with a developer portal and standard APIs gives agents a consented path to customer data. Open banking is the best known example.","fix":"Document the program, the standard in use (for example FDX in US banking), the supported partners and a sandbox.","test":"web"},{"id":"webmcp_tools","door":"connect","title":"Browser tools exposed to agents","status":"fail","points":0,"maxPoints":3,"finding":"The sign in and home pages register no browser tools for agents.","evidence":[],"why":"WebMCP lets a page register tools that a browser agent can call directly instead of clicking through the interface.","fix":"Register tools for safe tasks such as location search and price lookup with navigator.modelContext.","test":"web"},{"id":"oauth_metadata","door":"identity","title":"OAuth and OpenID metadata","status":"pass","points":5,"maxPoints":5,"finding":"Authorization server metadata is published at mcp.postman.com.","evidence":[{"label":"Issuer","value":"https://mcp.postman.com","url":"https://mcp.postman.com/.well-known/oauth-authorization-server"},{"label":"Grant types","value":"authorization_code, refresh_token"},{"label":"Scopes listed","value":"0"}],"why":"Published authorization server metadata tells a client where to send a customer to approve access.","fix":"Publish /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource for the customer facing APIs.","test":"web"},{"id":"pkce_registration","door":"identity","title":"PKCE and client registration","status":"pass","points":4,"maxPoints":4,"finding":"PKCE with S256 and a registration path for new clients are both published.","evidence":[{"label":"PKCE S256","value":"supported"},{"label":"Dynamic registration","value":"supported"},{"label":"Client ID metadata documents","value":"not listed"}],"why":"PKCE protects the approval step. Dynamic registration or client metadata documents let a new agent onboard without a manual review each time.","fix":"Require PKCE with S256 and support client ID metadata documents or dynamic client registration for approved agent clients.","test":"web"},{"id":"passkeys","door":"identity","title":"Passkeys at sign in","status":"unknown","points":0,"maxPoints":4,"finding":"The sign in form was not available in a form the scan can inspect, so passkey support was not measured.","evidence":[],"why":"A passkey lets a customer approve an agent action with a device gesture. It removes the passwords and one time codes that agents cannot handle.","fix":"Offer passkeys with conditional UI on the sign in page and for step up approvals.","test":"login"},{"id":"high_assurance","door":"identity","title":"High assurance authorization profile","status":"fail","points":0,"maxPoints":3,"finding":"No high assurance authorization features were found.","evidence":[],"why":"Pushed authorization requests, sender constrained tokens and rich authorization requests let a provider approve one specific action instead of a blanket login.","fix":"Support PAR with DPoP or mutual TLS, and rich authorization requests for payments and account changes.","test":"web"},{"id":"delegate_access","door":"identity","title":"Documented delegate and data sharing controls","status":"fail","points":0,"maxPoints":4,"finding":"No public page on delegate access or connected app controls was found.","evidence":[],"why":"Customers need a place to see and revoke what an agent can do. Organizations need a documented route for authorized agents.","fix":"Publish a help page on delegate access and add a connected apps screen where customers revoke access.","test":"web"},{"id":"declared_agent_homepage","door":"web","title":"Home page for a declared agent","status":"pass","points":3,"maxPoints":3,"finding":"The home page loaded normally for a declared agent.","evidence":[{"label":"Status","value":"200"},{"label":"Response time","value":"338 ms"}],"why":"A declared agent that is challenged or blocked at the first step cannot help the customer at all.","fix":"Allow declared agents through bot management on public pages, and verify them with signed requests.","test":"login"},{"id":"signin_reachable","door":"web","title":"Sign in page loads for a declared agent in a browser","status":"fail","points":0,"maxPoints":4,"finding":"The sign in page did not load for an agent or a standard automated browser.","evidence":[{"label":"Declared