API Testing MCP

@cocaxcode/api-testing-mcp

The most complete MCP server for API testing. Period.

42 MCP tools · Zero config · Works in any MCP client

Overview · Just Talk to It · Installation · Features · Tool Reference · Storage · Architecture

---

Quick Overview

The most complete MCP server for API testing — 42 tools, zero config, nothing else comes close. This is not just a request sender. It is a full testing workbench: HTTP requests with assertions, multi-step flows with variable extraction, OpenAPI import with schema-aware mock data, load testing with percentile metrics, response diffing across environments, bulk test runners, reusable collections, environment groups with directory scoping and persistent defaults, Postman import/export, and cURL export. All from natural conversation. No accounts, no cloud, no generated files. Everything runs inline and stores as plain JSON you own.

---

Just Talk to It

You don't need to learn tool names or parameters. Describe what you want and the AI picks the right tool.

"Create a group called my-project and add this directory as scope"

"Set up a dev environment with BASE_URL http://localhost:3000" "Switch to prod for this session" "Set dev as the default environment" "Import my API spec from /api-docs-json" "Show me all user endpoints" "GET /users" "Create a user with random data" "Verify that DELETE /users/5 returns 204" "Login as admin, extract the token, then fetch dashboard stats" "How fast is /health with 50 concurrent requests?" "Run all my saved smoke tests" "Compare the users endpoint between dev and prod" "Export the create-user request as curl" "Export my collection to Postman"

If you've imported an OpenAPI spec, the AI already knows every endpoint, every required field, every valid enum value. When you say "create a blog post", it reads the schema and builds the request correctly — no guessing.

---

Installation

Claude Code

claude mcp add --scope user api-testing -- npx -y @cocaxcode/api-testing-mcp@latest

Claude Desktop

Add to your config file (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):

{

"mcpServers": { "api-testing": { "command": "npx", "args": ["-y", "@cocaxcode/api-testing-mcp@latest"] } } }

Cursor / Windsurf

Add to .cursor/mcp.json or .windsurf/mcp.json in your project root:

{

"mcpServers": { "api-testing": { "command": "npx", "args": ["-y", "@cocaxcode/api-testing-mcp@latest"] } } }

VS Code / Codex CLI / Gemini CLI

VS Code — add to .vscode/mcp.json:

{

"servers": { "api-testing": { "command": "npx", "args": ["-y", "@cocaxcode/api-testing-mcp@latest"] } } }

Codex CLI (OpenAI):

codex mcp add api-testing -- npx -y @cocaxcode/api-testing-mcp@latest

Or add to ~/.codex/config.toml:

[mcp_servers.api-testing]

command = "npx" args = ["-y", "@cocaxcode/api-testing-mcp@latest"]

Gemini CLI — add to ~/.gemini/settings.json:

{

"mcpServers": { "api-testing": { "command": "npx", "args": ["-y", "@cocaxcode/api-testing-mcp@latest"] } } }

Quick Start

Once installed, set up an environment so relative paths resolve automatically:

"Create an environment called dev with BASE_URL http://localhost:3000"

If your API has a Swagger/OpenAPI spec, import it:

"Import my API spec from http://localhost:3000/api-docs-json"

Verify with: *"List my environments"* — you should see the one you just created.

---

Features

HTTP Requests

Send any HTTP method with headers, query params, JSON body, auth, and {{variable}} interpolation. Relative URLs auto-resolve against BASE_URL.

"POST to /api/users with name Jane and email jane@company.com using my bearer token"

Supports: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS — Bearer / API Key / Basic auth — custom timeouts.

Compression modes (v0.13+)

AI agents pay for every byte that lands in their context window. By default, request now returns a compressed response that cuts 70-95% of those tokens without losing debugging value. Three optional parameters control it:

Modes:

• `minimal` — only status, timing, size_bytes, first 200 chars of body. Perfect for health checks, polling loops, or fire-and-forget calls. *Saves ~95% tokens.*
• `normal` *(default)* — filtered headers (drops Date, Server, CF-*, Set-Cookie, etc.) + body truncated to max_body_bytes. Covers ~80% of debugging use cases. *Saves ~75% tokens.*
• `full` — complete response untouched. Use when you explicitly need every header or the full body.

