{ "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-13T23:52:59.204Z", "record_id": "VXI-EXT-TOOL-TRUST-POSTMAN-01-v1", "record_kind": "external_reference", "title": "Postman MCP: Region, credentials and tool-set scope", "system": "Postman MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Which Postman MCP configuration fits API discovery without granting unnecessary workspace changes?", "near_questions": [ "Is Postman Minimal MCP guaranteed read-only?", "Can the Postman MCP Learn configuration search documentation?", "Which Postman MCP variant needs an API key?", "Does the EU Postman MCP server support OAuth?", "Can local Postman MCP avoid all external data transfer?", "What can Full Postman MCP change?", "Does Postman Context Graph require team enablement?", "Which workspace rights does my Postman agent inherit?", "Should an agent receive internal API environment values?", "How do Postman local and remote telemetry defaults differ?", "What should I preserve when reviewing a Postman connection?", "When should Postman tool access be reviewed again?" ], "supported_claims": [ { "claim": "Postman documents separate tool configurations and local or remote servers. Minimal is a smaller tool set, not a stated read-only guarantee. US remote authentication supports OAuth; the EU remote and local variants use an API key. Match the region, identity and specific tools to the task before connecting.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "Postman documents separate tool configurations and local or remote servers. Minimal is a smaller tool set, not a stated read-only guarantee. US remote authentication supports OAuth; the EU remote and local variants use an API key. Match the region, identity and specific tools to the task before connecting.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-ZAPIER-01-v1", "VXI-EXT-TOOL-TRUST-DOCKER-01-v1", "VXI-EXT-TOOL-TRUST-SHOPIFY-CART-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "Postman MCP variants and tool sets", "source_url": "https://learning.postman.com/docs/reference/postman-api/postman-mcp-server/overview", "checked_on": "2026-10-14", "candidate_record_id": "VXI-EXT-TOOL-TRUST-POSTMAN-01-v1", "candidate_record_sha256": "544df8142100dd42d25e7917de23dcef932865be878fc16d12b2a778776f309b", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Postman documents separate tool configurations and local or remote servers. Minimal is a smaller tool set, not a stated read-only guarantee. US remote authentication supports OAuth; the EU remote and local variants use an API key. Match the region, identity and specific tools to the task before connecting.", "required_buyer_context": "Postman account region, server variant, tool configuration, workspace rights and API data classification.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "Postman MCP", "variant": "Publisher remote and local variants; US and EU authentication differ" }, "review_status": "documentation_review_only", "checked_on": "2026-10-14", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Postman publishes remote and local MCP variants.", "source_ids": [ "postman-main" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "The integration manages API workspaces, collections, specifications and related resources.", "source_ids": [ "postman-main" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Documentation search and API-definition or workspace context depend on the selected configuration.", "source_ids": [ "postman-main" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Management tools can create or change collections, workspaces and environments.", "source_ids": [ "postman-main" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "OAuth is supported on the US remote service; EU remote and local servers require a Postman API key.", "source_ids": [ "postman-main" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Minimal, Code, Full, Learn and Context Graph expose different tool sets; Context Graph requires team enablement.", "source_ids": [ "postman-main" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Internal API definitions may be passed to the client and its model. A local MCP process still interacts with Postman services.", "source_ids": [ "postman-main" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Confusing Minimal with read-only, or selecting the wrong region and authentication flow, can invalidate a connection review.", "source_ids": [ "postman-main" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Account rights, chosen tools, connected API secrets and downstream client retention are unverified.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Confirm region and specific operations before accessing internal definitions or allowing workspace mutations.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "postman-main", "url": "https://learning.postman.com/docs/reference/postman-api/postman-mcp-server/overview", "final_url": "https://learning.postman.com/docs/reference/postman-api/postman-mcp-server/overview", "title": "Postman MCP variants and tool sets", "checked_on": "2026-10-14", "sha256": "16d8c0f580b8bf02d8e03936608680755c37ce6a8dd0aa7e16c72dc7aac63663", "bytes": 254476 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Preserve the region and tool-set assumptions behind an API discovery connection.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Recheck tool configuration, account region, credentials and workspace membership." }, "change_history": [ { "version": 1, "date": "2026-10-14", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#postman-mcp-region-toolset-trust", "machine_readable_record": "/varexis-index/records/postman-mcp-region-toolset-trust.json" }