agent","value":"blocked (HTTP 403)"},{"label":"Standard browser","value":"blocked (HTTP 403)"},{"label":"Page","value":"https://identity.getpostman.com/login","url":"https://identity.getpostman.com/login"}],"why":"Where a customer must use the website, a browser agent has to reach the sign in page so it can hand control back to the customer.","fix":"Serve the sign in page to verified agent browsers, and use signed agent identity to separate them from attackers.","test":"login"},{"id":"agent_browser_parity","door":"web","title":"Same behavior for a declared agent and a standard browser","status":"fail","points":0,"maxPoints":2,"finding":"Both loads were blocked.","evidence":[{"label":"Declared","value":"blocked"},{"label":"Browser","value":"blocked"}],"why":"If a declared agent is treated worse than an anonymous browser, honesty is penalized and agents will hide what they are.","fix":"Do not rank declared agents below anonymous browsers in bot management policy.","test":"login"},{"id":"form_semantics","door":"web","title":"Sign in form structure and autofill hints","status":"unknown","points":0,"maxPoints":4,"finding":"No sign in fields were present in the loaded page. The form may open after a click or load from a separate host.","evidence":[],"why":"Labels and autocomplete hints let an agent and a password manager find the right field and hand over to the customer at the right moment.","fix":"Label every field and set autocomplete values for the username, the current password and the one time code.","test":"login"},{"id":"semantic_markup","door":"web","title":"Semantic page structure","status":"partial","points":1,"maxPoints":2,"finding":"The page structure is only partly readable by agents.","evidence":[{"label":"Landmarks","value":"2"},{"label":"Headings","value":"3"},{"label":"Named controls","value":"100 percent"},{"label":"Images with alt text","value":"100 percent"}],"why":"Landmarks, headings and named controls let an agent read the page the way a screen reader does.","fix":"Use landmark elements, headings in order, accessible names on buttons and alt text on images.","test":"login"},{"id":"terms_stance","door":"policy","title":"Terms on automated access","status":"partial","points":2,"maxPoints":4,"finding":"The terms read are silent on agents and automated agents.","evidence":[],"why":"Terms that prohibit all automated access with no exception make every agent a violation, even when the customer authorized it.","fix":"Add an exception for authorized agents acting for the customer through approved interfaces.","test":"web"},{"id":"third_party_rules","door":"policy","title":"Third party access and data sharing rules","status":"fail","points":0,"maxPoints":3,"finding":"No third party access rules were found in the documents read.","evidence":[],"why":"Published rules tell customers and developers what is allowed. That keeps agents on approved paths.","fix":"Publish a third party access policy that names the approved interfaces and the consent model.","test":"web"},{"id":"ai_position","door":"policy","title":"Published position on AI agents","status":"pass","points":3,"maxPoints":3,"finding":"Published documents describe AI agents.","evidence":[{"label":"Excerpt","value":"…Terms outline the rules and guidelines for using Postman's services.Learn more →For AI agents: the clean markdown version of this page is available at https://www.postman.com/legal.md","url":"https://www.postman.com/legal/"}],"why":"A public position tells customers whether an agent acting for them is welcome, and under what conditions.","fix":"Publish a page that states how customer agents are handled and where to connect them.","test":"web"},{"id":"poppy_discovery","door":"connect","title":"Poppy file for personal agents","status":"unknown","points":0,"maxPoints":0,"bonus":0,"bonusMax":3,"finding":"The site refused the scanner at the Poppy address, so the file could not be checked.","evidence":[{"label":"Address checked","value":"https://www.postman.com/.well-known/poppy.json","url":"https://www.postman.com/.well-known/poppy.json"}],"why":"Poppy is an open draft standard from Sierra and Meta. A company publishes one small file that tells a customer's personal agent how to find it, how the customer signs in and which route to use: the