MCP REST API Tester
MCP server: an agent sends GET, POST, PUT, DELETE and PATCH to your REST API and gets back status, headers and body
- 103 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The server sends requests with your authorization to any path the agent names under the base URL, including PUT and DELETE, which change data
- Tokens and passwords sit in the client settings in plain text
- Turning off SSL checking leaves the connection open to certificate spoofing
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/mcp-rest-api-testerDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The server sends requests with your authorization to any path the agent names under the base URL, including PUT and DELETE, which change data
- Tokens and passwords sit in the client settings in plain text
- Turning off SSL checking leaves the connection open to certificate spoofing
This is third-party code. Review the repository files before installing.
What it does
MCP REST API Tester gives the agent a single tool, `test_request`. The agent names the method and path and, if needed, a body and headers; the server sends the request to the address in `REST_BASE_URL` and returns the status code, headers, body and timing. The server fills in authorization itself: Basic, a Bearer token or an arbitrary key header. Only one method is configured at a time, with priority Basic first, then Bearer, then the header key. Shared headers are set with variables like `HEADER_X-API-Version` and can be overridden in a single request. Large responses are cut to 10,000 bytes by default, the limit changes with `REST_RESPONSE_SIZE_LIMIT`, and the response carries a truncation note. SSL certificate checking can be turned off for self-signed certificates through `REST_ENABLE_SSL_VERIFY`.
Who it is for. API developers who want to check endpoints without leaving Cline or Claude Desktop, and without writing a separate curl for every request.
Good fit when
- A new endpoint is ready and the agent should call it with different bodies and show what comes back
- After a backend change you want to confirm that error codes and the response format did not move
- A local server with a self-signed certificate is checked over HTTPS
- Requests to a private API need a Bearer token or a header key, and filling them in by hand is a chore
- The response is huge and the agent needs only the first kilobytes plus the truncation note
Not a fit when
- Load tests and scenario chains: the server sends single requests and does not measure throughput
- You need a request collection for the whole team: Postman fits better
- The API uses OAuth with token refresh: only Basic, Bearer and a header key are supported
- The address belongs to someone else's system and you have no permission to test it
Example request
Send a POST to /users with the name John Doe and the email john@example.com and show the status code, headers and bodyMCP
- Transport
- stdio
- Authentication
- key is optional
Environment variables
REST_BASE_URLrequired- Base URL of the API under test
AUTH_BEARERsecret- Bearer token, if the API uses it
AUTH_BASIC_PASSWORDsecret- Password for Basic authorization
AUTH_APIKEY_VALUEsecret- Key value for the header named in `AUTH_APIKEY_HEADER_NAME`
REST_ENABLE_SSL_VERIFY- SSL verification, `false` turns it off
REST_RESPONSE_SIZE_LIMIT- Maximum response size in bytes, 10000 by default
Limitations
The last commit in the repository dates from April 2026; the package version is 0.4.0. The README instructions are written for Cline: settings paths are given for Windows and macOS, and for other clients you have to carry the config format over yourself. On Windows `npx` in the settings does not always work, so the README advises giving the full path to `build/index.js` instead of `%APPDATA%`. SSL checking is on by default; turning it off is acceptable only for development.
How to disable. Remove the `rest-api` block from `mcpServers` in the client settings and restart it. The package is removed with `npm uninstall -g dkmaker-mcp-rest-api`.
FAQ
How do I connect MCP REST API Tester?
Install the package with `npm install -g dkmaker-mcp-rest-api` or run it with `npx -y dkmaker-mcp-rest-api`. In your client's MCP settings add a server with that command and the `REST_BASE_URL` variable. After a restart the `test_request` tool appears.
Which authorization does the server support?
Basic through `AUTH_BASIC_USERNAME` and `AUTH_BASIC_PASSWORD`, Bearer through `AUTH_BEARER`, and a header key through `AUTH_APIKEY_HEADER_NAME` and `AUTH_APIKEY_VALUE`. If several are set, the first on the list applies: Basic, then Bearer, then the key.
Why does the response arrive truncated?
The server caps the response body at 10,000 bytes. The response carries a truncation note and keeps its structure. To get more, raise `REST_RESPONSE_SIZE_LIMIT` in the server `env`.
Can I test a site with a self-signed certificate?
Yes. Set `REST_ENABLE_SSL_VERIFY` to `false` and certificate checking is switched off. Do this only for your own local or test server.
How do I add my own header to every request?
Set a variable with the `HEADER_` prefix in the server `env`, for example `HEADER_X-API-Version` with the value `2.0`. The header name keeps its case, and a header from a single request overrides the shared one.
Discussion
No questions or reviews yet.
Related
MCP serversThe official MCP server debugger: web UI, automation CLI and terminal UI in one package
Postman's official MCP server: workspaces, collections, specs and environments straight from your agent
MCP Interviewer checks an MCP server before an agent connects: provider limits, tool tests and a Markdown report.
An MCP server that spins up several browser agents to test a site for broken links, UI bugs and accessibility issues
MCP server, agent and skills for end-to-end UI tests where the agent drives the computer through vision on cloud machines
METR
METR (MCP 1C:Enterprise Test Runner)
An MCP server that lets an agent update a 1C infobase, run YaXUnit tests and check syntax
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| MCP REST API Tester (this card) | no | key is optional | 103 | |
| Postman MCP Server | yes | OAuth | 326 | works with Postman collections and workspaces rather than single requests |
| Resterm | no | 2,008 | keeps requests and checks in text files for the terminal and CI instead of sending them on an agent call |
README in short
The README starts with an npm install, then gives a block of custom instructions for Cline and configs for Windows and macOS with the full list of environment variables. Below come the features, `test_request` call examples in TypeScript and development steps: clone, install dependencies and build.