Typical savings on a 5 KB JSON response (≈1,500 tokens):

For a head-to-head comparison against curl, WebFetch and other native alternatives with measured numbers, see Native alternatives below.

Recovering full responses: every compressed response includes a call_id. If you need the full body later, call inspect_last_response({ call_id }) — no need to re-execute the request. This works for request, assert, and each step of flow_run. Responses are kept in a 20-slot ring buffer and persisted to .api-testing/last-responses/ with a 1-hour TTL.

// Example: normal (default) response

{ "call_id": "k3m9a2xp", "status": 200, "statusText": "OK", "method": "GET", "url": "https://api.example.com/users/1", "timing": { "total_ms": 142 }, "size_bytes": 5324, "headers": { "content-type": "application/json" }, "body": { "id": 1, "email": "...", "...": "..." }, "body_truncated": true, "hint": "Body truncated to 2048 bytes (full size: 5324B). Call inspect_last_response({ call_id: \"k3m9a2xp\" }) for the full body.", "tokens_saved_estimate": 820 }

Native alternatives: real token cost

How this MCP compares against the native options Claude Code has when api-testing is not available (Bash + curl, WebFetch, etc.).

TL;DR: compared to raw curl, request saves between 65% and 97% of context tokens depending on the mode, with no loss of debugging information. Measured on a real call to GET /api/v1/blog returning 8 posts (~8.7 KB of JSON, 19 response headers):

Why this table's numbers differ slightly from the "Compression modes" section above: these come from a single real-world response, while the previous table shows typical savings on a synthetic 5 KB response. Trend and order of magnitude are the same.

Notes:

• The default mode (normal) already saves 65% without any configuration: it filters out noisy headers (Date, Server, CF-*, Set-Cookie…) and caps the body at 2048 bytes.
• only_fields accepts dot-paths with array index and wildcard support (items[*].name) — returns only the fields you ask for.
• The MCP also adds features that have no direct native equivalent: {{variable}} interpolation, stored environments, auth schemas, flows, Postman import/export, and inspect_last_response to recover the full body without re-hitting the server.
• Every registered MCP adds a fixed overhead of ~300-600 tokens per session (its instructions block + tool names). Typical break-even: 1-2 real calls per session.

Assertions

Validate responses with structured pass/fail results:

"Verify that GET /api/health returns 200, body.status is ok, and responds in under 500ms"

PASS — 3/3 assertions passed

status === 200 body.status === "ok" timing.total_ms < 500

10 operators: eq, neq, gt, gte, lt, lte, contains, not_contains, exists, type

Request Flows

Chain requests with variable extraction between steps. Perfect for auth flows and CRUD sequences.

"Login as admin@test.com, extract the access token, then use it to fetch all users"

What the tool executes

flow_run({

steps: [ { name: "login", method: "POST", url: "/auth/login", body: { email: "admin@test.com", password: "SecurePass#99" }, extract: { "TOKEN": "body.access_token" } }, { name: "get-users", method: "GET", url: "/api/users", headers: { "Authorization": "Bearer {{TOKEN}}" } } ] })

OpenAPI Import

Import specs from a URL or local file (JSON and YAML). Once imported, the AI knows every endpoint, parameter, and schema.

"Import my API spec from http://localhost:3000/api-docs-json"

"Import the spec from ./openapi.yaml" "What parameters does POST /users expect?"

Supports OpenAPI 3.x with full $ref resolution, allOf, oneOf, anyOf. OpenAPI 2.0 partially supported.

Mock Data Generation

Generate realistic fake data from your OpenAPI schemas. Respects types, formats (email, uuid, date-time), enums, and required fields.

"Generate mock data for creating a user"

{

"email": "user42@example.com", "name": "Test User 73", "password": "TestPass123!", "role": "admin" }

Load Testing

Fire N concurrent requests and get performance metrics:

"How fast is the health endpoint with 50 concurrent requests?"

LOAD TEST — GET /api/health

Requests: 50 concurrent Successful: 50 | Failed: 0 Req/sec: 23.31

Min: 45ms | Avg: 187ms p50: 156ms | p95: 412ms | p99: 523ms Max: 567ms

Response Diffing

Execute two requests and compare their responses field by field. Detect regressions or compare environments.