company's own agent, an API or the website. Eight launch partners and dozens of design partners back it.","fix":"Publish a poppy.json file in the well known folder of your website. It names your organization, your sign in server and at least one route. Then make your sign in server list your domain in poppy_domains. The standard is a draft, so treat this as early work.","test":"web"}],"homeAgentFetch":{"status":200,"ms":338,"bytes":501428,"blocked":false,"thin":false},"login":{"url":"https://identity.getpostman.com/login","source":"link on home page","validated":false,"candidates":[{"url":"https://identity.getpostman.com/login","source":"link on home page"},{"url":"https://identity.getpostman.com/login?_pmt=pmMTc5MTAyNzIxNjAyMA%3D%3D%7CPM.MjAyNi0xMC0wM1QxMTozMzozNi4wMjBa&anon=4dcdcd77-26d6-4e39-89b8-ce137c31a629&_pm_handover=eyJ1aWQiOiJQTS5NakF5TmkweE1DMHdNMVF4TVRvek16b3pOaTR3TWpCYSIsImlhdCI6MTc5MTAyNzIyOCwiZXhwIjoxNzkxMDI3NTI4LCJhdWQiOiJpZGVudGl0eS5nZXRwb3N0bWFuLmNvbSIsImlzcyI6Ind3dy5wb3N0bWFuLmNvbSJ9.rYO_NW4VNioDwGGQAywv3yqIWFENtyg4bU0BBG6JQ_w","source":"after clicking the sign in control"},{"url":"https://www.postman.com/login","source":"common path"},{"url":"https://www.postman.com/signin","source":"common path"},{"url":"https://www.postman.com/sign-in","source":"common path"},{"url":"https://www.postman.com/online-banking/login","source":"common path"}],"menu":{"clicked":true,"label":"Sign In","navigatedTo":"https://identity.getpostman.com/login?_pmt=pmMTc5MTAyNzIxNjAyMA%3D%3D%7CPM.MjAyNi0xMC0wM1QxMTozMzozNi4wMjBa&anon=4dcdcd77-26d6-4e39-89b8-ce137c31a629&_pm_handover=eyJ1aWQiOiJQTS5NakF5TmkweE1DMHdNMVF4TVRvek16b3pOaTR3TWpCYSIsImlhdCI6MTc5MTAyNzIyOCwiZXhwIjoxNzkxMDI3NTI4LCJhdWQiOiJpZGVudGl0eS5nZXRwb3N0bWFuLmNvbSIsImlzcyI6Ind3dy5wb3N0bWFuLmNvbSJ9.rYO_NW4VNioDwGGQAywv3yqIWFENtyg4bU0BBG6JQ_w","linkCount":2,"hasPasswordField":false},"shots":{"agent":"/data/shots/postman_com_login_agent.jpg","browser":"/data/shots/postman_com_login_browser.jpg","home":"/data/shots/postman_com_home.jpg","menu":"/data/shots/postman_com_login_menu.jpg"},"agent":{"finalUrl":"https://identity.getpostman.com/login","status":403,"title":"Just a moment...","ms":4790,"blocked":true,"blockReason":"HTTP 403","thin":false,"uaLabel":"declared agent","error":null,"vendors":[{"name":"Cloudflare","evidence":["cookie __cf_bm","host challenges.cloudflare.com","host brunhild.challenges.cloudflare.com","header cf-ray"]}],"textPreview":"identity.getpostman.com Performing security verification This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot. Ray ID: a44ba2974e87c98b Performance and Security by Cloudflar"},"browser":{"finalUrl":"https://identity.getpostman.com/login","status":403,"title":"Just a moment...","ms":4484,"blocked":true,"blockReason":"HTTP 403","thin":false,"uaLabel":"browser","error":null,"vendors":[{"name":"Cloudflare","evidence":["cookie __cf_bm","host challenges.cloudflare.com","host brunhild.challenges.cloudflare.com","header cf-ray"]}],"textPreview":"identity.getpostman.com Performing security verification This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot. Ray ID: a44ba2b588fff493 Performance and Security by Cloudflar"},"botDefense":[{"name":"Cloudflare","evidence":["cookie __cf_bm","host challenges.cloudflare.com","host brunhild.challenges.cloudflare.com","header cf-ray"]}],"passkeys":{"found":false,"runtimeObserved":false,"evidence":[]},"fields":[]},"protocols":{"mcp":{"cards":[],"endpoints":[{"url":"https://mcp.postman.com/mcp","getStatus":405,"contentType":"application/json; charset=utf-8","confirmed":true,"authRequired":true,"challenge":{"raw":"Bearer resource_metadata=\"https://mcp.postman.com/.well-known/oauth-protected-resource/mcp\"","resourceMetadata":"https://mcp.postman.com/.well-known/oauth-protected-resource/mcp","scheme":"bearer"},"resourceMetadata":"https://mcp.postman.com/.well-known/oauth-protected-resource/mcp","resource":{"url":"https://mcp.postman.com/.well-known/oauth-protected-resource/mcp","resource":"https://mcp.postman.com/mcp","authorizationServers":["https://mcp.postman.com"],"scopes":[],"bearerMethods":["header"]},"tools":null}],"resources":[{"url":"https://mcp.postman.com/.well-known/oauth-protected-resource/mcp","resource":"https://mcp.postman.com/mcp","authorizationServers":["https://mcp.postman.com"],"scopes":[],"bearerMethods":["header"]}],"registry":{"checked":true,"matches":[{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.11.0","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.11.1","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.11.2","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.12.0","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"Give your AI agents trusted access to the full Postman platform.","version":"2.12.2","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"Give your AI agents trusted access to the full Postman platform.","version":"2.12.3","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"Give your AI agents trusted access to the full Postman platform.","version":"2.13.0","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.4.2","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.4.9","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.5.1","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.5.2","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.5.4","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.6.0","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.6.1","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.7.0","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.7.1","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.8.1","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.8.2","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.8.4","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.8.7","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.8.9","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.9.0","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true},{"name":"com.postman/postman-mcp-server","description":"A basic MCP server to operate on the Postman API.","version":"2.9.1","remotes":["https://mcp.postman.com/mcp","https://mcp.postman.com/minimal","https://mcp.eu.postman.com/mcp","https://mcp.eu.postman.com/minimal"],"verified":true}]},"mentions":[{"url":"https://www.postman.com/product/mcp-server/","snippet":"ic API in the Postman API Network into an MCP server.Learn more →FAQWhat is MCP?Model Context Protocol (MCP) is an open standard that enables applications to share context with large language models (LLMs), making it ea…"},{"url":"https://www.postman.com/solutions/api-governance/","snippet":"umption in mind.×Agents produce specs that violate every standard the org wrote×MCP makes governed APIs the agent's discovery surface×One ruleset must cover human and agent authors alikeChallenge 6The do"},{"url":"https://www.postman.com/solutions/api-lifecycle-management/","snippet":"Review)×51% of organizations have deployed AI agents; only 24% design APIs with agents in mind (Postman State of the API 2025)×MCP SDK monthly downloads passed 97 million in early 2026Postman has helped us make shift-le…"}],"found":true,"live":true,"protectedByOAuth":true,"registryListed":true,"checkedBases":5},"a2a":{"found":false},"aiPlugin":{"found":false},"agentsJson":{"found":false},"openapi":{"found":false},"llms":{"llmsTxt":{"found":true,"status":200,"url":"https://www.postman.com/llms.txt","bytes":24494,"links":91,"preview":"# Postman > Postman is an AI-native API engineering platform that helps developers and their AI agents design, develop, test, document, govern, manage, and distribute APIs and services. The platform enables teams to mov…"},"llmsFull":{"found":true,"status":200,"url":"https://www.postman.com/llms-full.txt","bytes":24494,"links":91,"preview":"# Postman > Postman is an AI-native API engineering platform that helps developers and their AI agents design, develop, test, document, govern, manage, and distribute APIs and services. The platform enables teams to mov…"}},"robots":{"found":true,"status":200,"url":"https://www.postman.com/robots.txt","bytes":3118,"sitemaps":["https://www.postman.com/sitemap.xml"],"managedAI":false,"agents":[{"agent":"ChatGPT-User","vendor":"OpenAI","kind":"assistant","allowed":"partial","rule":"5 disallowed paths","via":"ChatGPT-User"},{"agent":"Claude-User","vendor":"Anthropic","kind":"assistant","allowed":"partial","rule":"5 disallowed paths","via":"Claude-User"},{"agent":"Perplexity-User","vendor":"Perplexity","kind":"assistant","allowed":"partial","rule":"5 disallowed paths","via":"Perplexity-User"},{"agent":"Gemini-Deep-Research","vendor":"Google","kind":"assistant","allowed":"partial","rule":"5 disallowed paths","via":"Gemini-Deep-Research"},{"agent":"GPTBot","vendor":"OpenAI","kind":"crawler","allowed":"partial","rule":"5 disallowed paths","via":"GPTBot"},{"agent":"ClaudeBot","vendor":"Anthropic","kind":"crawler","allowed":"partial","rule":"5 disallowed paths","via":"ClaudeBot"},{"agent":"OAI-SearchBot","vendor":"OpenAI","kind":"search","allowed":"partial","rule":"5 disallowed paths","via":"OAI-SearchBot"},{"agent":"PerplexityBot","vendor":"Perplexity","kind":"search","allowed":"partial","rule":"5 disallowed paths","via":"PerplexityBot"},{"agent":"Google-Extended","vendor":"Google","kind":"crawler","allowed":"partial","rule":"5 disallowed paths","via":"Google-Extended"},{"agent":"Applebot-Extended","vendor":"Apple","kind":"crawler","allowed":"partial","rule":"5 disallowed paths","via":"Applebot-Extended"},{"agent":"CCBot","vendor":"Common Crawl","kind":"crawler","allowed":"partial","rule":"5 disallowed paths","via":"CCBot"},{"agent":"Bytespider","vendor":"ByteDance","kind":"crawler","allowed":false,"rule":"Disallow: /","via":"Bytespider"}],"assistantsBlocked":[],"assistantsAllowed":[],"crawlersBlocked":["Bytespider"],"error":null},"sitemap":{"found":true,"url":"https://www.postman.com/sitemap.xml","entries":26,"isIndex":true,"hasHelp":false,"hasRates":true,"hasProducts":false},"webmcp":{"found":false,"tools":[],"declarativeForms":0,"markupHint":false},"structuredData":["Organization","ItemList"],"poppy":{"found":false,"blocked":true,"unreachable":false,"tried":[{"host":"www.postman.com","status":406},{"host":"postman.com","status":406}],"url":"https://www.postman.com/.well-known/poppy.json"}},"identity":{"found":true,"servers":[{"issuer":"https://mcp.postman.com","url":"https://mcp.postman.com/.well-known/oauth-authorization-server","host":"mcp.postman.com","s256":true,"pkceMethods":["S256"],"dcr":true,"cimd":false,"par":false,"parRequired":false,"dpop":false,"mtls":false,"rar":false,"privateKeyJwt":false,"grantTypes":["authorization_code","refresh_token"],"scopes":[],"acrValues":[],"deviceFlow":false,"tokenExchange":false,"clientCredentials":false,"fapiLike":false}],"checkedHosts":20,"answeredHosts":11,"silentHosts":["e.postman.com","secure.postman.com","login.postman.com","sso.postman.com","signin.postman.com","online.postman.com","accounts.postman.com","digital.postman.com","connect.postman.com"]},"openBanking":{"pages":[{"url":"https://www.postman.com/product/api-client/","source":"site link","title":"API Client | Postman API Platform","terms":[],"aggregators":[],"excerpt":"Skip to main contentTest & ValidateAPI ClientSend requests, inspect responses, and debug any API in seconds.Get StartedRead DocsTrusted by teams atExplore, test, and debug APIs without writing codeEv…"},{"url":"https://www.postman.com/product/api-catalog/","source":"site link","title":"API Catalog | API Observability | Postman API Platform","terms":[],"aggregators":[],"excerpt":"Skip to main contentManage & OperateAPI CatalogOne pane of glass to view, manage, govern,and monitor every API and service.Get StartedTalk to SalesThe Postman API Catalog overview, showing fleet-wide…"},{"url":"https://www.postman.com/product/agent-mode/","source":"site link","title":"Agent Mode | Postman API Platform","terms":[],"aggregators":[],"excerpt":"Skip to main contentAgent ModeExplore, debug, and build APIs using natural language. Describe what you'd like to do to get started.Generate tests for my REST API's CRUD endpointsI want to create an A…"},{"url":"https://www.postman.com/product/mcp-server/","source":"site link","title":"Postman MCP Server: Connect AI Agents to Your API Workflows","terms":["apiReference","oauth"],"aggregators":[],"excerpt":"Skip to main contentMCP ServerGive your AI agents trusted access to the full Postman platform. Connect any MCP-compatible agent to 100+ Postman tools—collections, specs, environments, workspaces and …"},{"url":"https://www.postman.com/solutions/api-governance/","source":"site link","title":"API Governance | Postman API Platform","terms":[],"aggregators":[],"excerpt":"Skip to main contentPostman's AI-Native API PlatformAPI GovernanceClose the API Governance Gap. Before AI widens it.Governance is the framework that sits alongside the API at every step. Postman runs…"},{"url":"https://www.postman.com/solutions/partner-api-management/","source":"site link","title":"Partner API Management | Postman API Platform","terms":["sandbox","apiReference"],"aggregators":[],"excerpt":"Skip to main contentPostman's AI-Native API PlatformPartner API ManagementFirst call in minutes.Revenue that scales.Postman makes your APIs partner-ready: discoverable, runnable, and instrumented end…"},{"url":"https://www.postman.com/solutions/api-lifecycle-management/","source":"site link","title":"API Lifecycle Management | Postman API Platform","terms":[],"aggregators":[],"excerpt":"Skip to main contentPostman's AI-Native API PlatformAPI Lifecycle ManagementRun the whole API lifecycle on one platformPostman runs the full API lifecycle as one connected system for humans and agent…"}],"portal":{"url":"https://www.postman.com/product/mcp-server/","title":"Postman MCP Server: Connect AI Agents to Your API Workflows"},"fdx":false,"rule1033":false,"openBanking":false,"sandbox":true,"oauth":true,"dataAccessAgreement":false,"aggregators":[],"found":true},"policy":{"stance":"silent","documentsRead":5,"termsRead":1,"prohibits":[],"delegation":[],"thirdParty":[],"dataSharing":[],"ai":[{"type":"ai","label":"Mentions AI or agents","excerpt":"…Terms outline the rules and guidelines for using Postman's services.Learn more →For AI agents: the clean markdown version of this page is available at https://www.postman.com/legal.md","url":"https://www.postman.com/legal/","title":"Legal Terms Hub"},{"type":"ai","label":"Mentions AI or agents","excerpt":"…by security teams atPostman is now AI-native and so is our security model.APIs and AI agents are inseparable in the modern enterprise. Postman is the only platform that governs both with security…","url":"https://www.postman.com/security/","title":"Security"}],"credentialSharing":[],"documents":[{"url":"https://www.postman.com/legal/","title":"Legal Terms Hub","status":200,"textLength":2556,"blockedForAgent":false,"flags":["Mentions AI or agents"]},{"url":"https://www.postman.com/legal/terms/","title":"Terms of Service","status":200,"textLength":721,"blockedForAgent":false,"flags":[]},{"url":"https://www.postman.com/legal/postman-product-terms/","title":"Postman Product Terms","status":200,"textLength":715,"blockedForAgent":false,"flags":[]},{"url":"https://www.postman.com/legal/postman-website-terms-of-use/","title":"Website Terms of Use","status":200,"textLength":729,"blockedForAgent":false,"flags":[]},{"url":"https://www.postman.com/security/","title":"Security","status":200,"textLength":12716,"blockedForAgent":false,"flags":["Mentions AI or agents"]}]},"delegates":[],"voice":{"phone":{"e164":"+18886161665","pretty":"+1 888 616 1665","score":6,"context":"out your organization and we'll get in touch with you. You can also reach our sales team directly by phone at (888) 616-1665.Looking for support? Visit the Postman Support Center …","source":"https://www.postman.com/company/contact-sales/","tollFree":true,"seen":2,"kind":"customer service"},"candidates":[{"e164":"+18886161665","pretty":"+1 888 616 1665","score":6,"context":"out your organization and we'll get in touch with you. You can also reach our sales team directly by phone at (888) 616-1665.Looking for support? Visit the Postman Support Center …","source":"https://www.postman.com/company/contact-sales/","tollFree":true,"seen":2,"kind":"customer service"},{"e164":"+14157966470","pretty":"+1 415 796 6470","score":2,"context":"le continents.San Francisco (HQ)One Market Plaza1 Market StreetSteuart TowerSuite 0800San Francisco, CA 94105+1 415 796 6470info@postman.comGet directions →BangaloreBuilding no 31…","source":"https://www.postman.com/company/contact-us/","tollFree":false,"seen":1,"kind":"unclassified"},{"e164":"+13106846246","pretty":"+1 310 684 6246","score":2,"context":"art TowerSuite 0800San Francisco, CA 94105+1 415 796 6470info@postman.comGet directions →BangaloreBuilding no 3106th Main Road Indiranagar,Bangalore, Karnataka 560038, IndiaGet di…","source":"https://www.postman.com/company/contact-us/","tollFree":false,"seen":1,"kind":"unclassified"}],"status":"not_run","calls":[],"aggregate":null,"startedAt":null,"finishedAt":null,"progress":null,"note":null},"timeline":[{"step":"identify","label":"Identify the organization and load the home page","ms":16127,"ok":true},{"step":"robots","label":"Read robots rules for agents, llms.txt and sitemaps","ms":943,"ok":true},{"step":"cards","label":"Look for agent cards, OpenAPI documents and browser tools","ms":6441,"ok":true},{"step":"links","label":"Map sign in, terms, help and developer pages","ms":0,"ok":true},{"step":"login_agent","label":"Load the sign in page as a declared agent","ms":4956,"ok":true},{"step":"login_browser","label":"Load the sign in page as a standard browser","ms":4660,"ok":true},{"step":"openbanking","label":"Check developer portals and data sharing programs","ms":2621,"ok":true},{"step":"policy","label":"Read terms for automated access and delegation","ms":7899,"ok":true},{"step":"mcp","label":"Probe for MCP servers and check the official registry","ms":12669,"ok":true},{"step":"identity","label":"Discover OAuth and OpenID metadata","ms":25334,"ok":true},{"step":"phones","label":"Find published customer service phone numbers","ms":1302,"ok":true}],"previous":null,"brand":{"src":"/data/logos/postman_com.png?v=144d4902","kind":"icon","invert":false,"tile":false,"w":160,"h":144,"source":"structured data","from":"https://voyager.postman.com/logo/postman-logo-orange-stacked.svg"},"summary":{"score":79,"measuredWeight":80,"provisional":true,"calibration":1,"level":{"id":3,"name":"Connectable","summary":"An agent can connect through an MCP server or a public API program.","nextLevel":{"id":4,"name":"Trusted","need":"Let customers authorize agents: OAuth with PKCE, a registration path and documented delegate controls."}},"doors":[{"id":"discover","name":"Discoverability","weight":15,"measured":true,"score":93,"raw":73,"points":13.9},{"id":"connect","name":"Protocol access","weight":20,"measured":true,"score":84,"raw":60,"points":16.8},{"id":"identity","name":"Identity and delegation","weight":20,"measured":true,"score":81,"raw":56,"points":16.2},{"id":"web","name":"Web experience","weight":15,"measured":true,"score":60,"raw":36,"points":8.9},{"id":"voice","name":"Voice and IVR","weight":20,"measured":false,"score":null,"points":0,"completed":0,"total":6},{"id":"policy","name":"Policy and governance","weight":10,"measured":true,"score":75,"raw":50,"points":7.5}],"strengths":["MCP server","OAuth and OpenID metadata","PKCE and client registration"],"gaps":[{"id":"delegate_access","title":"Documented delegate and data sharing controls","lost":4},{"id":"signin_reachable","title":"Sign in page loads for a declared agent in a browser","lost":4},{"id":"webmcp_tools","title":"Browser tools exposed to agents","lost":3},{"id":"high_assurance","title":"High assurance authorization profile","lost":3}],"headline":"Postman reaches level 3, Connectable. Discoverability is the strongest area at 93 out of 100. Web experience is the weakest at 60."},"assistantDay":[{"id":"balance","job":"Check my account","outcome":"works","steps":[{"status":"ok","text":"MCP server: the agent connects and the customer approves access with OAuth."},{"status":"fail","text":"Website: the sign in page is blocked for the agent's browser.","detail":"The sign in page did not load for an agent or a standard automated browser."},{"status":"untested","text":"Phone line: not tested yet."}]},{"id":"rates","job":"Compare plans","outcome":"works","steps":[{"status":"ok","text":"Website: pricing and product pages are readable by agents without signing in."},{"status":"untested","text":"Phone line: not tested yet."}]},{"id":"human","job":"Get me to a person","outcome":"untested","steps":[{"status":"untested","text":"Phone line: not tested yet."}]}],"history":[{"at":"2026-10-03T11:34:58.057Z","score":79,"level":3,"levelName":"Connectable","cal":1,"doors":{"discover":93,"connect":84,"identity":81,"web":60,"policy":75},"pts":{"robots_assistants":2,"llms_txt":3,"structured_data":1,"server_rendered":3,"sitemap_content":2,"mcp_server":8,"a2a_agent_card":0,"openapi_docs":2,"open_banking":2,"webmcp_tools":0,"oauth_metadata":5,"pkce_registration":4,"passkeys":0,"high_assurance":0,"delegate_access":0,"declared_agent_homepage":3,"signin_reachable":0,"agent_browser_parity":0,"form_semantics":0,"semantic_markup":1,"terms_stance":2,"third_party_rules":0,"ai_position":3,"poppy_discovery":0}}]}